Web Network Security - Giải pháp bảo mật lớp ứng dụng/web
"Web Network Security" thường chỉ các giải pháp: Secure Web Gateway (SWG), Web Application Firewall (WAF), Cloud Access Security Broker (CASB), Remote Browser Isolation (RBI), DNS Security. Không phải một sản phẩm đơn lẻ cài file .exe.
Kiến trúc triển khai & "File" liên quan
1. Cloud-delivered (SASE/SSE) - Không cài file agent bắt buộc
| Giải pháp | Cơ chế | File/Component |
|---|
| SWG (Zscaler, Netskope, Cloudflare, iboss) | Proxy PAC file / DNS / GRE/IPsec Tunnel / Browser Extension | .pac file, browser extension (.crx/.xpi), root CA cert (.cer/.pem) |
| CASB (Netskope, Microsoft Defender for Cloud Apps, Bitglass) | API connector (OAuth), Reverse proxy, Forward proxy | API token, cert, proxy config |
| RBI (Menlo, Ericom, Cloudflare, Island) | Browser extension / Clientless / Isolated browser | Extension, custom browser binary, .pac |
| DNS Security (Cisco Umbrella, Quad9, Cloudflare 1.1.1.1 for Families) | DNS resolver change / Roaming client | Roaming client installer (.msi/.pkg/.deb), DoH/DoT config |
2. On-premise / Hybrid - Cần cài đặt phần mềm
| Sản phẩm | File cài đặt chính | Thành phần bổ sung |
|---|
| Blue Coat / Symantec ProxySG | SGOS firmware (.img), Management Center installer (.bin/.rpm) | Policy file (.xml), SSL cert, ICAP config |
| Forcepoint Web Security | Windows/Linux installer (.exe/.rpm), Virtual Appliance (.ova/.qcow2) | Policy bundle, DLP dictionary, CA cert |
| McAfee Web Gateway | Appliance ISO, VMware OVA, Hyper-V VHD | MWG configuration backup (.xml), cert |
| F5 BIG-IP ASM (WAF) | BIG-IP ISO/VE image (.iso/.qcow2), ASM policy (.xml) | iRules, SSL cert/key, GeoIP DB |
| ModSecurity (Open Source WAF) | Source code (.tar.gz), Apache/Nginx module (.so), CRS rule set (.conf) | OWASP CRS, custom rules, audit log config |
| Squid Proxy + SquidGuard | Source/package (squid, squidGuard), config file (squid.conf) | Blacklist DB (.db), SSL cert, LDAP config |
3. Endpoint Agent (Nếu có)
- Zscaler Client Connector (ZCC):
ZscalerClientConnector.msi (Windows), .pkg (Mac), .deb/.rpm (Linux) - Tunnel traffic to Zscaler cloud
- Netskope Client:
NetskopeClient.msi/.pkg/.deb - Steering traffic, device posture
- Cisco Umbrella Roaming Client:
Umbrella_Roaming_Client.msi/.pkg - DNS protection off-network
- Palo Alto GlobalProtect:
GlobalProtect.msi/.pkg/.apk - VPN + Host Info + Cloud-Delivered Security
File cấu hình quan trọng (Config Files)
| Loại | Ví dụ file | Nội dung |
|---|
| PAC File | proxy.pac, wpad.dat | JavaScript function FindProxyForURL(url, host) - điều hướng traffic qua proxy |
| SSL Cert/Key | ca.crt, server.pem, key.pem | TLS inspection (MITM proxy), mutual TLS |
| Policy/Rule | policy.xml, rules.yaml, crs-setup.conf | URL category, block/allow, DLP pattern, WAF rule (OWASP CRS) |
| Blocklist/Allowlist | domains.txt, urls.csv, ipset.netset | Danh sách domain/IP block/allow |
| DLP Dictionary | patterns.xml, regex.conf | Regex PII, credit card, source code, keyword |
Log & Data Files (Sinh ra khi chạy)
- Access log:
/var/log/squid/access.log, /opt/zwall/logs/access.log (format: squid, combined, json)
- Audit log: WAF audit log (ModSecurity:
/var/log/modsec_audit.log)
- Incident/Alert: SIEM ingestion (CEF, LEEF, JSON)
- Quarantine: File bị chặn (malware, DLP) - lưu cách ly
Best Practices quản lý file
- Version control: Policy, rule, config → Git (Infrastructure as Code)
- Immutable infrastructure: Deploy appliance/container từ image đã build, không sửa live
- Certificate management: Automate (cert-manager, ACME, Venafi) - tránh hết hạn
- Backup/Restore: Config backup hàng ngày, test restore quý
- Integrity check: Hash (SHA256) file binary, rule set - phát hiện tampering
Tóm tắt
"Web Network Security" không phải 1 file .exe duy nhất. Tùy kiến trúc (Cloud vs On-prem) và sản phẩm, các file liên quan bao gồm: Installer (MSI/OVA/ISO), PAC file, SSL Cert, Policy/Rule file, Blocklist, Agent installer, Log file. Xu hướng: Cloud-native, agentless, API-driven, config-as-code.
