What is the CVP Gateway Inspection Engine?

The eTrust Content Inspection Gateway component uses packet-processing technology to detect network objects in real-time. It can be configured to work with external applications that capture the network stream and assemble the files for inspection. In the eTrust Content Inspection CVP Edition, the Gateway component is configured with Check Point's FireWall-1.

Adding a "rule" to the FireWall-1's "rule-base" facilitates the integration of Check Point Software's FireWall-1 and eTrust Content Inspection. This rule will ensure that every executable entering the enterprise's network will be sent to eTrust Content Inspection, where it will be analyzed according to the enterprise's executables security plan. as set up by eTrust Content inspection. Once the executable is approved to enter the network, it will be sent to the client's workstation via FireWall-1.

CVP Gateway Application

The Gateway application communicates with the Control Center, so that it is updated with the organization's latest security policy. Each Gateway transfers to the Control Center details of objects analyzed; it's source and destination IP addresses, security violations and collisions, including the cause of the violation, and the date and time of analysis.

The organization's security policy is received from the Control Center and enforced at the Gateway level. All communications between the Gateway and the control Center use TCP/IP protocols, and these communications are fully authenticated, as are all communications between any of the eTrust Content Inspection components.

CVP Gateway User Interface

The Gateway interface lists all objects analyzed at the Gateway, and displays the number of downloadable objects passed and the number rejected, along with the date and time of the latest policy update.

CVP Gateway Information

The top section of the Gateway User Interface as shown above, provides the following information:

The name of the Gateway (Test-gate-05) The Control Center to which the Gateway is connected (Default Control Center) The number of objects analyzed (2078), the number of objects rejected (13), the date and the time that the Gateway was last activated, and the date and time when the security database was last updated.

CVP Gateway Object Information List

The lower part of the gateway user interface is the Object Information List, which provides the following information:

Client IP This refers to the name of the Client (workstation) that requested the download, as defined in the security plan. In the example above, the Client IP is 194.90.79.110. Object Name This field displays the URL address and path and filename of the object that was downloaded. In the example above, the Object Name of the first object is http://194.90.79.97:80/test/virus(do%20not%2. Status This field indicates whether the object was passed (i.e. executed), rejected (i.e. blocked and therefore not executed), or audited (i.e. logged in the Audit Viewer database). In the example above, the eighth Object was both rejected and audited. Date and Time This field displays the date and time when the object was analyzed. In the example above, the first Object was analyzed on 11/29/00 and the time was 10:03:13 AM