Blocking File Types
You can block or allow the uploading or downloading of certain content based on the file type.
The Web Security Service determines file types by checking:
- The file's signature
- The reply header's content-type value
- The file's extension (URL)
Each file type is compared with the list of known file types. If the file type does not match any in the list, the file is considered an 'other' type. If the scan of a single file reveals a mixture of file types and a match is found with at least one in the list, filtering is based on the file type that has the strictest policy. For example, if at least one file type is blocked, the entire file is blocked.
As you decide whether to allow or disallow files of type 'other', consider this process of examining file types:
- If you select Less than 4 MB for the Max File Size Allowed option, that setting takes precedence over your selections for file type filtering. The service blocks the file if the size exceeds the maximum, without scanning for the file type.
- For filtering over SSL, file type blocking works for URLs that are entered in the fully qualified domain name format only, and not the full URL, because SSL encryption prevents the service from determining content type unless SSL is enabled via the policy.
- File-type blocking takes precedence over malware scanning. If a file type is to be blocked, the Web Security Service blocks and does not scan further for malware.
Viewing Supported File Types
Click on the Files subtab to view the supported file types. Note that regular zipped files are categorized under Archives, and password-protected zipped files are included as one of the encrypted files under the Applications category. The items in the list are a grouping of files, not file extensions. For example, exe does not imply only the .exe extension. Instead, it includes all Windows executables.
Note: File types of 'other' encompass those that are not in the list. The Web Security Service allows or disallows these 'other' types according to your setting.
Specifying File Types
Note: To specify file type settings, you must have Files permission for Manage Policy.
To specify file types:
- On the Policies tab, create a new policy or display an existing one in Edit mode.
- Select the Files subtab.
The Files subtab displays categories of file types that you can expand. Each category lists file types. The cell colors under Upload and Download indicate which actions are allowed for the corresponding category or file type. All files are allowed (green) by default.
- In the Max File Size Allowed box, select one:
- Unlimited means no limit to the file's size. This is the default.
- Less than 4 MB means that the file is blocked before transmission if the size is 4 MB or more, regardless of the file type. This option takes precedence over file-specific blocking.
HTTP headers have a field called Content-Length that shows the file size. If the file size in the header exceeds the 4 MB limit, the Web Security Service blocks the file without further analyzing the content type. If size is less than 4 MB, the file is scanned for attributes that match your criteria for blocking files.
- Click the arrows to expand a File Type category and display its specific types.
- To deny permission, click in the corresponding cell to change the color to red under Upload or Download.
If you set options at the category level, all types under this level are similarly affected. You can, however, select the setting for specific file types regardless of the category setting.
- Click Save.
