Forcepoint Web Security: Filtering, Identity and TLS Inspection
Forcepoint Web Security governs user traffic to the internet: which categories and sites are allowed, for whom, under what conditions, and what the proxy can actually inspect while doing it. The exam tests deployment modes (cloud and on-premises Content Gateway), user identification, filtering actions, and TLS inspection - the enabling step most other controls depend on.
Core rules
- Deployment: Forcepoint Web Security Cloud (cloud proxy reached via PAC file or explicit proxy on the endpoint) or on-premises with Content Gateway on appliances in explicit or transparent mode.
- Categories come from the ThreatSeeker/ACE intelligence feed and cover URL categories plus security risk classes; custom URLs are your own entries and override the category-based action for that site.
- Filtering actions: Permit, Block, Confirm (user proceeds with justification), Quota (time or bandwidth), Coaching/education, plus notification pages. Actions apply per filtering level, and a user's effective policy comes from directory group membership.
- User identification: LDAP/AD integration, the DC agent or User ID agent, terminal-services agents, and SAML/IdP for cloud. Unmatched traffic falls to the unauthenticated-user policy.
- TLS/HTTPS inspection: the proxy presents a certificate from your internal CA, so endpoints must trust that CA. Categories such as health and finance are commonly placed on a do-not-decrypt list.
- Threat protection: real-time security updates, advanced malware detection, sandboxing of suspicious downloads.
Worked example
Remote laptop users must receive the same policy on and off the corporate network, streaming video must be blocked in working hours except for Marketing, and DLP must inspect HTTPS uploads. Reasoning: point browsers at the cloud proxy with a PAC file distributed by GPO so policy follows the device; authenticate via the IdP so group membership resolves; create a Streaming Media rule with a time-of-day condition and a Marketing exception group; enable HTTPS inspection and push the internal root CA by GPO. Without decryption, encrypted uploads bypass DLP entirely and you see only the domain, never the file.
Traps
- Assuming a custom URL allow entry survives when a higher-precedence rule blocks that site's category - check ordering and specificity.
- Forgetting the unauthenticated-user policy, then finding guest devices have full access.
- Enabling decryption without distributing the CA certificate - certificate errors and a helpdesk spike.
- Expecting DLP visibility into HTTPS with inspection off.
- Decrypting banking and healthcare categories and generating avoidable privacy findings.