Tutorial: Protect Your Users From Malware and Other Cyber Threats⁠

Overview⁠

Use CloudConnexa Cyber Shield to protect users from malicious domains and network threats. You can apply different protection settings per User Group with Shield Policies, allowing you to tailor security and content filtering for each group.

In this tutorial, you will:

Configure baseline protection with the Default Policy.
Create a custom Shield Policy for a User Group that needs different filtering.
Block unwanted content categories and specific domains.
Configure Traffic Filtering to detect or block threats such as malware and ransomware.
Use the Top 10 Dashboard to investigate Cyber Shield events.

This tutorial focuses on protecting users after you've connected them to CloudConnexa. For an introduction to Cyber Shield and its filtering features, refer to About Cyber Shield.

Before you begin⁠

You need:

A configured CloudConnexa WPC.
Users organized into User Groups.
Users connected to CloudConnexa.
DNS Proxy turned on for Domain Filtering.

Start by configuring the protection you want to apply to User Groups that don't require their own custom Shield Policy.

Sign in to your WPC's Administration portal by entering your Cloud ID in a web browser (for example, company_name.openvpn.com).
Select Shield → Policies.
Select the edit icon for Default Policy.
Select the Domain Filtering tab.
Turn on Domain Filtering.
Select a protection level:
- Monitor Only
- Basic Protection
- Safe Browsing
- High Productivity
- Custom
If you select Custom, configure the individual categories you want to monitor or block.
Save your changes.
- The Default Policy now provides your baseline Domain Filtering configuration.
  Note
  Domain Filtering applies only to DNS queries resolved through CloudConnexa. DNS Proxy must be on for Domain Filtering to apply. Encrypted DNS, such as DNS over HTTPS (DoH), can bypass Domain Filtering when DNS queries use another resolver.

For details about the available protection levels and categories, refer to Domain Filtering Protection Levels and Content Categories.

If a User Group needs different protection from the Default Policy, create a custom Shield Policy.

For example, you might use different policies for employees, contractors, students, guests, or other groups with different security or acceptable-use requirements.

Select Shield → Policies.
Select New Policy.
Enter a unique policy name.
Enter an optional description.
Assign the User Groups that should use the policy.
Select the Domain Filtering tab.
Turn on Domain Filtering.
Select a protection level or configure individual content categories.
Save the policy.
- The assigned User Groups now use the custom Shield Policy instead of the Default Policy.

For more information, refer to Create or Edit a Shield Policy and Assign User Groups to a Shield Policy.

Content categories provide broad filtering, but you can also control access to specific domains per Shield Policy.

Use the:

Domain Allow List to allow a domain even when its content category is blocked.
Domain Block List to block a domain regardless of its content-category settings.

Allow a specific domain⁠

Open the Shield Policy.
Select the Domain Allow List tab.
Turn on Enable Allow List.
Enter the domain you want to allow.
Save your changes.

Block a specific domain⁠

Open the Shield Policy.
Select the Domain Block List tab.
Turn on Enable Block List.
Enter the domain you want to block.
Save your changes.

For domain-matching behavior, batch uploads, comments, and list limits, refer to Override Blocked Domains with a Domain Allow List and Block Access to Specific Domain Names with a Block List.

Domain Filtering protects users based on the domains they access. Traffic Filtering examines tunneled network traffic for threat signatures.

Traffic Filtering can operate as an Intrusion Detection System (IDS)/Intrusion Prevention System (IPS). Configure it to monitor threats or block matching traffic based on threat priority or category.

Select Shield → Policies.
Select the edit icon for the Shield Policy you want to configure.
Select the Traffic Filtering tab.
Turn on Traffic Filtering.
Choose how to configure protection:
- Per Priority: Configure protection based on Critical, High, and Medium threat priorities.
- Per Category: Select individual threat categories.
Configure the threats you want to monitor or block.
Save your changes.

For example, Traffic Filtering includes threat categories such as Malware and Ransomware and Intrusion Activity.

Repeat this configuration for other Shield Policies that require Traffic Filtering.

For the complete options, refer to Traffic Filtering Priorities, Categories, and Protection Levels.

After creating your policies, verify that your User Groups have the intended protection.

Select Shield → Policies.
Review the policies under All Policies.
Verify the Domain Filtering and Traffic Filtering status for each policy.
Review the number of User Groups assigned to each custom policy.
Select the User Group count when you need to review the assigned groups.

For more information about reviewing your configuration, refer to Browse and Manage Shield Policies.

Use the Top 10 Dashboard to identify the Domain Filtering and Traffic Filtering categories generating the most events.

Select Shield → Overview.
Locate the Top 10 Dashboard.
Select a Period.
Select Domain or Traffic for Filtering Type.
Select Monitored or Blocked for Events.
Review the Top 10 categories by event count.
Select a category to drill down and identify the sources generating those events.
Continue drilling down as needed to investigate affected users and devices.
Use View All to continue the investigation in Shield → Metrics with the selected period and filters.

For detailed instructions, refer to Interact with the Cyber Shield Top 10 Dashboard and Investigate Using Cyber Shield Top 10 Dashboard.

What happens next⁠

Your users now receive Cyber Shield protection based on their User Group's Shield Policy.

You can:

Use the Default Policy as baseline protection.
Create custom policies for User Groups that need different Domain Filtering or Traffic Filtering.
Use Domain Allow Lists and Block Lists for specific domain exceptions.
Review the Top 10 Dashboard and Cyber Shield Metrics to identify and investigate filtering events.
Update User Group assignments as your security requirements change.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: Protect Your Users From Malware and Other Cyber Threats⁠

Overview⁠

Before you begin⁠

What happens next⁠

Related resources⁠

Was this information helpful?