Secure DNS Forwarder is now generally available with Security Connector 2.7.0

In addition to functioning as a DNS sinkhole, Security Connector can now act as a DNS forwarder that directs traffic to Enterprise Threat Protector (ETP) for resolution. Secure DNS Forwarder detects the internal client IP address and the internal hostname of the client machine. It also protects connections to ETP with DNS over TLS (DoT).

In the Security Connector console, a new menu is now available for DNS Forwarder. You can:

• View traffic statistics about connections that are directed from DNS Forwarder to ETP.
• View the health status of DNS Forwarder
• Enable or disable DNS Forwarder. By default, DNS Forwarder is enabled.
• Temporarily enable query and response logging in your enterprise for Akamai to investigate and troubleshoot an issue.
• Change the DNS Forwarder port. By default, DNS Forwarder uses outbound TCP port 443. However, you can choose to use outbound TCP port 853.
• Configure a local DNS server. If your organization’s corporate DNS server is not recursive and is used for internal domains only, you can configure it as a local DNS server for DNS Forwarder. This configuration sets the DNS server that you configured in the Security Connector setup as a fallback server in case ETP is not reachable. If you apply a local DNS server configuration, you can then set the Security Connector DNS name server to use the ETP DNS server IP addresses.

ETP also now includes new reporting dimensions to show the internal client IP address and the internal hostname of the user’s machine.

Note the following:

• When you upgrade Security Connector, the virtual machine will temporarily hop to version 2.6.9 before it upgrades to version 2.7.0. This upgrade process also restarts your virtual machine twice. Make sure you do not interrupt this upgrade process. If you find that Security Connector is stuck on version 2.6.9, contact Akamai Support.
• If you intend to use DNS Forwarder, the virtual machine requires 4 GB of RAM and can be increased to 8 GB. If you don’t intend to use Security Connector as a DNS Forwarder, 2 GB of RAM is enough for the Security Connector virtual machine.

For more information about this update, see the online help or the Security Connector Setup and Configuration Guide.

Application visibility and control (AVC) is now in beta

If your organization is participating in the AVC beta, you can now control access to web applications. You can define default policy behavior, or you can create a policy that is based on risk level, acceptable use policy (AUP) categories, category operations, applications, or specific operations for an application. You assign actions to each area of the AVC policy. As you configure each component, the detailed settings you set take precedence over more general settings. For example, the policy action you apply to an application takes precedence over an action that’s applied to its corresponding category or category operation.

You can also select the users and groups that can access a blocked web application and perform specific operations in the application. AVC supports the following ETP setups:

• ETP DNS. If ETP Proxy is not enabled, you can still control access to applications based on the application’s domain and IP address.
• ETP Secure Web Gateway. If ETP Proxy is enabled and configured as a full web proxy, you can control access to applications based on URLs, domains, IP addresses, and other attributes.

For more information, see the online help. To participate in the beta, contact your Akamai representative.

Known Issues and Limitations

Issue: Depending on the domain that’s used to access Google Gmail, an allow action for Gmail may not override a block action with a user exception to the Web-Based Email category. It also may not override the Very High risk level.

Workaround: There is currently no workaround.

Mac OS 11 (Big Sur) Support for ETP Client

Apple has announced the general availability of macOS Big Sur (version 11.0) across its platforms starting November 12, 2020.

Akamai has been working closely in the Apple Developer Network to validate the ETP Client with various Apple Developer builds. As a result, the ETP Client 3.2.1 will install in macOS Big Sur-based environments. However, full qualification is only possible once the production release of macOS Big Sur is made available.

Following Apple’s announcement today, Akamai will undertake a final round of testing on macOS Big Sur to ensure that ETP Client 3.2.1 is fully qualified. Once the testing is complete, Akamai will update appropriate Client release notes to reflect this.

ETP Clients below 3.2.1 will not support Big Sur. Customers using ETP Client who wish to run macOS Big Sur must upgrade to corresponding supported Client versions when they have been fully qualified.

See macOS Big Sur for more information.

Enterprise Threat Protector (ETP) now includes these features and enhancements:

Custom Headers. In a policy, you can now configure custom headers to control access to software as a service (SaaS) applications. You can use this feature to require that users access only your organization’s account of the application. To use this feature, your organization must be licensed for ETP Advanced Threat and configure ETP Proxy as a full web proxy. For more information, see the online help.

Block Unscannable Files. You can enable the Block Unscannable Files option in a policy to block files that cannot be scanned by ETP Proxy as part of inline payload analysis. These files include encrypted or password protected files. If this option is disabled, these files are not scanned by ETP Proxy.

Custom List Updates. Custom lists now include these changes:

• If the block action is assigned to a custom list, you can select the users and groups that are exceptions to the block action. This means that selected users and groups can access a blocked website from the list after they successfully authenticate. To select users and groups for the exception, the policy must be enabled for authentication and have an associated identity provider.
• After you create a custom list, you can no longer modify the category that’s assigned to the list.

New Name for ETP Client Setting in Policy. The “Enable ETP Client as Proxy” setting is now called “Overwrite Device Proxy Settings.”

Identity Provider Deployment. In the new Enterprise Center user interface, you can now deploy an identity provider (IdP) within the IdP configuration. A new button now appears beside the deployment status when the IdP is ready for deployment. This button also appears if there is a failure that requires you to redeploy the IdP.

ETP Client 3.2.2 for Windows is now available for download

A new version of ETP Client for Windows is now available. This release includes fixes to a number of issues. Make sure you download this version or upgrade your clients on Windows.

Enterprise Threat Protector (ETP) now includes these enhancements:

Overlay groups and organizational units (OUs) in a directory configuration. When configuring groups in a directory, an administrator can now import organizational units from a directory and add overlay groups. Overlay groups allow administrators to add groups to ETP without modifying their external directory configuration. Like any directory group, an administrator can select an overlay group or an OU when configuring exceptions to an Acceptable Use Policy (AUP).

New and updated AUP categories. New and enhanced AUP categories and subcategories are now available. You can allow or block these categories in a new or existing AUP. If a policy blocks a category that’s now discontinued, ETP allows you to confirm the block action to a suggested new category.

Make sure that you log in to ETP to review your policy and confirm any suggested change to an AUP. Discontinued AUP categories are not supported after January 31, 2021.

For a detailed list of categories, including new, updated, and discontinued categories, see the online help.

The following additional features are also now available in an AUP:

• Bypass action for an AUP category. If ETP Proxy is enabled, you can select the bypass action to ensure websites in a specific category bypass ETP Proxy. You may want to select the bypass action for categories that are associated with sensitive information such as the Finance & Investing and the Healthcare categories.
• Select a custom response in an AUP. If ETP Proxy is not enabled, you can now assign custom responses to blocked AUP categories. This enhancement allows you to direct AUP traffic to resources of your choice.

Security Connector added as dimension to DNS Activity report. The DNS Activity report now shows the Security Connector name when DNS traffic was detected by Security Connector.

DNS Proxy is now called DNS Forwarder. If you are participating in the Security Connector beta with version 2.6.8, the DNS Proxy feature is now called DNS Forwarder. The Security Connector console user interface still includes the DNS Proxy name; however, this name will be updated in an upcoming release.

This release also includes minor user interface improvements, including new tabs on the identity provider and directory configuration pages that better organize settings.

Try Enterprise Threat Protector (ETP) with the new Enterprise Center interface

The new interface offers the following:

• A new navigation that makes it easy for you and other administrators to find ETP features and reports.
• An improved and more interactive dashboard where you define custom widgets. Widgets allow you to configure the data that’s shown in a dashboard and the overall presentation of this data.
• A new workflow that guides you through the process of setting up major features in ETP. This includes DNS security, the selective proxy, the full web proxy, and identity providers.
• New placement of features that are found on the Utilities page of the original interface. These features are now accessible in more logical areas of the navigation. For example, ETP Client and Security Connector are now accessible from the new Clients and Connectors navigation area.
• All event and activity reports are now on separate pages and are accessible from the new Threat Analytics navigation area.
• The ability to clear the DNS cache. ETP DNS servers cache domains to quickly resolve requests. If a domain resolves to a new IP address, you can clear the domain from the ETP DNS server to resolve the domain to the correct IP address. This feature is only available in Enterprise Center.

You can access the new interface from a banner that appears in ETP.

 To learn more about Enterprise Center, see the ETP online help.

Data Loss Prevention (DLP) is now in beta

An enterprise can now identity and block sensitive or confidential data that’s uploaded from a corporate network and transmitted to the Internet. DLP scans data that’s posted over an HTTP and HTTPS connection. You can scan data or files that’s 5 MB or less.

Sensitive data is identified through a DLP dictionary. A DLP dictionary contains the patterns or the regular expressions that are used to detect sensitive data.

Depending on the policy and the DLP dictionary configuration, you can block the following sensitive information:

• Personal identifiable information (PII), such as social security numbers, home addresses, email addresses, and more.
• Financial and credit card information, such as bank and credit card numbers.
• Personal health and healthcare information. DLP allows your organization to maintain compliance with the United States Health Insurance Portability and Accountability Act (HIPAA).

To learn more about DLP, see the online help. To participate in the beta, contact your Akamai representative.

ETP Client 3.2.0 is available for download and now includes DoT protection (beta)

ETP Client 3.2.0 allows your enterprise to secure traffic that’s directed from ETP Client to ETP DNS. This traffic is protected with DNS over TLS (DoT). DoT secures this information with Transport Layer Security (TLS) encryption, providing privacy and preventing threat actors or network providers from hijacking DNS traffic. When DoT is enabled for your organization, ETP Client always attempts to use DoT. It falls back to plaintext DNS if the network blocks DoT connections.

New policy settings are now available where you can select whether DoT is required, attempted, or disabled. You can also select the port for DoT connections. For more information, see the online help or the ETP Client Configuration Guide.

ETP Client 3.2.0 also includes fixes to a number of issues.

While version 3.2.0 is available for download, DoT is currently in beta. To participate in this beta, contact your Akamai representative.

Enterprise Threat Protector (ETP) now includes these features and enhancements:

• Optimize Microsoft 365 Traffic.  The new Optimize Microsoft 365 Traffic setting in a policy allows ETP to quickly identity and resolve requests to Microsoft 365 apps and services. This option retrieves the latest Microsoft 365 domains and IP addresses from Microsoft and enables this traffic to securely bypass ETP Proxy scanning. By leveraging Akamai’s network of servers, this setting provides optimal routing to Microsoft 365 apps and services.
• Allow or block domains incompatible with TLS MITM Certificate. With the new Block Incompatible Domains toggle in a policy, you can allow or block domains that are not compatible with the TLS man-in-the-middle (MITM) certificate. The TLS MITM certificate is the certificate you generated or uploaded in ETP for ETP Proxy. Akamai maintains a list of these domains. By default, these domains are allowed and bypass ETP Proxy scanning.
• New identity provider activity report. If your organization is licensed for ETP Advanced Threat and uses an identity provider, a new Identity Provider Activity report is now available on the Activity page. This report indicates when a login was attempted, successful, or a failure. It also shows when an identity provider session was restarted as a result of updating a user group.
• Grant Akamai Support permission to view activity reports. In the Akamai Support tab of the Utilities page, you can now allow Akamai Support to view your organization’s DNS, Proxy and Identity Provider activity reports. If Akamai Support already has administrative access to your organization’s ETP configuration, this view permission is automatically granted.
• Unclassified Traffic setting is now called Default Action. The Unclassified Traffic setting in a policy is now called Default Action. This setting is available in the Proxy Settings area of the policy. The action you select is applied to unclassified traffic and to Acceptable Use Policy (AUP) categories that have no action assigned.
• New and updated AUP categories are now in beta. New and enhanced AUP categories and subcategories are now available. If your organization is participating in the beta, you can allow or block these categories in a new or existing AUP. If a policy blocks a category that’s now discontinued, ETP allows you to confirm the block action to the new category. For a detailed list of categories, including new, updated, and discontinued categories, see the online help. The following feature is also available as part of this beta:
  • Custom Response for AUP. If ETP Proxy is not enabled, you can assign custom responses to blocked AUP categories. This enhancement allows you to direct AUP traffic to resources of your choice.

 To participate in the AUP beta, contact your Akamai representative.