CyBlock and Cyfin offers the advanced functionality for you to manage and customize the categorization of sites. By using these categorization features, you can maximize the overall usefulness of your CyBlock or Cyfin product. Follow these 5 tips to get the most out of categorization.

1. Keep your categorization list current via daily updates.
Wavecrest site analysts work continuously to update and expand the categorization list. In fact, the Wavecrest URL list is 100% human reviewed. These updates are available for download daily. It’s a simple process that can be done manually or on an automatic/scheduled basis. You can download the URL list or schedule the download to occur daily on the Administration - URL List screen.

2. Establish custom categories.
Augment Wavecrest’s standard 74 categories with custom categories. You can add up to 25 custom categories. You can activate and use as many or as few of these as you want, and you can easily give them specific names of your own choosing. Names are limited to 50 characters. These settings are found on the Advanced Settings — Category Setup — Name Custom screen. Once a custom category has been established, you can augment the Wavecrest URL List with URLs of your own choosing and place them in the custom category for subsequent monitoring or filtering. Custom categories also provide white list (allow-only) capability for CyBlock users.

3. Add URLs.
You can add URLs to both the Wavecrest standard and custom categories. The applicable settings are found on the Advanced Settings — Category Setup — Edit URLs screen. You can also delete URLs here.

4. Change a URL’s category.
If you wish, you can change the category to which Wavecrest has assigned a particular URL. You can do this by simply adding the URL to the category of your choice. Your categorization will take permanent precedence over the Wavecrest URL list.

5. Participate in our OtherWise program.
To opt in our OtherWise program, you simply need to periodically run a Top Non-categorized Sites report and email a copy to sites@wavecrest.net. Our list technicians will research, identify and categorize the most popular unidentified sites, many of which will be of local or special interest to your organization. Then, after you download the next daily control list update, subsequent visits to those sites by your users will no longer be listed as “Other.” They’ll be properly identified and categorized. NOTE: We hold all customer information sent to us in strict confidence.

Check out the latest releases for CyBlock Proxy, CyBlock Appliance, Cyfin Reporter, and Cyfin Proxy!  These are packed with tons of great new features that we’re sure you will love.  The new features include:

• A New Browser Interface with new colors and wider screens.
• A Dashboard that includes:
  • A Home screen that provides an overview of the organization’s Web use for the last 7 days by displaying charts of Web-use visits, top users, top categories and bandwidth usage.
  • Top charts and trend charts with customizable parameters to view Web usage data by hits, visits or bytes, select the timeframe and compare users Web usage to the group average or enterprise average.
• More Custom Categories.
• Enhanced Data Warehousing that includes support for MySQL and SQL server.
• Full 64-bit support on Windows and Linux systems.
• Safe Search option to enforce safe search on Google, Yahoo and Bing.

Use the following links to access the full release notes for your Wavecrest product.

• CyBlock Proxy
• CyBlock Appliance
• Cyfin Reporter
• Cyfin Proxy

If you have any questions about any of the new features or upgrading, please contact Support.

Email: support@wavecrest.net
Phone (Toll-free): 877-442-9346, ext. 4 (U.S. and Canada)
Phone (Direct): 321-953-535, ext. 4

From time to time we are asked, “What is the purpose of the ‘IP Address’ category used by Wavecrest products?” The short answer is — it’s used to capture and segregate the IP addresses of Web sites that the product was unable to associate with ‘regular’ categories. Customers can then analyze them to identify network security threats, traffic to intranet sites, or other patterns of interest.

Here’s a bit more detail.

First note that our products identify many IP addresses and place them in content categories. The Wavecrest URL (control) list contains many such addresses.

Unfortunately though, initially unidentifiable IP addresses still appear from time to time. Generally speaking, we see three types, i.e., addresses associated with:

1. Internal (and partner) Web pages
2. Innocent links on Web sites
3. Possible malware or virus servers

When the product encounters any of these three types, it places them in a special ‘IP Address’ category. Customers can then run reports on that category the same way they do on any other category. In addition, if the customer runs a Top Non-Categorized report, the uncategorized IP addresses will be listed along with uncategorized domain names.

Because the traffic associated with unidentified IP addresses can be important or even dangerous, it’s obviously desirable to pursue the matter further. So what can be done? Well, with a bit of work—and in some cases with some help from Wavecrest—it is possible to:

• determine the source and purpose of most of the addresses
• categorize the legitimate ones
• isolate/neutralize the malicious ones

Let’s see how this is done. We’ll take it one ‘type’ at a time.

1. Internal and Partner Web Pages. Some unidentified IP addresses may have resulted from users going to internal (intranet) or partner sites. (These normally would not be in the Wavecrest URL list.) To address this issue, start by running a Top Non-Categorized Sites Report or IP Address Category Report. Using your local knowledge, try to determine the IP addresses of those sites and then enter the information in one or more custom categories. (Instructions on how to create custom categories can be found in our manual.)
2. Innocent links on Web Sites. These addresses could be associated with image or ad servers. If you want to address this issue, send a copy of a Top Non-Categorized Sites (“OtherWise”) Report to Wavecrest (sites@wavecrest.net). Our categorization team will then research and categorize the unidentified IPs for you the same way they categorize domains. If you would like to identify the IPs yourself, you can use IP address lookup tools such as the one available from http://www.networksolutions.com. This tool will provide you with information about the owner of the IP address(es) of interest. For example, the owner of the IP address could be a marketing company that serves ads, or it could be an image server. Once identified, if you desire, you can add the addresses to one or more custom categories.
3. Possible Malware or Virus Servers. Some of the unidentified IP addresses could be associated with malware, spyware or virus servers. The clue here is very high around-the-clock traffic. This is an indication that the user’s computer has been infected or attacked. The solution in these cases is to isolate the internal computer(s) and remove the malware/spyware or virus. Here’s an approach you can use to help solve this problem.

• Using the Dashboard, run a Trend report on the IP Address category and look for any unusual spikes. If you see anything suspicious then …
• Run a category audit on the IP Address category and look for large amounts of activity coming from a particular PC(s). Make a note of the IP address(es) and then scan for infected files.

Summary. The IP address category was created to be a ‘red flag.’ Its purpose is to alert you that further action may be needed to resolve problems or to simply give you a more complete and comprehensive picture of all Web activity.