Item: Forcepoint Secure Web Gateway
Rating: 9
Author: Junie Johwa

Use Cases and Deployment Scope

It is used across the organisation. It addresses web security for our users and allows certain departments to be able to access certain categories of websites (e.g. PR has access to Facebook while others don't). It enables Internet usage and bandwidth usage to be measured easily and to keep track to see if any additional bandwidth for staff is needed.

Pros and Cons

Check bandwidth usage, e.g "bandwidth vampires"
Control internet access with policies
Robust reporting!
Easy to use interface and very user-friendly "User Administrative" interfaces
Extremely stable and no sudden issues

Complete Active Directory integration. Users have to be manually removed if they have been deleted on Active Directory, therefore you can have some users who still exist but have been deleted from Active Directory and consume licenses
Some configurations are only available via Linux CLI which can be intimidating for Windows or "GUI users" on the appliance configurations
There are three parts of the system and some people don't know that and that can be confusing, i.e. Web Security, Content Management Gateway and Appliance Management. It can be simplified to be one system or at least have it be more obvious that there are three "parts"
Some sites struggle to be accessed and some have to be "bypassed" because of some known issues with the sites

Return on Investment

Control of internet usage with organisational policies.
Secure internet access for users even when not in the office network.
Have a management view of how the internet is used in the organisation, e.g productivity versus productivity loss.

Alternatives Considered

Fortinet FortiGate

It downloads database updates more frequently therefore always on the lookout for threats. Easy to use policy assignment. More robust reporting and able to keep records for many years. It doesn't have deep analysis of links on a page.
The web interface wasn't user friendly and not "straight forward."

Likelihood to Recommend

It is very appropriate when dealing with sites such as Office365 as you don't have to "open" any related sites which are many. You don't have to do any configuration for access to Office365 sites/applications. It is appropriate for scenarios where an organisation has users with different needs in terms of Internet access e.g PR users having access to social media sites and other departments not having access, Technical divisions having access to YouTube and other streaming sites while other departments do not. It is very appropriate in terms of reporting Internet use in the organisation and proper action taken to "bandwidth vampires" which affect the productivity of other users. It is good at reporting as it can keep data for a long time depending how long it is kept (for us it is 3 years) and can be used during IT audits

Users and Roles

410 - They are all Internet users (i.e. all staff) who require protection to access the Internet.

Support Headcount Required

3 - Networking skills
Active Directory
Internet site categorization
Web Caching fundamentals
Access Control Lists

Business Processes Supported

Secure Internet Access anywhere
Protection of organisation machines/laptops regardless of location
Control of Internet Usage
Identify losses in productivity
Different user Internet access needs catered for

Innovative Uses

Identify unproductive users.
Identify Internet "bandwidth vampires" which affect other users' Internet speed which could be for the organization's productivity.
Able to identify a user's IP Address on the system (real-time access tab by hovering on their name) to be able to identify their machines for support by Help Desk.
Use in IT audits (e.g how many threats within a time frame were blocked, what are the top users being blocked etc.).

Future Planned Uses

Add the Advanced Malware Protection Module to add another layer of security.
Increase the number of users who use laptops to further use the Hybrid deployment where the web security policies still apply everywhere and anywhere regardless of your Internet connection.

Likelihood to Renew

It is very stable, the organisation has "locked in" the product and has no plans to change or try another product. We have already renewed our 2019-2020 licenses. It is user friendly and people catch on easily when they first use it. The only downtime is when we install Microsoft updates!
It has excellent reporting which help in determining how the organisation's Internet is used and also during both internal and external IT audits.

Other Software Used

Microsoft Intune, Microsoft Exchange, Kaspersky Endpoint Security, Windows Server

Products Replaced

Not Sure

Key Differentiators

Product Features
Product Usability
Product Reputation
Vendor Reputation

Product Features, the organisation being able to provide IT audit reports, control and manage Internet usage,identify anomalities on Internet access and better troubleshooting if there are any issues. To be honest the organisation made the right decision as we don't struggle with the product as it is stable and hardly a problem!

Evaluation Lessons Learned

Look at the pricing of the product and licensing fees. As much as it is the best decision the organisation has made regarding it's features and stability the licensing I think is a bit expensive for us.

Implementation Rating

Research known issues with upgrading from the Support Knowledge base, this will enable you avoid road blocks along the way and reduce your dependence on Forcepoint Support

Implementation Details / Implementation Partner

Third-party professional services

It was first done by Netfusion for the initial setup which was up to 7.8.4 and for the upgrade from 7.8.4 to 8.5.0 was done by Performanta and they are now our prefered vendor as they are certified Forcepoint Partners

Change Management Lessons

Change management was a big part of the implementation and was well-handled - I'll be talking about the upgrade as I was there: It takes many stakeholders to make things happen. We needed cooperation of other departments as this upgrade impacted the whole staff of Mascom Wireless and it took three days which required no Internet for staff in the evening. This resulted in users understanding the reason for the upgrade and there were no complaints as a result of this

Implementation Issues

First night the upgrade failed and had to seek Forcepoint Support help
There were known issues in the upgrade that were not researched prior to the upgrade
The upgrade took longer than anticipated (as the first night it failed and we rolled back)

Support Rating

The is a quick first response to acknowledge your issue and the Engineers never take more than two hours to fix an issue and we hardly get issues looking at the fact that the system is pretty stable. There is also a robust Knowledge Base in the site for known problems.

Forcepoint SWG Customer Support Pros and Cons

Pros	Cons
Quick Resolution Good followup Knowledgeable team Problems get solved Kept well informed No escalation required Support understands my problem Support cares about my success Quick Initial Response	None

Premium Support

Yes - Because not all three of us are actual specialist of the product and if there are issues that we fail to resolve (quickly) then we escalate to Forcepoint Support who offer a good 2nd level support and this makes issue resolution turnaround times less.

Bug Resolution

Exceptional Examples of Forcepoint SWG Support

When suddenly all users were being resolved by IP Address instead of Active Directory usernames, this made policies assigned to users not apply as the system apply policies to users by Active Directory username. Users were complaining that they were being blocked on sites they normally access and the issue was resolved and answered very quickly (didn't log the call by phone by the way) by Forcepoint Support. It was quickly determined that the service account which made the Active Directory usernames resolution was changed the day before (not realising that it was going to affect the Forcepoint Web Security). We immediately reverted the changes we made to the service account and everything returned to normal

Usability

Despite the intimidating Linux CLI when you use the appliance for troubleshooting, the web security usability compensates as most of the Administration of the system is done there. It is GUI based and has an easy to use UI where one can navigate around rather easily like getting reports, checking alerts, looking the whole setup under deployment to check if all services are running in one place though there are other parts to the system.

Usability Pros and Cons

Pros	Cons
Like to use Relatively simple Easy to use Technical support not required Well integrated Consistent Quick to learn Convenient Feel confident using	None

Easy Tasks

Getting Reports
Assigning User Policy
Monitoring system perfomance and using module perfomance dashboards
Troubleshooting user access policy issues
Able to determine issues whether it is the Internet or the product having problems

Difficult Tasks

Knowing that the system has three parts; appliance, web security and content management gateway
Having to sometimes use a Linux shell on the when you are more skewed to Windows. Most troubleshooting tools on the appliance are Linux CLI based
When a user is deleted in Active Directory, you have to delete that person again on Forcepoint Web Security

Easy Protection with Forcepoint Web Security

Overall Satisfaction with Forcepoint Web Security