Web security guide comodo cwatch by Baskaran G

rat

Comodo cWatch Web Security Software Version 1.6

Quick Start Guide Guide Version 1.6.103117

Comodo Security Solutions

1255 Broad Street Clifton, NJ 07013

Comodo cWatch Web Security - Quick Start Guide

Comodo cWatch Web Security - Quick Start Guide cWatch Web Security is a cloud-based security intelligence service that continuously monitors and protects websites against millions of attacks and threats. In addition to website protection, cWatch Web Security includes a subscription to a content delivery network (CDN) service, helping to accelerate your websites' performance. This document explains how you can purchase licenses, enroll websites and use the cWatch interface. •

Purchase Website License(s)

•

Enroll Websites

•

Configure cWatch Scanning and the CDN Service

•

Using the cWatch Interface

Purchase Website Licenses If you haven't done so already, please select a cWatch plan at https://cwatch.comodo.com/plans.php. •

Licenses are charged per domain. You can add any number of domains to a license.

•

You can add multiple license types to your account if you wish to implement different protection levels on different websites.

•

You can associate websites with specific licenses in the cWatch interface.

Available license types are: •

Starter

•

Pro

•

Premium

•

Enterprise

The following table shows the features and services available with each license type: Feature/Service Number of Websites (Unlimited Web Pages)

Starter

Pro

Premium

Enterprise

1 domain

1 domain and up to 10 sub-domains

Detection & Removal of Known & Unknown Malware 24 hrs Stand-alone File | Embedded in Script | Database response

12 hrs response

6 hrs response

2 hrs response

Security Information and Event Management (SIEM) and 24/7 Cyber Security Operations Center (CSOC)



CSOC Analyst





CSOC backed



Malware Scan Detection / Block



Spam & Website Filtering



 



plus



plus 2

Comodo cWatch Web Security - Quick Start Guide Analyst backed

Analyst backed

Malware Detection Scan

24 hrs

12 hrs

6 hrs

2 hrs response

Vulnerability (OWASP) Detection Scan

24 hrs

12 hrs

6 hrs

2 hrs response



Managed (Updates)

24 hrs

12 hrs

6 hrs

2 hrs response for incidents

Fine Grained Control



 CSOC backed

2 hrs response for incidents

   

Web Application Firewall (WAF)

Bot Protection



Scraping Protection



Enterprise Control



Content Delivery Network (CDN)



   

50 GB/mo

200 GB/mo

500 GB/mo

1000 GB/mo

99.99%

100%

Speed

40/100 Gbps

10/40/100 Gbps

Scale

10 Tbps

96 Tbps



 CSOC

backed

 CSOC

backed



Bandwidth and Domains Uptime SLA

Layer 7 DDoS Protection Layer 3, 4, 5 & 6 DDoS Protection 30 Days Money Back Guarantee





 

Once you complete the purchase process: •

If you are a new user, a Comodo account will be created for you at https://accounts.comodo.com. An email containing your subscription ID and the link to activate your account will be sent to you. You can activate your account by following the link in the mail.

•

If you are an existing user, an acknowledgment mail will be sent to you containing your license key.

•

Please save your license key in a safe location.

•

Next, login to cWatch at https://login.cwatch.comodo.com/login

Comodo cWatch Web Security - Quick Start Guide

If you are logging-in for the first time, please use the username and password provided in the cWatch account confirmation email. We strongly recommend you change your password after first login for security reasons.

Enroll Websites •

The cWatch console lets you to add and configure websites for cWatch protection and for site acceleration via the content delivery network (CDN).

•

The number of domains that can be added to your account depends on your license (explained here).

•

After enrollment, you can configure threat monitoring and CDN settings for each website. See the next section, Configure cWatch Scanning and the CDN Service for more details.

To add a new domain •

The dashboard will appear by default •

Click 'Add Site' at top-right to start the 'Add Websites' wizard:

Comodo cWatch Web Security - Quick Start Guide

The wizard contains four steps: •

Step 1 - Register your website

•

Step 2 - Select License

•

Step 3 - HTTP Protocol Settings

•

Step 4 -Finalization

Step 1 - Register your website •

Enter the name of the website you wish to register. Do not include 'www' at the start.

•

Click 'Continue Setup' to move to the next step.

Comodo cWatch Web Security - Quick Start Guide

Step 2 - Select License Next, choose the license type you wish to apply to the site. •

cWatch features and CDN traffic limits vary according to license type. Details are available here.

•

The drop-down displays all licenses that you have purchased.

•

Choose the type of license you wish to associate with the domain you entered in step 1

•

Click 'Continue Setup' to proceed

•

Each 'Enterprise' license covers up to ten sub-domains of a primary domain.

•

You have to specify each sub-domain after registering the primary domain.

Comodo cWatch Web Security - Quick Start Guide •

You should select 'Enterprise' as the license type for each sub-domain in order for it to be covered under the primary domain license.

•

Each sub-domain also has to be configured separately for malware scanning and the CDN service. See the next section, Configure cWatch Scanning and the CDN Service for more details.

Step 3 - HTTP Protocol Settings Specify whether your website uses the HTTP or HTTPS protocol. If it uses HTTPS, you can also select the SSL certificate used to secure the site.

•

Select the protocol from the drop-down. The available options are: • •

HTTP - Choose HTTP and click 'Finish'. The wizard will move to Step 4 -Finalization. HTTPS - Choose HTTPS and enter the details of the certificate to be used.

Comodo cWatch Web Security - Quick Start Guide

You need to upload the SSL certificate of the website and its private key. You should also upload any intermediary certificates. SSL Protection Settings - Table of Parameters Parameter

Description

Name

Enter a descriptive name for the certificate. This will be used to identify it in cWatch.

Certificate

Paste the content of your certificate. For example, the content you are looking for will look something like this:

Comodo cWatch Web Security - Quick Start Guide -----BEGIN CERTIFICATE----MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEw JDTjEL MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1 UECxMC VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDT A1MDgx NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQ QHEwJD TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbm cgWWFu ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBew KE/B7j V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAg MBAAGj gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIw R4MHaA FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMA kGA1UE CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU 4xFDAS BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhv cNAQEE BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/ +HQX67aRfgZu7KWdI+Ju Wm7DCfrPNGVwFWUQOmsPue9rZBgO -----END CERTIFICATE-----

SSL Chain Certificate

If your certificate contains an intermediate certificate then paste it here. If not, leave this field blank.

Certificate Key

Paste the private key of your certificate

Tip: You can skip uploading the SSL certificate at this time by simply selecting HTTP. You can switch to HTTPS and choose the certificate later in the website's 'CDN Settings' area. See Configure cWatch Scanning and the CDN Service for more details. •

Click 'Add Certificate and Finish'.

•

The wizard will move to Step 4 -Finalization.

Step 4 - Finalization The final step allows you to configure your DNS settings. •

cWatch will generate a CNAME DNS record for the website you just enrolled

•

You need to add this record to the DNS entry for your domain to route your site traffic through the CDN.

•

Your web host may be able to help you with this step. Guidance is also available at https://support.google.com/a/topic/1615038?hl=en.

Comodo cWatch Web Security - Quick Start Guide

•

The CNAME record is also saved in the cWatch interface. To view it, click the domain name on the left then 'Settings' > 'CDN Settings'. See the online help page, Configuring CDN Settings for more details.

•

Click 'Get Started'.

Your new website will be added to your account. All features will be activated as per the license chosen for the site.

Comodo cWatch Web Security - Quick Start Guide

•

Repeat the process to add more websites.

Configure cWatch Scanning and the CDN Service The next step is to: •

Configure vulnerability and malware scanning on a website

•

Configure FTP access so cWatch technicians can resolve issues on your site

•

Upload the SSL certificate used to secure the site if you are using HTTPS (if not already uploaded)

•

Configure cache management settings for your website

To configure your website for scanning and the CDN service •

Click a website name on the left and choose 'Settings'.

Comodo cWatch Web Security - Quick Start Guide

The interface contains three tabs: •

Malware Scan Settings - Configure the domain for vulnerability and malware scanning and provide FTP access details for your server. See Configure the Website for cWatch Scanning for more details.

•

CDN Settings - Register the website with the content delivery network. You can also specify whether your site uses HTTP or HTTPS. If HTTPS, you can also upload the SSL certificate that you use to secure your site. See Configure CDN Settings for more details.

•

Manage Cache - Configure the life-time of content saved in the CDN cache and visitors' browsers. Cached content is used to speed up content rendering times. See Configure Cache Settings for more details.

Configure the Website for cWatch Scanning •

You need to upload a .php file to your website in order to configure malware scanning.

•

cWatch will access the file at the location you specify and commence scanning.

•

You can opt for automatic removal of malware threats identified at the end of every scan.

You have the option to use technicians from Comodo Cyber-Security Operation Center (CSOC) to handle threats found on your websites. If enabled, our technicians will:

Comodo cWatch Web Security - Quick Start Guide •

Investigate threats identified by each scan and remove any malware.

•

Remove any vulnerabilities identified by scans.

•

Remove any malware or vulnerabilities you reported in a support ticket. See the online help page for Viewing and Managing Support Tickets if you need help with this.

You need to provide your FTP server details for our technicians to access your website. To configure your website for scanning and malware removal •

Click the 'Malware Scan Settings' tab

Scan Settings: •

Download the PHP file in step 1.)

•

Upload the file to the root folder of your website. The file should be publicly accessible.

•

Enter the URL of the uploaded file in the text field.

Comodo cWatch Web Security - Quick Start Guide •

Click 'Save and Verify' to run the check.

Malware Removal Settings: •

Enable 'Switch On for automatic malware removal' if you want discovered malware to be removed by Comodo technicians.

The fields for specifying your secure FTP server details will appear. s/FTP Settings - Table of Parameters Parameter

Description

s/FTP Hostname

Enter the hostname of your FTP server

s/FTP Username/ FTP Password

Enter the username and password that cWatch should use to access the FTP server.

s/FTP Directory

Enter the path to the location of the website in the FTP server.

s/FTP Port

Enter the port through which the website can be securely accessed.

•

Click 'Save and verify'

cWatch will access the .php file and begin scanning your website according to a schedule.

Comodo cWatch Web Security - Quick Start Guide

Your domain will be scanned in 12 hour intervals and the results will be displayed in the 'Malware' page of the domain. See Comodo Malware Scan Results for more details. Comodo cWatch Web Security - Quick Start Guide | ÂŠ 2017 Comodo Security Solutions Inc. | All rights reserved.

Comodo cWatch Web Security - Quick Start Guide Configure CDN Settings •

You must configure your website to use the CDN service in order to monitor traffic, identify threats and accelerate web-site performance.

•

To configure the service, you need to add a CNAME entry to your website's DNS record. The CNAME entry is listed in the 'CDN Settings' area.

•

The amount of CDN traffic available for a domain depends on the cWatch license active on the domain. Details are available here.

•

You should also select the SSL certificate used on your website if it uses HTTPS.

Once configured, the CDN service will: •

Accelerate performance by delivering your website content to your visitors from data centers closest to their location.

•

Forward event logs to the Comodo CSOC team who will monitor your traffic to identify anomalous behavior and threats.

•

Provide Comodo web application firewall protection for your domains. The CSOC team constantly improves the mod-security rules in Comodo web application firewall to provide cutting edge protection for our customers.

To open the CDN Settings page •

Click the 'CDN Settings' tab in the 'Settings' page.

Comodo cWatch Web Security - Quick Start Guide

Comodo cWatch Web Security - Quick Start Guide SSL Configuration: If you chose HTTPS when adding your site, the SSL configuration area shows details of the certificate that is installed on your website.

If you chose HTTP, you can upgrade to HTTPS and upload the SSL certificate to secure your website. •

Choose HTTPS from the drop-down or click the 'Click to update protocol button'

Comodo cWatch Web Security - Quick Start Guide

The form for adding your SSL certificate will appear. SSL Protection Settings - Table of Parameters Parameter Name

Description Enter a descriptive name for the certificate. This will be used to identify it in cWatch.

Comodo cWatch Web Security - Quick Start Guide Certificate

Paste the content of your certificate. For example, the content you are looking for will look something like this: -----BEGIN CERTIFICATE----MIICUTCCAfugAwIBAgIBADANBgkqhkiG9w0BAQQFADBXMQswCQYDVQQGEw JDTjEL MAkGA1UECBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1 UECxMC VU4xFDASBgNVBAMTC0hlcm9uZyBZYW5nMB4XDTA1MDcxNTIxMTk0N1oXDT A1MDgx NDIxMTk0N1owVzELMAkGA1UEBhMCQ04xCzAJBgNVBAgTAlBOMQswCQYDVQ QHEwJD TjELMAkGA1UEChMCT04xCzAJBgNVBAsTAlVOMRQwEgYDVQQDEwtIZXJvbm cgWWFu ZzBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCp5hnG7ogBhtlynpOS21cBew KE/B7j V14qeyslnr26xZUsSVko36ZnhiaO/zbMOoRcKK9vEcgMtcLFuQTWDl3RAg MBAAGj gbEwga4wHQYDVR0OBBYEFFXI70krXeQDxZgbaCQoR4jUDncEMH8GA1UdIw R4MHaA FFXI70krXeQDxZgbaCQoR4jUDncEoVukWTBXMQswCQYDVQQGEwJDTjELMA kGA1UE CBMCUE4xCzAJBgNVBAcTAkNOMQswCQYDVQQKEwJPTjELMAkGA1UECxMCVU 4xFDAS BgNVBAMTC0hlcm9uZyBZYW5nggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhv cNAQEE BQADQQA/ugzBrjjK9jcWnDVfGHlk3icNRq0oV7Ri32z/ +HQX67aRfgZu7KWdI+Ju Wm7DCfrPNGVwFWUQOmsPue9rZBgO -----END CERTIFICATE-----

SSL Chain Certificate

If your certificate contains an intermediate certificate then paste it here. If not, leave this field blank.

Certificate Key

Paste the private key of your certificate

•

Click 'Create New SSL Certificate'

cWatch will create a new certificate and bind it with the website for data transfer through the CDN. DNS Configuration: •

Add the 'CNAME' record displayed in this interface to the DNS entry for your domain to route your site traffic through the CDN. Your web host may be able to help you with this step. Guidance is also available at https://support.google.com/a/topic/1615038?hl=en.

•

Once configured, cWatch will check the DNS records and route the traffic through the CDN.

Comodo cWatch Web Security - Quick Start Guide

•

It may take up to 20 minutes for the CDN to receive the traffic to your domain. Once it has started, you can view traffic statistics on the 'CDN Metrics' page for the domain. See Content Delivery Network Metrics for more details.

Origin Information •

Origin IP Resolution - Choose whether or not the CDN should use DNS servers to resolve the IP address of your origin web server. This depends on whether your server uses a static or dynamic IP address. If your server uses a static IP address, enable 'Origin IP Resolution'. The CDN will fetch your IP address by domain look-up, save it and display it in the 'Origin IP' field. The CDN will use this IP address to fetch the files from your web server. This will save time for content delivery to your website visitors. • If your server uses dynamic IP address, disable this option. The CDN will use DNS services to resolve your IP address. Custom Host Header - If the custom host header for your website configured in the origin hosting server, is different from the domain name, enter the Custom Host Header in this field. •

• •

Click 'Update' for your settings to take effect.

Configure Cache Settings •

You can configure validity periods of content cached by the content delivery network.

•

Content is cached in order to serve pages faster to your website visitors.

•

You may want to clear the cache if you have recently updated your website to ensure the latest content is served to your visitors.

To configure cache settings •

Click the 'Manage Cache' tab in the 'Settings' page

Comodo cWatch Web Security - Quick Start Guide

Manage Cache - Table of Parameters Parameter

Description Cache Settings

Set Default Cache Time

Allows you define the time period which content fetched by the CDN from your web servers should remain on the CDN cache. This is useful if your website's cache control headers (CCH) are not used or ignored by the browser on your visitors computer. Background Note: Cache Control Headers are used to define the length of time which content fetched from site should remain in the browser's cache. The local cache is used by the browser to render the site when it is re-visited by the user, avoiding the need to fetch the content again from the server.

Cache Control Header

Enter the validity period of the CCH at the end-user's web browser. This defines the time period which cached content in the web browser can be reused without checking the web server for updates

Use State

Select 'Serve expired content' if you want the CDN to deliver cached content when:

Query String

•

The CDN is currently checking the website for updated content

•

Your website is down.

Select 'Treat as separate cachable item' if you want webpages with query string parameters (e.g. '?q=something') to be cached as separate files. This will instruct the CDN to update the

Comodo cWatch Web Security - Quick Start Guide respective files in its cache whenever the original pages are updated. Ignore Cache

Select 'Ignore max age set by the origin' if you want your visitor's browsers and clients to ignore the time to live (TTL) and header expiry settings of your webpages. The web browsers will use the default cache time setting above to retain the content in their cache. Purge CDN Cache on Edge Servers

Purge Individual Files

Allows you remove specific files from the cache so that the CDN is forced to check your website the next time the files are requested. Enter the URI of the file in the text box and click the green '+' button Repeat the process to add more files Click 'Purge' Allows you remove all files from the cache so that the CDN is forced to check your website the next time the files are requested. • • •

Purge All Files

•

Click 'Purge'

Click 'Update Cache Settings' for your settings to take effect.

Using the cWatch Interface Once you have registered a new website it will be listed in the left-hand menu. You view threat statistics and configure the website by selecting an option below the domain name:

Dashboard - Overall statistics on all websites that are protected and managed. Alert - Shows all notifications about malware and vulnerabilities discovered on the website. See https://help.comodo.com/topic-285-1-848-11493-View-Alerts.html for more details. Comodo cWatch Web Security - Quick Start Guide | © 2017 Comodo Security Solutions Inc. | All rights reserved.

Comodo cWatch Web Security - Quick Start Guide Overview - At-a-glance summary of security status and CDN performance. See https://help.comodo.com/topic-2851-848-11010-Website-Overview.html for more details. Vulnerabilities - Lists all threats in the OWASP top ten that have been blocked by cWatch. You have the option to submit a ticket to Comodo Labs to remove the threats. Refer to https://help.comodo.com/topic-285-1-848-11492Comodo-Vulnerability-Scan-Results.html for more details. Malware - Summary of the number of files scanned so far and their trust levels. You have the option to submit a ticket to remove any malicious files. See https://help.comodo.com/topic-285-1-848-11011-Comodo-Malware-ScanResults.html for more details. COSC - Shows a real-time analysis of attack patterns on your domain from the Comodo Security Operations Center. See https://help.comodo.com/topic-285-1-848-11494-Cyber-Security-Operation-Center-Results.html for more details. CDN Metrics - Shows data about your content delivery network traffic. This includes total usage, data throughput and the locations from which your traffic originated. See https://help.comodo.com/topic-285-1-848-11495-ContentDelivery-Network-Metrics.html to find out more. Ticket - Allows you to view, open and manage your support requests for the domain. You can create tickets to request Comodo to whitelist or blacklist items or to clean malware from your domain. See https://help.comodo.com/topic-285-1-848-11014-Viewing-and-Managing-Support-Tickets.html to learn more. Settings - Allows you to configure domain malware scanning, CDN coverage, FTP access and SSL certification. See https://help.comodo.com/topic-285-1-848-11496-Website-Configuration.html to find out more.

Comodo cWatch Web Security - Quick Start Guide

About Comodo The Comodo organization is a global innovator of cybersecurity solutions, protecting critical information across the digital landscape. Building on its unique position as the world's largest certificate authority, Comodo authenticates, validates and secures networks and infrastructures from individuals to mid-sized companies to the world's largest enterprises. Comodo provides complete end-to-end security solutions across the boundary, internal network and endpoint with innovative technologies solving the most advanced malware threats, both known and unknown. With global headquarters in Clifton, New Jersey, and branch offices in Silicon Valley, Comodo has international offices in China, India, the Philippines, Romania, Turkey, Ukraine and the United Kingdom. For more information, visit comodo.com.

Comodo Security Solutions, Inc.

Comodo CA Limited

1255 Broad Street

3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Greater Manchester M5 3EQ,

Clifton, NJ, 07013 United States Email: EnterpriseSolutions@Comodo.com

United Kingdom. Tel : +44 (0) 161 874 7070 Fax : +44 (0) 161 877 1767