Understanding Click-Time Protection

Click-Time Protection (CTP) is based on URL “rewrites”. Every link within the subject and body of incoming email messages is replaced with an Cloud App Security-generated URL. When the user clicks on the link, Cloud App Security tests the site before redirecting the user to that website.

Click-Time Protection provides

• Another layer of post-delivery protection
• Enhanced protection for zero-day attacks, as URLs can later become malicious
• Forensics

Click-time Protection provides these options for how malicious websites can be handled :

• Do nothing and allow users to go through to the site
• Completely prevent users from visiting the site
• Display a warning to users with the option to continue to the site

Once enabled, all links contained in the subject or content of an incoming email message are replaced with an SonicWall link. When the user clicks on the link, it triggers an immediate scan of the target website.

• If the website is determined to be benign, the user continues without interruption.

• If the website is determined to be malicious, the user is forwarded to a warning page.

  

Each stage of the Click-time Protection process is recorded for forensic and auditing purposes: from the original URL substitution event to the result of the time-of-click scan. If configured in ‘warning only’ mode, user clicks of the continue link are recorded.

 

• Configuring and Using Click-Time Protection