Cloud SWG: High Risk Isolation Initial Tenants Migration

The maintenance is now complete. Thanks for your patience.

The scheduled maintenance is now underway. We'll keep you updated on our progress.

Beginning July 22, 2024, Broadcom will initiate a series of maintenance events to transition the majority of High Risk Isolation Cloud SWG tenants based on Symantec Web Protection to the new consolidated SWG view within the Threat Protection rules page. The per-tenant basis rollout is planned for a period of four weeks, with an expected completion date of August 22.

This update provides an enhancement to how High Risk Isolation (HRI) policy can be managed and enforced as part of the existing Cloud SWG policies.

When HRI is enabled, the Cloud SWG portal includes HRI rules within the Threat Protection layer. You can now have full visibility into the HRI logic, and can combine the isolation decisions with your existing Threat Protection rules.

After the policy is activated, network traffic is subject to HRI rules as part of the consolidated Cloud SWG policy.

For more information, see the Consolidated SWG Policy: High Risk Isolation documentation.

Impact

• Portal-managed (non-UPE), Symantec Web Protection tenants (not including Network Protection or tenants with the Full Web Isolation add-on) will be migrated. Tenants must have one of the following policy configurations:
  • Web Isolation layer is disabled (HRI is not used)
  • Web Isolation layer is enabled, and no “Do not isolate” rule exists
    • In addition, the Threat Protection layer does not include:
      • “Allow” rules
      • “Block unless isolated” rules above “block” rules

All other WPS tenants will be targeted in a future release.

• Current tenant behavior is preserved as part of the migration:
  • Customers with the Web Isolation layer currently disabled will be migrated to an updated policy in which HRI is disabled.
  • Customers with the Web Isolation layer currently enabled will be migrated to an updated policy in which HRI is enabled.
• Policy updates:
  • HRI rules are managed natively in the Threat Protection policy layer.
  • All Cloud SWG policies (Threat Protection, Content Filtering, and so on) will be enforced on isolated traffic as well.
  • To preserve the current behavior, “Block unless isolated” rules will be converted to “Block” rules below the new High Risk Isolation rules.

Required Action

• After your tenant has been migrated, click Activate Policy to apply the migration change.
• Review the new feature documentation and become familiar with how you can use it to better protect the end users and enforce your customized policy.
• Not using HRI yet? It is very easy to start.

Support

Questions? Contact technical support by visiting: https://support.broadcom.com/security.

For service status and maintenance updates visit and subscribe to Broadcom Service Status: https://status.broadcom.com