Skip to main content

Acium UBS basics

This article acquaints you with key concepts and components of Acium UBS.

Configuration profiles​

In general, configuration profiles contain settings that govern how users interact with websites and applications, and each profile includes its own audience. Acium UBS uses the following types of configuration profiles:

  • Browser settings profiles contain settings for a specific browser. Acium UBS supports browser settings for Google Chrome, Microsoft Edge, and Mozilla Firefox. See Browser settings.

  • Web control profiles contain rules that block or allow websites and YouTube content. You can define rules for the following content types:

    • Site URLs — block or allow websites using a URL, domain, or wildcard expression.
    • Site categories — block specific types of websites using site categories.
    • YouTube filter — block or allow specific elements within YouTube based on the following filters:
      • Videos — block or allow specific videos using their video ID.
      • Channels — block or allow channels using the channel ID.
      • Categories — block videos based on YouTube's content categories.
      • Keywords — block videos based on specific keywords found in the video title or description.

    See Web control.

  • Extensions management profiles contain settings that block or allow installation of third-party extensions and the manner in which they're installed. See Extensions.

  • AI and Data Controls profiles restrict actions like copy, paste, upload, download, camera, and microphone, or mask sensitive data. See AI and Data Controls.

  • Browser routing profiles control which browser opens which sites. See Browser routing.

Assign an audience​

Every configuration profile includes its own audience — there's no separate assignment step. When you create a profile, you choose who it applies to:

  • Everyone in the org — all users in your Acium organization.
  • Specific groups — groups from your Google Cloud Identity or Microsoft Entra ID directory. If the Jamf integration is configured for your organization, Jamf groups appear alongside your directory groups here as well.
  • Specific users — hand-pick users, or add someone by email if they aren't found in your inventory.

After you save and deploy a profile, its restrictions take effect the next time the Acium browser extension communicates with the Acium UBS platform. For more information about the role of the Acium extension, see Acium browser extension in this article.

For more information about connecting your directory service or Jamf to Acium UBS, see Integrations.

Profile naming​

When naming configuration profiles, keep the following limits in mind:

  • Maximum length: 128 characters
  • Disallowed characters: backward slash (\), forward slash (/), asterisk (*), question mark (?)

To keep track of your profiles, consider the following best practices:

  • Use a friendly, descriptive naming scheme that helps other Acium administrators understand at a glance which resources and audience are affected by a given profile.
  • Document profiles as you create them to build a reference outside of the Acium UBS platform. This practice can help other administrators quickly understand each profile's restrictions and audience, and plan future refinements.

Filtering precedence​

In general, if a conflict arises between profiles, Acium UBS applies the most restrictive one. To guide this behavior, Acium UBS uses the following precedence rules:

  • Block rules take precedence over allow rules.
  • Profiles assigned to specific users take precedence over profiles assigned to the entire organization.

These rules resolve any conflicts that might arise in how filtering rules are applied to users. The examples that follow illustrate these rules.

Example: Block rules override allow rules​

Let's say you've created two web control profiles:

  • Profile A blocks example.com and applies to five specific users.
  • Profile B allows example.com and applies to ten specific users.

One user, Jane, is included in both profiles' audiences. Now, there are conflicting rules for how Acium UBS should handle example.com when Jane accesses the site.

Because the block rule in Profile A overrides the allow rule in Profile B, Acium UBS applies Profile A to Jane. So, when Jane accesses example.com, she sees a page indicating the site is blocked.

Example: User profile overrides organization profile​

Let's say that you've created the following profile:

  • Profile C includes a rule blocking example.com and applies to everyone in the Acium organization.

When anyone in the organization accesses example.com, they see a page indicating the site is blocked.

Later on, you create the following profile:

  • Profile D includes a rule allowing example.com and applies to the individuals on the Marketing team.

Because Profile D directly targets these individual users, it overrides Profile C's organization-wide block. As a result, each user on the Marketing team can freely access example.com, but the site remains blocked for everyone else in the company.

Example: Redirected URLs​

Let's say that you have web control profiles that block and allow access to example-company.com by specifying the following redirected URLs:

  • Profile E allows http://example.com.
  • Profile F allows https://example.com.
  • Profile H blocks www.example.com.
  • Profile I allows example.com.

Because Profile H is the most restrictive, Acium UBS blocks all URLs that redirect to example-company.com. In this scenario, the block rule in Profile H overrides the allow rules in the other profiles.

Disable filtering​

In some cases, you might need to temporarily turn off web control in your organization. For example, you might need to troubleshoot an issue involving the Acium browser extension.

If you turn off web control, the Acium extension continues to record browser activity and apply browser settings, but doesn't enforce web control profiles.

To turn off web control:

  1. In the management console, select Operate > Administration > Organization Settings.
  2. Under Enforcement, turn on Allow Unrestricted Browsing.

Acium browser extension​

The Acium browser extension monitors the websites and browser-based applications that users access. You can install the extension on the latest versions of your browser.

When a user visits a website, the extension checks the URL category of the site in the Acium URL database. Acium UBS caches and stores this lookup throughout each user's browser session. Periodically, Acium UBS revalidates URLs to ensure nothing has changed with their status.

Communication interval​

The Acium extension communicates with Acium UBS every five minutes. During each five-minute interval, the following exchange occurs:

  • The extension sends all accumulated web traffic data to Acium UBS.
  • Acium UBS sends any profile updates or database changes to the extension.

As a result, profile changes might not take effect right away in your Acium organization. When creating new profiles or updating existing ones, allow several minutes for users to experience the effect of your changes.

Extension user experience​

After installation, the Acium extension runs silently on users' browsers. In general, users are aware of the extension only when content that they try to access is blocked and a block page is displayed. Users also receive notifications when other extensions are automatically installed, enabled, or disabled in their browser to comply with configured profiles. You can configure this type of notification through Organization Settings to prevent it from being displayed. The extension displays no other notifications to users.

Web access experience​

In some cases, after entering a URL or clicking a link to a website, users might experience a slight delay of one or two seconds before the site appears. This delay is due to Acium UBS's validation process. However, after Acium UBS verifies the site is allowed, users experience no delays in navigating and using the site. You can disable this behavior through the Instant Navigation setting in Organization Settings, which enables instant page loading without waiting for categorization. In this case, pages that violate filtering rules will be blocked after they load.

Block pages for managed Chrome browsers​

If you manage Chrome browsers with the Google Admin console, the console can override Acium UBS's web control configuration profiles. If you block a website or YouTube content through the Admin console, users who access that blocked content see Google's block page and messaging instead of those from Acium UBS.

Acium sensor​

The Acium sensor collects browser and device information from the device on which it's installed and enforces browser settings profiles. You can install the sensor on any Windows or Mac device, provided you have administrator permissions on the device.

Note

For a side-by-side comparison of what the extension enforces on its own versus what requires the sensor, see Sensor vs Extension.

Device information​

Once installed, the sensor collects the following information from the user's device, regardless of operating system:

  • Browsers installed on the device
  • Version of each installed browser
  • Profiles that exist on the device for each installed browser
  • Device serial number
  • Device type (for example, desktop, laptop, or mobile device)
  • Operating system installed on the device, including version
  • Device hostname
  • Domain name
  • Date and time at which the sensor last synchronized with the Acium browser extension

For Windows devices, the sensor collects the following device posture information:

  • If the user has administrator permissions on the device
  • If Windows is up-to-date or has updates pending
  • If the Trusted Platform Module (TPM) chip is present and whether it's enabled or activated
  • Bitlocker volume status, encryption method, and percent encrypted
  • If SecureBoot is enabled and configured
  • Windows Defender status, including:
    • If the service is running
    • If antivirus is enabled or disabled and when it was last updated
    • Days since last full scan
    • If RealTime Protection is enabled or disabled
    • If Tamper Protection is enabled or disabled
    • If IOAV Protection is enabled or disabled
    • If PUAProtection is enabled or disabled
    • If Defender for Endpoint is running and has Network Protection enabled
  • Defender Firewall:
    • Whether the service is running
    • Which policies are installed
    • Whether Domain, Public, and Private profiles are enabled or disabled
  • If Defender Antivirus is active or inactive
  • If Defender Antivirus' Block at First Sight feature is enabled or disabled and configured for optimal security
  • If Defender Application Guard is enabled or disabled
  • Defender Credential Guard:
    • If service is running or stopped
    • If service is configured or not configured
  • Device Guard:
    • If Device Guard services are running or stopped
    • Code integrity policy status
    • If the audit mode in Code integrity policy enforcement is active or inactive
  • Controlled folder access:
    • If the feature is configured or not configured
    • Status of protected folders
  • Quantity of AppLocker events that are present
  • Application Control status based on Code Integrity events
  • If Windows Sandbox is enabled or disabled

Data collection frequency​

The Acium sensor works with the Acium browser extension to transfer the browser and device information that it collects to the Acium UBS platform.

After the sensor is installed, it collects an initial set of data and relays it to the Acium browser extension. The extension then sends this data to the Acium UBS platform, along with any accumulated web traffic data, at its next five-minute communication interval.

Once per day, the sensor checks for any browser and device configuration changes. If changes are detected, the sensor relays those changes to the Acium browser extension. The extension then sends the data to the Acium UBS platform at its next communication interval.

View collected data​

The Acium UBS management console displays collected browser and device information for your entire Acium organization and for each user.

To view the devices in your Acium organization, go to the dashboard and locate the Endpoints Protected tile.

The console displays device and browser information for each user on their User Details page. To view this page, go to Inventory > Users and select Details for the user you want to manage.

  • For device information, locate the User Devices tile and select Details. If the user has multiple devices, you can select each one to view its information.
  • For browser information, locate the Browser Inventory section. This section displays the browsers and number of profiles on each user device.

For more information about the User Details page, see Users.