Skip to main content

Plan your deployment

The Acium UBS platform protects organizations and users from browser-borne attacks and helps you control web-based content and activity, browser configuration, extensions, and sensitive data across your organization.

To get the most out of Acium UBS, we recommend the following best practices:

  • Create allow rules for the business applications you rely on.
  • Review the site categories that classify malicious and exploitive content and block them as a standard profile configuration.
  • As you configure each profile's audience, keep a record of these assignments. This record can help you manage profiles effectively and troubleshoot any rule conflicts.

Align web control with company policy​

Defining how web control aligns with your company's web security policies starts with the following tasks:

  • Identify the business applications that users need to access for their work.
  • Create web control configuration profiles that allow access to those applications.

If your company doesn't already have a list of allowed standard applications, we recommend using Acium UBS for a period of time (typically, 15-30 days) to monitor web activity. Monitoring web activity requires that users have the Acium browser extension installed. Afterward, you can use the monitoring information to curate an inventory of the applications that users are accessing.

After you've created a web control profile for your allowed applications, assign it directly to the right audience — users, groups, or your entire organization — as part of that same profile.

Decide which applications to allow​

Allowed applications not only include the applications your organization provisions for business use, but also the applications your users need to get their jobs done or applications you want to allow for personal use.

For example, you might want to allow everyone to access news websites like CNN or The New York Times. However, you might want to allow only your Marketing team to access social media sites like Facebook or LinkedIn.

After you've inventoried your applications, identify the users who need access to each one. Understanding which applications require global access and which applications should be limited to specific users can help you create effective web control profiles later on.

Decide which sites to block​

Blocked sites not only include sites that are distracting, but also sites that represent a threat to your company's security. In addition to Acium UBS's built-in real-time detection of malware and phishing attempts, we recommend always blocking sites that are categorized as malicious or exploitative.

Use the following category list to get started blocking malicious sites:

  • Criminal Activities > Piracy & Copyright Theft
  • Malicious > Ad Fraud
  • Malicious > Botnet
  • Malicious > Command and Control Centers
  • Malicious > Compromised & Links to Malware
  • Malicious > Malware Call-Home
  • Malicious > Malware Distribution Point
  • Malicious > Phishing/Fraud
  • Malicious > Spam URLs
  • Malicious > Spyware & Questionable Software
  • Malicious > Cryptocurrency Mining
  • Miscellaneous > Parked & For Sale Domains

For more information about blocking site categories, see Web control.

Align browser configuration with company policy​

To determine how browser configuration aligns with your company's web security policies, we recommend completing the following tasks:

  • Identify the browsers currently in use in your company. Even if your company standardizes on a single browser, determine whether any non-standard browsers are in use and the business reasons for their use.
  • For each browser, determine the browser features and behaviors that you want to allow or disallow, in accordance with your company's web security policy. Develop a list of browser settings that comply with your security requirements. This list forms the basis of a default configuration that you can update to accommodate the business needs of your users.

If you don't already have a list of browsers in active use, we recommend using Acium UBS for a period of time to monitor web activity. Monitoring requires that users have the Acium browser extension installed. Afterward, you can use the browser and device information that Acium UBS records to develop your own inventory of active browsers and devices.

Plan your profiles​

Acium UBS lets you configure the following types of profiles, each with its own restrictions and its own audience:

  • Web control — manages users' access to applications and websites. See Web control.
  • Browser settings — manages the configuration of Google Chrome, Microsoft Edge, and Mozilla Firefox. See Browser settings.
  • Extensions management — manages which browser extensions are allowed, blocked, or installed in each browser. See Extensions.
  • AI and Data Controls — restricts actions like copy, paste, upload, download, camera, and microphone, or masks sensitive data. See AI and Data Controls.
  • Browser routing — controls which browser opens which sites. See Browser routing.

Unlike earlier versions of Acium UBS, there's no separate assignment step: each profile includes its own audience configuration — everyone in the org, specific groups, or specific users — as part of creating the profile. Once you save and deploy a profile, it's active immediately for the audience you selected.

For web control profiles, use your application inventory to complete the following tasks:

  • Identify the applications and sites that everyone in the company needs access to, and apply those profiles to your entire Acium organization.
  • For applications with limited access, identify the people that use them regularly, and apply those profiles to the relevant groups or individual users. If you use Google Cloud Identity or Microsoft Entra ID to manage access to these applications, you can target your profiles at applicable groups as well as individual users.

For browser settings profiles, use your browser inventory to complete the following tasks:

  • Determine the settings that must be enforced by default for each browser, according to your company's web security policy, and apply those profiles to your entire organization.
  • Identify the people who might need different browser configurations, and apply targeted profiles to those users or groups.

Zero Trust​

If your company's security policy is based on a Zero Trust model, you can focus on identifying allowed resources and the users who need to access them. After you've completed your inventory, create profiles that allow only these resources.

When you configure a web control profile, turn on Zero Trust Mode during setup. When this setting is turned on, users can access only the applications and websites you've allowed. All other applications and websites are blocked by default.

Plan for administrator and user access​

Administrators access your Acium organization when they sign in to the Acium UBS management console. Users access your Acium organization every time they sign in and use the Acium browser extension. During your planning, consider the following questions:

  • Which administrators in your company are allowed to manage your Acium organization? Identify at least two administrators to ensure there is always someone in your company who is trusted to access your Acium organization.
  • How will users sign in to Acium UBS? You can configure Acium UBS to accept sign-ins through browser profiles, the Acium browser extension, or both.
  • Will users need Google or Microsoft federated identities? When signing in to Acium UBS, users are prompted to use either a Google or Microsoft identity. If your company uses an on-premises identity provider or a different cloud identity provider, you might need to consider integrating it with Google Cloud Identity or Microsoft Entra ID so users' existing sign-in credentials can be used with Acium UBS.
  • Which users are allowed to sign in to Acium UBS? To guard against unauthorized sign-in attempts, your Acium organization includes an allow list where you can specify who's allowed to sign in. Identify the internal user domains in your company and the email addresses of any external users such as contractors. When you configure your Acium organization, you can add these domains and email addresses to the allow list.

Plan for extension and sensor deployment​

Acium UBS includes two components for enforcing the profiles you create:

  • Acium browser extension — monitors users' web activity, enforces web control and data control profiles, and sends users' activity data to the Acium UBS platform for viewing in the management console. This component is required for using Acium UBS.
  • Acium sensor — collects information about the user device on which it's installed and enforces browser settings profiles. This component is optional.

Determine how you will deploy the Acium extension to the users who will be included in your Acium organization. If you decide to use Acium UBS to manage browser configurations, include the Acium sensor in your deployment plan.

If you manage Google Chrome browsers, you can deploy and manage the extension automatically through the Google Admin console. If you manage Microsoft Edge browsers, you can deploy and manage the extension through Group Policy. You can also allow users to install the browser extension from the Google Chrome Web Store, the Microsoft Edge Add-ons site, or the Firefox Browser Add-ons store.

To deploy the sensor, you can use your existing endpoint management solution, use Group Policy, or allow users to install the sensor themselves.

Self-install considerations​

If you allow users to self-install the Acium extension or sensor, keep the following considerations in mind:

  • After installing the extension, users are prompted to enter the name of their Acium organization. Plan to communicate this information to users so they can sign in to your Acium organization and use the extension successfully.
  • To install the sensor successfully, users must have administrator privileges on their device.