4.5 Web filtering

Question 1

Content filtering

Answer 1

Control traffic based on data within the content
–URL filtering, website category filtering
* Corporate control of outbound and inbound data
–Sensitive materials
* Control of inappropriate content
–Not safe for work
–Parental controls
* Protection against evil
–Anti-virus, anti-malware

Question 2

URL Scanning

Answer 2

• Allow or restrict based on Uniform Resource Locator
  –Also called a Uniform Resource Identifier (URI)
  –Allow list / Block list
• Managed by category
  –Auction, Hacking, Malware,
  –Travel, Recreation, etc.
• Can have limited control
  –URLs aren’t the only way to surf
• Often integrated into an NGFW
  –Filters traffic based on category or specific URL

Question 3

Agent Based

Answer 3

• Install client software on the user’s device
  –Usually managed from a central console
• Users can be located anywhere
  –The local agent makes the filtering decisions
  –Always-on, always filtering
• Updates must be distributed to all agents
  –Cloud-based updates
  –Update status shown at the console

Question 4

Proxies

Answer 4

• Sits between the users and the external network
• Receives the user requests and sends the request
  on their behalf (the proxy)
• Useful for caching information, access control,
  URL filtering, content scanning
• Applications may need to know how to use
  the proxy (explicit)
• Some proxies are invisible (transparent)

Question 5

Forward Proxy

Answer 5

• A centralized “internal proxy”
  –Commonly used to protect and control user
  access to the Internet

Question 6

Block rules

Answer 6

• Based on specific URL
  –*.professormesser.com: Allow
• Category of site content
  –Usually divided into over 50 different topics
  –Adult, Educational, Gambling, Government,
  Home and Garden, Legal, Malware, News, etc.
• Different dispositions
  –Educational: Allow
  –Home and Garden: Allow and Alert
  –Gambling: Block

Question 7

Reputation

Answer 7

• Filter URLs based on perceived risk– A good reputation is allowed– A bad reputation is blocked– Risk: Trustworthy, Low risk, Medium risk, Suspicious,
  High risk
• Automated reputation– Sites are scanned and assigned a reputation
• Manual reputation– Managers can administratively assign a rep
• Add these dispositions to the URL filter. High risk: Block, trustworthy: allow.

Question 8

DNS filtering

Answer 8

• Before connecting to a website, get the IP address– Perform a DNS lookup
• DNS is updated with real-time threat intelligence– Both commercial and public lists
• Harmful sites are not resolved– No IP address, no connection
• This works for any DNS lookup. Not just web filtering.