URL Filtering

What Is URL Filtering?

URL filtering technology governs internet entry by evaluating user URL submissions. It grants or denies user requests to particular websites in order to oversee how the internet is utilized and to minimize security threats.

URL filtering limits access to specific categories and individual URLs, delivering multiple critical functions:

1. It blocks entry to websites unrelated to work, thereby boosting the productivity of enterprise employees and curbing bandwidth misuse.

2. It prohibits visiting sites that hold unlawful or unsuitable material, maintaining legality and adherence to standards of online conduct.

3. It bars access to websites that are deemed unsafe due to the presence of malware and phishing attempts, offering a safeguard against network attacks.

The Significance of URL Filtering

In today's digital age, people predominantly rely on browsing the web to perform work functions, acquire knowledge, and seek entertainment. However, the Internet is rife with insecurities. While it provides numerous conveniences, it also introduces unparalleled threats. These threats not only pertain to network security but also include the detrimental effects of network misuse:

• When at work, employees may spend time on websites that are not related to their duties, such as engaging with social media or streaming videos, which can significantly lower productivity, use up valuable network bandwidth, and in cases of visiting illegal sites, potentially result in legal consequences.

• Public facilities like schools and libraries may face legal issues if inappropriate content is accessed on their networks.

• If employees inadvertently visit websites infused with malware or designed for phishing, sensitive company or personal information may be compromised, exposing both to risks like viruses and trojans.

Controlling online behavior is thus imperative. URL filtering stands as a viable solution to these issues, limiting the web resources users can reach. This technique enables the blockade of access to categories of websites known for phishing, social networking, or video streaming. Additionally, it allows the specification of particular URLs to be either expressly permitted or denied access.

Understanding the URL Filtering Process

The essence of URL filtering lies in the evaluation of a requested URL against a pre-defined set of URLs contained within a database or a list. Upon user request—whether manually inputting a URL or clicking a link from a search engine—if there's a match and the URL is part of a restricted category or is a listed blocked URL, the system will inhibit access. In such cases, the user's browser is typically rerouted to an alternative page, indicating that access to the desired webpage has been denied.

These URL databases or lists can be managed either directly on the local device or through cloud-based services. For efficiency, URLs that are frequently requested tend to be stored in a local cache, permitting faster access, while a more extensive collection is maintained in the cloud, allowing for a broader scope of control. If a URL is not found in the local cache, the device will look it up in the cloud database, helping to reduce response time.

Moreover, the organization of these URL databases or lists can take various forms, such as categories of URLs (e.g., adult content, social media), individual URLs that are explicitly blocked (blacklist), or those that are explicitly allowed (whitelist). The URL filtering mechanism is illustrated in the said figure, detailing the step-by-step process a device undertakes to determine whether a URL request should be permitted or denied based on these parameters.

Comparing URL and DNS Filtering Techniques

URL and DNS filtering serve as distinct approaches to internet content regulation, with their own specific modes of operation and areas of employment. URL filtering operates by scrutinizing the full URL in a user request, which allows for fine-tuned control over the accessibility of specific web pages or content within a website. Conversely, DNS filtering functions by intercepting the domain name within a DNS query, subsequently enabling or disabling access to all the resources under that entire domain.

The choice of method largely depends on the intended scope of restriction. For instance, to block access to all content within the domain, DNS filtering is the appropriate tool. But if the aim is to only restrict the entertainment section of that same domain—URL filtering provides the necessary precision.

In cases where an entire domain is recognized as harmful, DNS filtering is the preferred choice to preemptively prevent access to any subpages that might be risky.

URL filtering can also be domain-based, but differs from DNS filtering as it is actioned during the URL request phase rather than the preceding DNS query stage, which can be less taxing on device performance. Furthermore, DNS filtering operates independently of the service protocols, making it protocol-agnostic, while URL filtering specifically targets HTTP/HTTPS traffic.

URL Filtering vs. Application Control

Application control and URL filtering are two distinct methods for managing and securing web traffic, each with its respective focus and domain of application.

Application control, employing application identification technologies, discerns various applications within network traffic to exert more nuanced control. It includes the capacity to manage web-based applications. Contrastingly, URL filtering specifically targets the management of web page URLs, thereby regulating access at the web page level.

When discussing web applications, application control distinguishes and governs access to the application itself, which could involve multiple web pages pertaining to a single application. URL filtering, in turn, zeroes in on the access behaviors associated with individual web pages.

The strength of application control lies in its granular management of applications. For recognizable services, such as Facebook's various functions (e.g., Facebook browser, Facebook videos, Facebook games), it can be far more practical, especially when a single application may be associated with numerous URLs. With application control, administrators merely need to configure by application names, thus simplifying management.

URL filtering excels in scenarios where control is needed over access to specific categories of websites or multiple URLs within the same domain. If the goal, for example, is to permit access only to the social networking aspects of Facebook, while barring other social platforms, URL filtering proves to be the straightforward approach. Employing application control in such a case would necessitate the identification of every single application linked to the desired website.

In conclusion, application control and URL filtering serve different purposes and are best utilized in combination, offering a comprehensive approach to traffic management and online security. Each has its place in different usage contexts, either for the fine-tuned governance of application access or for broader domain or webpage-based filtering.

URL Filtering Is Not Sufficient to Defend Against All Web Attacks

While URL filtering is a valuable component in safeguarding against cyber threats by restricting access to known malicious websites, it is not a standalone solution for comprehensive defense against the spectrum of web-based attacks. For robust protection, enterprises and organizations must implement a layered security strategy that addresses both familiar and emerging dangers. This multi-faceted approach typically involves the following measures:

Implementing a Next-Generation Firewall (NGFW) equipped with a suite of security features is a foundational step. A NGFW goes beyond basic URL filtering with capabilities that include:

• Content filtering, to examine and restrict access to harmful web page content.

• File filtering, to manage the transfer of files, guarding against unauthorized uploads and downloads.

• Intrusion Prevention System (IPS) functions, aiming to uncover and stop threats like Trojans and other forms of malware.

• Antivirus integration, offering additional scanning and removal of file-based viruses.

Linking the NGFW to cloud-based security services allows for real-time updates on the latest threat intelligence, ensuring proactive defense mechanisms against not yet widely-recognized threats. Huawei's firewall solutions can, for example, collaborate with cloud sandboxing tools to unearth and counter Advanced Persistent Threats (APTs), while simultaneously enhancing the local database of malicious URLs and files based on detection feedback, thus refining the effectiveness of subsequent protective actions.

Moreover, NGFWs often handle encrypted traffic, including HTTPS, allowing them to inspect and block potential threats hidden within SSL-encrypted communication.