Web Filtering

What Is Web Filtering?

Web filtering technology manages users' internet access by regulating which websites they can visit, the content they can view, and the files they can download. For instance, this technology can block access to gambling sites, filter out web pages with illegal content, and control search engines to exclude inappropriate search results.

Web filtering can also restrict access to non-work-related websites to boost productivity and regulate employee online behavior in enterprises. Additionally, it serves as a first line of defense against web threats, preventing access to malicious websites and downloads. Web filtering is the most commonly used web access control measure for enterprises and organizations.

Exploring Different Varieties of Web Filtering

A web filtering service can operate in various ways, differentiated by how they define acceptable content. Web filters can be categorized based on the following methods:

• Allow Listing: Allow lists specify the sites that a user, computer, or application is permitted to access. All web traffic is compared against this list, and any requests to destinations not on the list are denied. This method ensures very strict control over the sites that can be visited.

• Block Listing: Block lists function opposite to allow lists by specifying sites that users should not visit. All traffic is monitored, and any request to a site on the blocklist is denied. This method is commonly used to protect against known malicious sites, such as phishing sites, malware download locations, and inappropriate content.

• Content Filtering: Content and keyword filtering evaluate web traffic based on the content of a webpage to decide whether to allow or block access. For instance, an organization might use filters to block sites with explicit content. When a request is made, the site’s content is examined, and if it violates the policy, access is denied. This method allows organizations to block harmful or inappropriate sites that are not pre-identified.

In addition to filter types, web filtering solutions can vary based on where they apply their rules. Filters can be implemented in several ways, including:

• DNS Filtering: The Domain Name Service (DNS) acts as the internet's phone book, converting domain names (like google.com) into IP addresses used by computers for routing traffic. DNS filtering monitors these DNS lookup requests and either allows or blocks the traffic based on predefined policies.

• URL Filtering: A URL, or Uniform Resource Locator, serves as the address of a webpage. URL filtering scrutinizes the URLs embedded within web requests and decides whether to permit or deny a request based on established policies.

• Content Filtering: Content filtering examines the content of a requested webpage. If the response breaches the established policy, it is blocked.

Also, web filtering solutions can be classified by where the filter is applied. The options for this include:

• Client-Side Filtering: Client-side web filtering involves software installed on a user’s computer. It scrutinizes both outbound and inbound traffic, deciding whether to allow or block it according to predefined policies.

• Server-Side Filtering: Server-side filtering occurs through a solution situated either on-premises or in the cloud. All web traffic is directed through this solution, granting it visibility and control over the traffic.

The Significance of Web Filtering: Understanding Its Impact

Quick access to information through web browsing has become essential for work, staying informed, and entertainment. However, the Internet is inherently insecure, and while network resources offer convenience, they also introduce significant threats. Web filtering can be an excellent tool to help prevent attacks or loss of security.

• Malware Protection: Phishing and other malicious sites can deliver malware and harmful content to users' computers. Web filtering enables organizations to block access to these threatening websites, safeguarding company and user security.

• Data Security: Phishing sites often aim to steal user credentials and sensitive data. Blocking access to these sites helps an organization reduce the risk of data breaches and leaks.

• Regulatory Compliance: Companies must adhere to numerous data protection regulations that require safeguarding specific data from unauthorized access. Web filtering helps organizations control access to sites that might attempt to steal protected data or could be used to unintentionally or intentionally leak data, such as social media or personal cloud storage.

• Policy Enforcement: Web filtering allows organizations to enforce corporate web usage policies. It can block inappropriate use of company resources, such as accessing sites with explicit content, ensuring compliance with company guidelines.

Understanding the Mechanism of Web Filtering

Web filtering enables administrators to easily enforce comprehensive web access control. The diagram below illustrates how web filtering offers various control modes suitable for different stages of Internet access.

Safe Search

When using search engines like Google, YouTube, and Bing to find web pages, these platforms offer a safe search extension that automatically filters out search results with inappropriate content. Web filtering can enforce safe search without requiring users to manually enable it in their browsers. This feature is particularly useful for public organizations such as schools and libraries, ensuring a safer online experience for all users.

DNS Filtering

When a user tries to access a website, the first step is sending a DNS request to fetch the corresponding IP address for the domain name. DNS filtering intervenes by controlling user access to the entire domain through filtering the specified domain name in the DNS request. Should a domain be prohibited, all network addresses under that domain will be restricted.

DNS filtering offers two implementation modes:

• Pre-defined Category Database-based Filtering: A firewall maintains a dynamically updated database, either locally or on the cloud, comprising various categories corresponding to common domain names. Administrators define actions for each domain category, such as social networking, shopping, and news, ensuring centralized control over domains within each category.

• Blacklist- and Whitelist-based Filtering: Administrators manually set actions for specific domain names. Known malicious domains are blacklisted to prevent access, while trusted domains, including those of self-built websites, are whitelisted to permit access.

URL Filtering

Following domain name resolution, the URL request phase commences, where a request is made to access a specific webpage URL. During this phase, URL filtering comes into play, scrutinizing the specified URL in the request to manage user access. Unlike DNS filtering, URL filtering offers more granular control over web access based on URLs.

Like DNS filtering, URL filtering employs both URL category databases and blacklist/whitelist modes for implementation. Administrators have the flexibility to manage URL access by defining categories (e.g., phishing and social networking websites) and specific URL addresses, ensuring comprehensive control over web access.

Web Content Filtering

Once the URL is accessed, users interact with specific web pages, viewing content and submitting information. During this phase, the web content filtering feature is utilized to manage user activities involving prohibited keywords, such as gambling. This functionality serves several purposes:

• Restrict access to web pages containing prohibited keywords.

• Prevent users from sharing or posting prohibited content on social media platforms.

• Restrict users from entering prohibited keywords in search queries.

• Block the submission of content containing prohibited keywords (e.g., during user registration).

Content-level control is essential for ensuring appropriate internet usage and preventing data breaches. Alongside manually specified keywords, common feature codes like bank card numbers, identity card numbers, and mobile phone numbers are preloaded onto the system. Administrators can directly prohibit such content to mitigate the risk of information leakage.

File Filtering

Internet users frequently engage in file uploads and downloads, which, if unregulated, can lead to internal data leaks and virus infections within a network. For instance, an executable file downloaded from the internet may harbor concealed viruses, while uploading internal source code files could potentially expose a company's sensitive information.

The file filtering feature serves to regulate the types of files permitted for transfer, thereby preventing the exchange of executable (EXE) files and C language code files, among others. By employing file filtering, administrators can accurately identify file types beyond just their name extensions, ensuring that file type information remains transparent and concealed.

Beyond Web Filtering: Building Comprehensive Web Security Defenses

Web filtering serves as an initial line of defense by blocking access to recognized malware and phishing websites, thereby reducing the occurrence of web-based attacks. However, solely relying on web filtering is inadequate in safeguarding against the entirety of web threats. To fortify defenses, enterprises and organizations must adopt a holistic web security solution capable of countering both known and unknown threats. This necessitates the integration of multiple security functions working in tandem.

A common approach to achieving comprehensive web security involves:

• Implementation of a Next-Generation Firewall (NGFW) equipped with diverse security functionalities. These may include the Intrusion Prevention System (IPS) to identify various attacks like Trojan horses and malware, and an antivirus feature to detect file-based viruses.

• Synchronization of the NGFW with cloud-based resources to access real-time threat intelligence, enabling defense against emerging and unidentified threats. Furthermore, detection outcomes can be utilized to update local malicious URL and file lists, enhancing subsequent detection efficacy.

• Deployment of security software, such as antivirus applications, on internal network terminals to provide additional layers of protection against potential threats originating from within the network environment.