Skip to main content

Content Filtering

Web content filtering is crucial to protecting employees from unwanted and malicious websites. Today's digital landscape hosts the pervasive threats of phishing attacks, malicious content, and unwanted advertisements. Effective content filtering enhances user safety, improves browsing experiences, and protects sensitive data from bad actors. This document provides a comprehensive understanding of web content filtering and how Keep Aware addresses its challenges.

Fundamentals of Content Filtering​

Content filtering refers to the process of filtering access to specific websites based on certain criteria. This can include blocking both unwanted (e.g., advertisement) sites and malicious (e.g., phishing) websites.

Basic Principles​

  • Inspection and Analysis: Identifying web traffic characteristics or scanning web content to categorize a site.
  • Categorization: Classifying web content into categories (e.g., malicious; phishing; safe; inappropriate) to enforce appropriate access controls.
  • Policy Enforcement: Applying security policies to control user access to various types of websites based on their categorization.

Common Scenario #1​

  1. An employee clicks on a link to a legitimate document-hosting platform.
  2. The document is prompting the user to login to Microsoft to view the document's contents. The user clicks the provided link.
  3. The user's browser is directed to a page on a website reported by security tools as "safe". However, this web page performs browser checks and then reveals the legitimate Microsoft sign-in page.
  4. Not realizing this is a browser-in-the-browser attack, the employee types in their Microsoft credentials.
  5. Security tools that lack content inspection and context can see the user went to a "safe" site but have very little, if any, additional context.

Common Scenario #2​

  1. An employee receives an email asking to reset their password by clicking a link. They click the link, which directs the user to a Google Form.
  2. The Google Form requests sensitive information, including the employee's "old" credentials.
  3. Not realizing this is a web-based social engineering attack, the user provides their business credentials.
  4. Security tools that lack content inspection and context can see that the user went to the legitimate Google Forms domain but are unaware of the sensitive data loss that just occurred.

Detailed Explanation of Web Content Filtering​

Levels of Filtering​

  • Network Level: A network appliance through which all traffic is filtered.
  • DNS Level: Uses DNS queries to block access to specific domains.
  • Endpoint Level: Software installed on individual devices to control access.
  • Browser Level: Software installed on individual browsers to control access.

Methods of Filtering​

Methods of web content filtering include:

  • IP Filtering: Blocks access to or from IPs known to host malicious content.
  • Domain and DNS Filtering: Similar to IP filtering but for domains.
  • URL Filtering: Same as IP filtering but for specific URLs.
  • SSL Decryption: The decryption of web traffic that is SSL/TLS encrypted. SSL inspection is a required, additional step for any device at the network level to perform keyword filtering or content inspection.
  • Keyword Filtering: Scans the content of web pages for specific keywords or phrases and blocks access if they are present.
  • Content Inspection: A more in-depth filtering technique that analyzes the contents of web pages to determine if access should be blocked.

Challenges and Considerations​

Common Issues​

  • Lack of Visibility: Lack of visibility into a web page's content empowers threat actors to continue to abuse legitimate domains (e.g., Google Forms) to host and distribute malicious content.
  • Lack of Context: Missing contextual data—including both website, user activities, and organizational contexts—leads tools to incorrectly label websites.
  • Performance Impact: Potential slowdown of internet browsing speed due to real-time content scanning and inspection.

Solutions and Mitigations​

  • Content Visibility: Enforce content inspection to identify unwanted and malicious content even if it's hosted on legitimate and trusted domains.
  • Comprehensive Analysis: Implement analysis that utilizes both content and context of web pages and web activities to correctly discern malintent versus benign use.
  • Optimized Inspection: Ensure tools use efficient scanning techniques to minimize performance impact.

The Keep Aware Advantage​

Keep Aware's security extension operates at the browser level and thus has (A) deep visibility into browser activities that endpoint-level software lacks and (B) without the need for SSL decryption that network-level devices require. Our tool can provide IP, domain, URL, and keyword filtering, but it is purpose-built for content filtering.

Keep Aware offers content filtering that provides real-time protection against web-based threats. Our security technology ensures minimal performance impact while maintaining out-of-box capabilities to detect and block a wide range of malicious content. Additionally, Keep Aware’s user-friendly interface and customizable and extensible controls empower IT security teams to tailor detections and enforcement policies to their specific needs.

High Level​

Keep Aware offers web content filtering capabilities to secure the browser and protect organizations from browser-based attacks. Our solution includes:

  • Deep Visibility: Keep Aware performs content inspection on every web page.
  • Organizational Context: Characteristics, such as popularity of a site in your organization, adds context to users' web activities.
  • User Context: Did the user visit a page, download a file, and type into a password field? With a deep level of visibility into browser activities, Keep Aware logs and acts on these details and more.
  • Comprehensive Analysis: Discern between malicious and benign web pages and activities by factoring in the above content and context.
  • Optimized Inspection: Experience internet browsing speeds your employees are used to since Keep Aware optimizes its content inspection capabilities.

Technical Level​

Additional technical capabilities include:

  • Performs content inspection on initial page visits and subsequent page mutations.
  • Provides context and rich metadata of user browser activities, which include:
  • Supplements native web page content with additional context, including SSL/TLS certificate data and domain WHOIS domain registration.
  • Utilizes extensible XPATH selectors to identify risky combinations of web content characteristics.
  • Employs extensible input selectors to identify data leakage relevant to your organization's data security policies.
  • Fully-customizable policies to detect content and activities specific to your organization's risk appetite.
  • Safeguards—or, user and browser protections—that are customizable to enforce your organization's policies.
  • Offers the capability to block access to entire web pages or to simply restrict specific web activities.
  • Out-of-the-box detections for and protections against a variety of suspicious activities and malicious web techniques.
  • A Best Practices Feed with foundational and high-fidelity detections to rapidly protect your employees from malicious content and reduce risk.

Summary​

Content filtering is essential for protecting users from malicious and inappropriate web content. Effective content filtering involves real-time scanning, contextual enrichment, and policy enforcement. Keep Aware’s browser solution offers extensible detections, rich context, robust protections, and minimal performance impact.

References​

Zero-Day Phishing​

In today's threat landscape, where automation and machine learning models aid bad actors to rapidly create malicious web content and evade security tools, zero-day phishing is at the top of many security leaders' minds. Learn more about phishing and how Keep Aware addresses zero-day phishing. The documentation also covers common evasion techniques, majority of which require content inspection and additional technical capabilities (e.g., inspecting page mutations) that Keep Aware performs natively and efficiently.

Further Reading​

Table of Contents