TechKnowSurge

VideoSecurityFree

Web Filtering

Web filtering protects users and organizations from malicious websites by controlling which online destinations are accessible on a network. Solutions range from agent-based software installed on individual machines to proxy servers, inline filters, and firewall-integrated tools.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Web filtering is a security discipline focused on preventing users and organizational systems from reaching websites that host malware, facilitate phishing, or otherwise pose a threat. Because new malicious sites appear constantly, relying on users to avoid harmful content on their own is not a viable strategy, making automated filtering controls a standard component of network security architecture. The method chosen for deployment significantly affects both the strength of enforcement and the resilience of the solution if a filtering component goes offline. Agent-based filtering places software directly on each endpoint, giving the machine itself the ability to evaluate and restrict browsing regardless of what network the device is connected to. Network-based approaches shift that responsibility to infrastructure: a proxy server acts as an intermediary that retrieves web content on behalf of clients and can inspect it for malware before delivery, while inline filtering places a dedicated appliance or service directly in the traffic path where it can block requests outright. Monitor mode offers a lighter-touch alternative, using switch-level traffic duplication to send a copy of each request to a filtering server, which races to deliver a block response before the actual destination can reply. Firewall-integrated filtering, sometimes connected to an internal reputation or policy server, provides yet another deployment option. Access control policies within these systems typically rely on one or more of four mechanisms: block lists that deny specific known-bad sites while permitting everything else, allow lists that permit only explicitly approved destinations, category-based filtering that restricts entire classes of content such as adult material or competitor sites, and reputation-based filtering that draws on continuously updated intelligence about which domains are considered trustworthy. Each approach involves a trade-off, with allow lists offering the tightest control at the cost of user friction and block lists providing more flexibility while remaining vulnerable to newly registered malicious domains.

What you'll learn

Explain the purpose of web filtering and distinguish between agent-based, proxy, monitor mode, and inline deployment methods
Identify common web filtering mechanisms, including block lists, allow lists, category-based filtering, and reputation-based filtering

What's covered

Web Filtering

Why Web Filtering
- Malware-Laden Sites
- Malicious Site Threats
- Protects Users & Organizations
Implementation Methods
- Agent-Based Software
  - Installed Directly on Client
- Proxy Server
  - Client Routes Through Proxy
  - Firewall Enforces Proxy Use
- Monitor Mode
  - Switch Duplicates Requests
  - Filter Server Intercepts Early
- Inline Filtering
  - Traffic Passes Through Server
  - Harder to Bypass
- Firewall-Based Filtering
  - Built-In Firewall Tools
  - Firewall Checks External Server
Blocking Strategies
- Block List
  - Named Sites Denied
  - New Sites Still Accessible
- Allow List
  - Only Listed Sites Permitted
  - Can Be Overly Restrictive
- Category Filtering
  - Block Site Categories
  - Sites Pre-Categorized by Vendor
- Reputation-Based Filtering
  - Known Good vs. Bad Sites

Key terms

Web Filtering: A security mechanism that controls which websites users can access by blocking or allowing URLs based on defined policies.
Proxy Server: An intermediary server that handles requests between clients and other servers, providing anonymity and content filtering.
Inline Deployment: A network placement mode where all traffic passes directly through the security device, allowing it to enforce policy but risking network outages if the device fails.
Block List: A list of specific websites or resources that are explicitly denied to users, while all other destinations remain accessible.
Allow List: An application control approach that permits only explicitly approved applications to run, blocking everything else by default.
Category-Based Filtering: A web filtering method that blocks or allows websites based on predefined content categories such as social media, gambling, or adult content.
Reputation-Based Filtering: A web filtering method that permits or denies access to websites based on their known trustworthiness or history of malicious activity.

Topics

Web Filtering Network Security Proxy Servers Block Lists Content Filtering Cybersecurity

Transcript

There are a lot of illegitimate sites out there: sites that have malware, sites that want to steer you into the wrong directions, sites that could be considered malicious. We have concerns over this because it affects our end users. It affects our organizations and is very problematic. So we're probably going to want to do some sort of web filtering.

Most of the time we're implementing this using some sort of web filtering software or services — software and services that are specifically installed to help us filter out all those bad sites and still allow users to get to those legitimate sites.

When it comes to web filtering, somehow we need to be able to analyze the traffic that's going from our client to the web server. We can do that from a network perspective, or on the agent itself, on the client itself. So we could have something on the client that does some sort of agent-based filtering, or something within our network such as a proxy server. We could set up monitoring. We could do it inline. These are the different methods that we could use to set up web filtering software.

Agent-based

Agent-based is when we install software, install an agent that's running on the machine, and it's going to be looking at where people are browsing to, where the users are going to, and then making a decision on whether that's acceptable or not acceptable. So agent-based just means that we're installing software directly onto the machine.

Proxy server

If we're doing web filtering on a network, one thing that we could set up is a proxy server. There are settings on an individual machine so that rather than this machine going directly out to the internet and grabbing information, it has to go through a proxy server.

So what does that look like? Let's say this is our proxy server on this network, and then the machine is set up to use this proxy server. So it goes to this machine. Then what happens is, if the site is acceptable to go to, this machine will then go out and retrieve the information. It'll come back in, it might do some extra analysis to make sure that there's no malware involved, and send it back to the machine, and now the machine has access to whatever that website is.

One way we can get around this is just by changing it so it can still go back out to the rest of the world. So one thing we could do is block on our firewall, so that it doesn't allow anybody to get to the outside world, to any of these web resources, unless it comes from the proxy server. So now you have to go through the proxy server in order to get a hold of any of these resources, any of the external resources.

Monitor mode

I've also seen web filtering set up in a sort of monitor mode. What does that look like? Nothing impedes the machine from going out to any websites out there. So what happens is this machine right here sends out a message saying, "Hey, I want this web resource." And then a duplicate copy also gets sent to this web filtering server. So this is a web filtering server right here, and what we've done is we've set up the switch to duplicate all of those requests. All of that information gets sent to the web server.

Then what the web server does is, if it says, "Oh, I don't like where you're trying to get to," it will send a response back to this machine, but it will look like it came from this actual server out here. So it sends a response back to this machine, and this machine gets it. Maybe it's a screen — maybe we set up this web server to say, "You're not allowed to go to this website. Please stop. Don't even try." That gets sent to this machine, and this machine displays it. By the time that the information gets back from the server that it actually requested, it no longer is valid, and this machine is just going to drop that information. So it kind of intervenes ahead of time. As long as this responds faster — and it will, because it's on a local network — then this will be a good way to filter traffic.

What's great about this way is that if this service goes offline, you're still able to get to the outside world, where with some of the other solutions, if it's inline, then it will stop working.

Inline

The advantage of inline is that it's harder to get around. So what happens with inline is, let's say this machine wants to go to some outside resource, and so it makes a request, and it has to come through this server right here. What happens is that this server can analyze that traffic and just respond back and say, no, you're not supposed to go to that site, so don't even try. So that is one way we could set it up.

Filtering on the firewall

A lot of firewalls now come with filtering on them, so we could be doing the filtering right on the firewall. Another solution that I've implemented in the past is where the firewall checks in with another server on the network before it allows the communication to come back in. So that would be another method as well: using the firewall, either the tools that are implemented in the firewall, or the tools on the firewall integrated into some other server that's on your network.

Block lists, allow lists, categories and reputation

So how are we going to actually block things? We can create a block list and just say, well, this website, this website, this website and this website, they're not allowed. So we just create a list of websites that they can't get to. This is less restrictive, because these are the sites they can't get to, which means everything else they can get to — and there are a lot of sites out there that are popping up every day, and this could become problematic, because now they have access to all of these brand new sites that have malicious software on them.

Or we could create an allow list. These are the websites that are allowed, and then anything else is not allowed. This is problematic because if we are not aware of a new website that's out there, then they're not going to get access to it. So the allow list can be very restrictive.

Most of these software packages do some sort of filtering by category as well. So you would go in and identify any of the categories that you are not allowing your users to get to. Maybe it's some sort of competitor sites, or productivity loss, or the big one — I used to work in schools, and they didn't want the students to go to porn sites. So you'd filter by category, and then they would go out there and figure out what all the websites are and categorize them, so that you could just filter it by category.

There's also reputation. We have certain sites that end up getting some sort of reputation, so there is a way to filter based off of reputation: what are known good sites and known bad sites.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →