PC Magazine: Web Content Filtering: Don't Go There

Web filtering is possibly the most controversial category of products we review here at PC magazine. No other topic so quickly suggests thoughts of an Orwellian Big Brother or so starkly divides employees and managers. You may consider blocking and monitoring Web access appropriate for children at home or school, but does it have any place at work?

Many companies point to legal liability, productivity, and bandwidth usage as concerns that arise when employees view inappropriate (read: porn) Web sites, shop online incessantly before the holidays, or download and play MP3 files throughout the day. Sexual harassment lawsuits do occur, and it would be hard to argue that someone repeatedly bidding on eBay is being as productive as possible. If Britney Spears is coming through loud and clear but the monthly sales close is bogged down, you've got a problem.

There are, however, two sides to this coin. "There haven't been that many lawsuits, productivity is up overall, and bandwidth is cheap," says Bill Gassman, principal analyst at market research firm Gartner. And many employees wonder whether Web filtering is like taking away pens to prevent idle doodling. Can't you get rid of the offenders some other way and leave us productive employees alone? Privacy and trust issues come up, and though companies do have the right to monitor employees, most are reluctant to enforce procedures that tell their employees "we don't trust you." Like spying on your spouse, these policies can quickly lead to distrust on all sides.

Given the potential for backlash, a company must contemplate and identify business goals while paying attention to employee concerns. Only then can it create an effective policy for acceptable use. Communicating the policy and the presence of filtering software to employees is also critical. A secret deployment could cause serious repercussions and perhaps a privacy lawsuit from employees when they find out—and they will find out.

Some companies are drawn to Web-filtering solutions by a lack of perceived control, especially in the wake of new regulations like HIPAA and Sarbanes-Oxley, which are meant to protect customer privacy and oversee financial dealings. If you are in this situation, don't just throw technology at the problem: You need to think through policies and avoid letting fear provoke hasty decisions.

The Products

We tested four software products and three appliances that block and monitor access to various categories of Web sites. You can imagine the really bad ones most companies worry about—porn, drugs, hacking, hate—but the products also work with categories like shopping, sports, hobbies, gambling, and even with those such as blogs, job search (do it on your own time!), and Web e-mail (a common entry point for viruses).

All the filtering products we looked at use block lists that most of the companies update daily, so expect to pay a high yearly subscription fee (half or more of the up-front cost). Some also use algorithmic techniques to determine whether content falls into a blocked category, but it turns out that plain old block lists are the most effective.

It's also important to know what these products don't do. First, they don't protect your network or employees from viruses and hacks. While they can block employees from accessing sites known to contain malicious mobile code or hacking mater-ial, you'd be naïve to use them as your only protection. New malware sites appear daily, and users can catch viruses in other ways besides Web surfing. Look to desktop and network antivirus software and firewalls for these needs.

And what about the shenanigans possible when employees use instant messaging, peer-to-peer file sharing, and streaming media? Filtering products address these rogue services with varying levels of protection, and some vendors offer separate products to address them (see the sidebar "Taking on the Really Tough Filtering Jobs"). E-mail is a completely separate beast, with the potential for spam and virus attachments. Eventually, we think all these capabilities will come together in a single package, but point solutions rule the day at present.

There are two primary deployment options for these products. They can run either independently, often known as standalone mode, or integrated with a firewall, caching device, or proxy server. All the software products we reviewed have both options available, except Sentian, which must integrate with one of a host of supported edge devices. And all the appliances run in standalone mode except St. Bernard iPrism, which sits in the physical path of every URL request.

The standalone products are often classed as pass-by, because URL requests needn't go through the product; rather, the product sits alongside the data stream to sniff out and address bad packets. Similarly, the integrated products are known as pass-through, since every packet must enter and cross the filter to get out to the Internet. Each type has a number of situational benefits and drawbacks; hence a company should base its decision on its own requirements. Whether you choose pass-by or pass-through software, you must size the hardware appropriately to avoid slowdowns and sneak peaks.

The software products generally have more power and flexibility as well as more intuitive management interfaces than the appliances. But the appliances turned out to be easier to install. Also, because the appliances don't need to integrate with firewall, proxy, or cache servers, they work in any environment without incurring complex integration problems. In addition to block list updates, you can receive automatic software upgrades to an appliance. But one drawback with hardware solutions is that you can't just use a more powerful box to increase performance as you can with the software.

We like Web-based consoles, which all the appliances use, because they let administrators make changes from anywhere. But we saw the usual trade-offs compared with Windows interfaces. Integration with Windows domain, Active Directory, and Novell directory services are helpful because they let administrators use existing users and groups for Web-filtering policies.

Some products offer soft blocking (in which a warning page is sent to the user instead of the requested page but access to the URL is still allowed through a link), overrides (which allow administrators to unlock a page), quotas, and review requests. Such features avail you of more options and soften the blow for employees. In our testing, artificial-intelligence options for blocking usually didn't measure up and always made for more complexity. Avoid URL and content scanning as a blocking mechanism: It produces too many false positives.

Monitoring and reporting features vary drastically among the products, with excellent interfaces and poor ones, flexible architectures and limiting ones. We care mostly about how well suited the tools are to management and human resources personnel: These people should be the ones enforcing appropriate-use policies by creating and viewing reports—not the IT group.

How We Tested

To evaluate these products, we identified four criteria: configuration and deployment, administration, blocking, and monitoring and reporting. We had the unenviable task of testing these products on a carefully selected set of inappropriate content, averting our eyes when the occasional naughty page came through. We tried the sites your mother would know and the sites that only your strange uncle would visit. In an attempt to trip the products up, we used deceptive pages, exploring the loopholes presented by caching and translation sites. On the whole, the products did well, but the occasional piece of flesh did get through, and we could shop at esoteric little sites throughout the Web even when the products were set to block shopping.

Our test configuration made use of a 3Com SuperStack 3 Switch 4400 Family (with a roving analysis port, which is needed for the standalone solutions to work) and Microsoft Internet Security and Acceleration (ISA) Server 2000.

The Bottom Line

Companies with tons of bandwidth and productive employees may just want to block the truly offensive content and monitor the rest, keeping an audit trail and reacting only when egregious misuse occurs. If you do decide to filter, you may as well do a good job of it. Our reviews will help you find the right balance for your company's needs in terms of liability, productivity, privacy, and trust.