The Importance of Secure Web Access

A secure web gateway (SWG) acts as a filter between company employees and the Internet, blocking unsafe content and risky user behavior. It also helps enforce security policies and compliance to protect data and devices. A solid SWG implementation can include a range of functions such as URL filtering, malware detection and prevention, application controls for popular cloud applications, DLP, and traffic inspection.

HTTPS Inspection

Using Secure Sockets Layer (SSL), websites can encrypt data between the web server and browser. This helps prevent eavesdropping or tampering. However, hackers take advantage of SSL to hide malware that is undetectable by web browsers. This makes detecting and blocking malicious SSL sites more challenging. A safe web gateway can decrypt and inspect SSL traffic to identify threats hidden by encryption. It can verify certificates and avoid weak ciphers to ensure the connections are snug. This is important because around half of web traffic today is encrypted. When HTTPS inspection is enabled, the single SSL tunnel between the client and web server is split in two.

URL Filtering

The Internet can be dangerous to firms both financially and operationally. Uncontrolled access to distracting websites can cause productivity issues, while malware and phishing sites can lead to data breaches. An integrated URL filtering solution, like a secure web gateway, can help. URL filtering works by comparing the domain of a website an employee tries to visit against a database or list of restricted websites. This prevents users from visiting sites that could disrupt business operations, such as those that include illegal or inappropriate content, are not related to work, or are known to be high-risk, malicious, or linked to phishing attacks. Many firewalls with URL filtering enabled use local lookups on a limited number of the most commonly accessed websites for maximum performance and minimal latency while also querying a master cloud-based database when necessary to keep up with new threats. This allows organizations to create categories for different types of websites and define a level of accessibility based on that category. This is useful for blocking access to social media sites that decrease worker productivity or pose a risk of sharing confidential information.

Malware Detection

In addition to enforcing and applying corporate acceptable use policies to internet browsing, a secure gateway helps protect against malicious content threats. By performing functions such as URL filtering, web visibility, and harmful content inspection on incoming data, the gateway can prevent users from connecting to websites that contain malware or other dangerous content. The gateway can even inspect outbound data, preventing sensitive information from being sent to external sources and potentially stolen by attackers. This feature, known as data loss prevention (DLP), is available on some gateways natively or via integration partners. Next-generation secure gateways, or CASBs, are a security solution that goes beyond traditional secure web gateways by helping to prevent cloud-enabled threats and data risks in an increasingly complex threat landscape. As the name suggests, a CASB deals with web and cloud traffic and can include a combination of URL filtering, malicious code detection, and filtering features, granular application control for personal instances of popular cloud applications and Shadow IT, and even DLP.

Data Loss Prevention

A gateway solution’s data loss prevention feature prevents sensitive outbound information from a network. It categorizes outbound web traffic and blocks it when data matches specific patterns or keywords. It can redact or secure confidential data such as social security numbers, credit card information, medical records, etc. Most secure gateways use proxy servers between a network and a device requesting a webpage or application. They analyze the content and pass it along only if it complies with established policies. They also provide granular control, so they can block websites or applications that are more at risk for cyberattacks and other threats. Some gateways are hardware-based, while others run as software. Some even offer remote browser isolation (RBI), which prevents malicious code or data from entering the organization’s network, protecting it from web-based attacks and reducing the attack surface. This is especially important as more and more workers use cloud-based, internet-focused apps on devices that IT can only partially trust or manage.

Traffic Inspection

A secure web gateway acts like a security guard at a checkpoint, inspecting all incoming and outgoing data to ensure it complies with an organization’s established policies. This enables an enterprise to protect itself from malware, viruses, suspicious and malicious website traffic, and data exfiltration (preventing sensitive user data and intellectual property from leaving the network). All outgoing web content can be inspected in real time for unique patterns indicating a cyberattack is underway. This includes checking for unsecured files and suspicious attachments in emails and inspecting cloud application web downloads for the presence of potentially harmful elements. A sophisticated SWG solution will also include remote browser isolation, enabling questionable web content to be run in a virtual container outside the organizational network to avoid downloading any active code that could cause infection or attack. This can help ensure that high productivity is maintained. Many SWGs can also decrypt encrypted data for inspection, providing enhanced visibility and granular control over SSL-encrypted traffic.

*This is a collaboration post