A.8.23
Web filtering
Technological controlsCheckpoints 6Evidence 6Cases 5
Control objective
This control requires that access to external websites be managed/controlled so that members of the organization are less exposed to malicious content and risky sites. When users reach compromised sites, phishing sites, command-and-control (C2) servers, or sites that are unrelated to work or legally problematic, the result can be malware infection, information leakage, and reputational/legal risk. The objective is to protect confidentiality, integrity, and availability together by allowing or blocking target URLs/domains/categories according to policy and by recording and reviewing the outcome.
Key checkpoints
- Is an allow/block policy for access to external websites (category, URL, domain, reputation based) defined and formally approved?
- Is a web filtering capability (proxy, secure web gateway, DNS filtering, firewall URL filter, and so on) in place that blocks known malicious/phishing/C2 sites and risky categories?
- Are threat intelligence, reputation lists, and category databases kept up to date so that newly identified risky sites are reflected promptly?
- Is the same filtering policy applied when users connect from outside the corporate network, such as remote workers and mobile devices?
- Is there an inspection policy for encrypted traffic such as HTTPS, along with criteria for exceptions that consider personal data/privacy?
- Are block/bypass-attempt logs collected and reviewed, and is there a procedure to request and review exceptions for false positives?
Implementation guidance
- Establish allow/block policies per web category based on business need and risk level, and block by default the sites known to distribute malware, host phishing/C2, or provide anonymizing proxies.
- Check capability differences: proxies/secure web gateways can enforce supported URL/content policies, while DNS filtering primarily controls domains. Explain blocks through available mechanisms without assuming HTTPS can always show a block page or instructing users to ignore certificate warnings.
- Automatically update threat intelligence, reputation feeds, and category databases so that the latest risky sites are reflected promptly.
- Apply the same policy in remote/mobile environments through an endpoint agent or cloud-based filtering to remove blind spots.
- Decide whether and where to decrypt HTTPS after assessing necessity, security impact, privacy, and legal requirements. If used, manage certificate validation, interception CA key protection, TLS security, and exceptions. For uninspected traffic, apply appropriate alternatives such as domain, reputation, or endpoint controls.
- Collect and periodically review block events, bypass attempts, and policy-exception requests, and operate an exception-approval procedure and user guidance (acceptable use policy) for false positives.
- Combine with download-file scanning and malware controls to defend against web-borne threats in multiple layers.
Evidence
- Web filtering/internet access control policy and allow/block category criteria
- Secure web gateway/proxy/DNS filter configuration screens and block-policy settings
- Update history of threat intelligence/reputation/category databases
- Block-event logs, bypass-attempt logs, and periodic review/inspection records
- Policy-exception (allow) request/approval records and the exception list
- Filtering coverage status for remote/mobile devices and SSL-inspection exception documentation
Nonconformity examples
- There is no allow/block policy for internet access, or it is undocumented, so unrestricted access to any site is possible.
- A web filtering capability is deployed, but the category/reputation database is not updated for a long time, so newly emerging malicious/phishing sites are not blocked.
- Filtering is applied on the corporate network but not on remote-work/mobile devices, allowing access to be bypassed.
- Block/bypass-attempt logs are only collected and never reviewed, so attempts to reach malicious sites go unnoticed.
- Blocks are lifted arbitrarily without an exception-approval procedure, or the exception list is not maintained.