## 8.23 Web filtering

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities     | Security domains |
| ------------ | ----------------------------------------- | ---------------------- | ---------------------------- | ---------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Protect               | #System_and_network_security | #Protection      |

**Control**
Access to external websites should be managed to reduce exposure to malicious content.

**Purpose**
To protect systems from being compromised by malware and to prevent access to unauthorized web resources.

**Guidance**
The organization should reduce the risks of its personnel accessing websites that contain illegal information or are known to contain viruses or phishing material. A technique for achieving this works by blocking the IP address or domain of the website(s) concerned. Some browsers and anti-malware technologies do this automatically or can be configured to do so.

The organization should identify the types of websites to which personnel should or should not have access. The organization should consider blocking access to the following types of websites:

a\) websites that have an information upload function unless permitted for valid business reasons;

b\) known or suspected malicious websites (e.g. those distributing malware or phishing contents);

c\) command and control servers;

d\) malicious website acquired from threat intelligence (see [5.7](a-5.7-Threat-intelligence.md));

e\) websites sharing illegal content.

Prior to deploying this control, the organization should establish rules for safe and appropriate use of online resources, including any restriction to undesirable or inappropriate websites and web-based applications. The rules should be kept up-to-date.

Training should be given to personnel on the secure and appropriate use of online resources including access to the web. The training should include the organization’s rules, contact point for raising security concerns, and exception process when restricted web resources need to be accessed for legitimate business reasons. Training should also be given to personnel to ensure that they do not overrule any browser advisory that reports that a website is not secure but allows the user to proceed.

**Other information**
Web filtering can include a range of techniques including signatures, heuristics, list of acceptable websites or domains, list of prohibited websites or domains and bespoke configuration to help prevent malicious software and other malicious activity from attacking the organization’s network and systems.