Content filters are devices that restrict or allow traffic based on the information contained in the packets traversing the network. This is generated primarily for security reasons. You might want to control documents that go out of the company and restrict sensitive materials from being leaked to unauthorized destinations. This corporate control ensures the desired confidentiality and privacy level within an organization.
Another reason to use content filtering is preventing users from viewing inappropriate content and this might happen in both enterprise environments (content that is not safe for the organization) and home environments (parental control). From a high-level security standpoint, content filters offer protection in many forms, including anti-virus and anti-malware.
Content filtering can be enabled at multiple points in the network, for example:
- E-mail filtering
- URL filtering
It is very common for large organizations to control the filtering of their e-mails to check for viruses whenever there is any inbound attachment in an e-mail message. E-mail attachments can be very dangerous because they might contain malicious code. Sometimes control filters may be configured to block unsolicited e-mail advertisements (spam) that might contain dangerous files or links. E-mail content filtering might also control phishing attempts coming in via e-mail because this is a very easy way of accessing many people in the organization. Hackers might insert links in e-mails that, when clicked, redirect the users to websites that can contain malicious code.
Another common way of enabling content filtering is by URL, which limits the website addresses a user can access with his browser. Many organizations use this type of filtering to control what people see on their Web browsers. URL content filtering uses Allow and Block lists, which provide granular control on allowed websites. A very common way of enabling URL filtering is by website category. The content filtering engine sorts the URLs in a few common categories, such as the following:
- Business
- Travel
- Recreation
- Shopping
- Hacking
- Malware
A URL control filtering rule might allow users to visit business and travel websites but they might restrict them from accessing sites that are categorized as hacking or malware. Even though URL filtering is an effective way of controlling enterprise traffic, this should not be the only security mechanism configured, as there are ways of accessing external resources without using URLs, like encryption. Some URL filters can decrypt traffic and inspect the content of the packets, but other URL filters do not have this capability. Hackers might take advantage of this and send encrypted information inside the organization, information that cannot always be scanned by the content filters.
Sometimes, Web browsers and search engines might have content filtering mechanisms embedded that alert users when they are trying to access a possible malicious site. These mechanisms do not need a dedicated content filtering device and are managed by the third-party browser/search engine providers.