DNS filtering and secure web gateway

What it is

Blocking of malicious and unwanted domains at the DNS layer, and inspection of web traffic for threats and data uploads, on and off the company network.

How to value it

Phishing links, drive-by downloads and malware command servers all depend on domains. Blocking them is cheap, quick to roll out and stops many attacks at the first step, including on laptops outside the office.

Questions to ask a vendor

1. 1How quickly are new malicious domains added to the block lists?
2. 2Does it protect devices when they are off the company network?
3. 3What logs do we get for investigations, and where is that data stored?
4. 4Can users report a wrongly blocked site easily?

Risk

Users reach phishing and malware sites, and infected devices contact attackers.

Control

DNS filtering on all devices, on and off the network.

Owner

IT operations lead.

Measure

Share of devices covered.

A starting point: set the owner and measure to fit your organisation.