Heads-up: Malware & Phishing category not supported in Smoothwall Cloud Filter

[Smokebomb]

Just a quick heads-up for anyone using Smoothwall Cloud Filter.

While working with Smoothwall support on a recent ticket, we discovered that the "Malware and Phishing" category is not currently supported by the Cloud Filter. This means that even if you add it to your blocklists, sites won’t be classified under this category in the browser extension — and as a result, they will still be allowed.

According to Smoothwall, this is due to the size of the category causing performance issues within the browser extension so they have excluded it.
It’s worth noting that this category does still work as expected on on-premise appliances, so traffic filtered there will be blocked correctly.

In the meantime, you may want to:

• Add any known malicious URLs to a custom block category.
• Ensure you have other anti-malware/web protection controls in place to cover the gap.

 

Hope that helps others avoid the same confusion.

[synaesthesia]

Slightly worrying, especially as certain conditions push us towards the cloud filter even with some on site devices and particularly if using GCPW for google schools.

[Joeloman]

I don't think the answer you got from support is entirely correct..

The size itself is probably not a big problem, but it is the large daily changes in this category that mean that it can take a while to start up.

 

Since most browsers today have this protection built in from the start, Smoothwall probably considered it unnecessary to have double protection in Cloud Filter.

Today, browsers often use AI as well as real-time scanning to find this type of threat.
https://support.google.com/chrome/answer/9890866#zippy=%2Cenhanced-protection

 

The reason why they have chosen to keep that category on premise for the time being is probably because they want continued support for the Internet of Things (IoT) and older devices with old browsers.
The category already exists and is updated automatically from various sources and there is no problem with the update in equipment that is on 24/7.

[mrstrong]

interesting.

 

is anyone using "Enhanced protection" for the Safe Browsing setting ?