Web filtering refresh

[EBrooke]

Hi all,

 

We are coming up for a refresh/replacement of our Smoothwall solution.

I wanted to put feelers out on what are people using these days and your thoughts/opinions, specifically re: agent-based solutions vs. proxy-based solutions vs. DNS-only solutions.

 

We are considering providers on the UKSIC accredited filtering system scheme.

 

Some things we are pondering which I would very much welcome input on: -

 

• Are proxy-based appliances an old-school approach?
• Do filtering agents have significant overhead on user devices?
• Can filtering agents be bypassed easily if a user has local administrator rights on the device?
• If using a DNS-only solution for Bring Your Own Device, is there any good mitigation to prevent filtering bypass? Restricting port 53 helps, but DNS over HTTPS (DoH) adoption is climbing.

 

Thanks,

Edan

[sigma]

Are proxy-based appliances an old-school approach?  "It depends" on your precise requirements.

 

Do filtering agents have significant overhead on user devices? 

Not in the grand scheme of things.  Overall device performance and network/internet speed are far more significant.

 

Can filtering agents be bypassed easily if a user has local administrator rights on the device?  "

It depends", but generally yes.  Why would anyone have or need Local Admin Rights?

 

If using a DNS-only solution for Bring Your Own Device, is there any good mitigation to prevent filtering bypass? Restricting port 53 helps, but DNS over HTTPS (DoH) adoption is climbing. 

A DNS only solution can never be KCSIE or Filtering and Monitoring Standards compliant. DNS over HTTPS should in any case be blocked in school.

 

Are you planning filtering "school devices" on site or everywhere?    

Its always worth asking for product trials and to ask suppliers for references to schools that have a close a setup and requirement to your own if they can, and to check they really can do what the marketing says they can.

 

[TechMonkey]

Have a good read of the DfE expectations and KCSIE.  I seem to recall it says in one or both of them that (roughly) any device on a school connection must be filtered to some level and not be able to bypass.  If you only have agent based, then a device not under your control can connect to your network and not be filtered.  Now, would a DfE SWAT team helicopter down the moment that device connected?  No. Would the wrong question asked by a switched-on inspector cause issues or deeper digging?  Possibly.

 

This may be mitigated by ISP hard filters or forwarders, but personally I would be very hesitant to rely on only cloud based fitlering and have nothing on your edge connection.

 

Also, as sigma points out, DNS filtering is not compliant.

[tom_newton]

The posters here have given some good pointers.

Agent based systems are only suitable for fully managed devices. Anyone telling you otherwise is leading you down the garden path. Smoothwall has agent based and proxy options.

If you hear people saying proxies are dead technology, they're also poorly informed: outside of in-browser extensions and DNS filters, the vast majority of filtering (including windows, IOS, android agents) depends on a proxy somewhere. A proxy box at the edge of your network might be slightly less common than it was 5 years ago, but the technology just moved

 

Happy to talk you through everything I know: reach out to your Smoothwall CSM and ask them to set up a call with me or one of the Technical Account Maangers.

[BKGarry]

This question - Are you planning filtering "school devices" on site or everywhere?    

 

I do believe that is is explicitly stated that school owned devices should be filtered the same offsite and onsite in the DfE Digital Standards.