A Radically Simpler Approach to Web Content Filtering & Security

Transcription

1 WHITEPAPER A Radically Simpler Approach to Web Content Filtering & Security As the Internet has grown it s become increasingly complex and dangerous for users to navigate. Each day there are new threats to contend with: Web sites that infect users machines with malware, propagating botnets, phishing scams, and more. On top of that there s a growing array of inappropriate and recreational uses of the Internet such as adult Web sites, social networking applications like MySpace and Facebook, and bandwidth-intensive video sites like YouTube. So, it s no surprise that Web content filtering and security have become essential functions for most enterprises. Tools that provide these functions help ensure safe Internet use, compliance with Internet-use policies, and a reduction in unproductive Web use and traffic. The challenge for IT organizations is that traditional solutions have been high cost and high overhead. They typically require customers to buy hardware appliances that are placed inline in the network path, slowing down the overall network and taxing firewall and other system resources. Another issue is that they can miss a lot of the new non-web traffic, such as P2P. Fortunately, there are three developments that have made a new, radically simpler approach to Web content filtering and security possible: The emergence of cloud-based services (SaaS Software as a Service), which require no hardware or software to be installed or maintained. The growth of cloud-accessible domain intelligence information about the quality, integrity and nature of Web sites. And the final piece of the puzzle was to realize that recursive DNS service, typically provided by an ISP, could be used as an effective filtering and security mechanism easily evaluating domains and IPs when the DNS query is requested.

2 Introducing DNS-based Web Content Filtering & Security DNS service has always been a fundamental part of the Internet. A client provides a domain name and receives the IP address of the server to connect to. This basic function has changed little over the years and has largely been taken for granted. IT managers have primarily demanded that recursive DNS services offered by ISPs work fast and reliably. OpenDNS has pioneered a new model adding a layer of intelligence on top of DNS that provides highly effective Web content filtering and security capabilities, in addition to faster and more reliable DNS service. Using this DNS approach, domains are evaluated at the point of ACCESSING a Web site vs. during the ENTIRE COMMUNICATIONS with a Web site. This means it is not in the direct path of the traffic once a DNS lookup happens, the answer is either yes or no and the endpoint is free to communicate directly with the server without any further latency or delay. The way DNS-based Web content filtering and security works is illustrated in the diagram below. When a DNS request is made, the domain is first evaluated to ensure that it is safe and appropriate. It does this by checking malware, botnet, and phishing databases and also checking policies, blacklists, and whitelists that have been configured for the network. OpenDNS Datacenters Lightweight, Reliable DNS Anti-Phishing Content Filtering Botnet and Malware Site Protection Management Console and Reporting Custom Block Page Blocked Content Users The Internet Internet traffic flows directly No proxy or in-line appliance By putting security directly into one of the core protocols that powers your network and the Internet, security becomes an integrated, pervasive part of your network instead of an appliance-based add-on that will slow down your network. It also enables you to simplify your network architecture by not forcing all Internet-bound traffic through a single place in the network. A RADICALLY SIMPLER APPROACH TO WEB CONTENT FILTERING & SECURITY PAGE 2 OF 7

3 Dramatically Simpler Than Using an Appliance Overall, DNS-based Web content filtering and security is compelling because it is dramatically simpler and less expensive than traditional approaches. Rather than installing an expensive appliance at each location that involves capital expenditure, hardware, shipping, training, software, and maintenance, you can simply turn on a cloud-based service that is already running. Just set up an online account and reconfigure DNS settings. Rather than trying to manage multiple appliances in multiple locations, which is time-consuming and difficult, you can use a single web interface to manage policies and monitor activity for any number of locations. It sounds far simpler and it is. The following table presents a side-by-side comparison with a traditional appliance-based approach. Appliance-Based DNS-Based Technology IP packet checking DNS request checking Cost Very expensive capital expenditure Low per-seat cost Management & Maintenance Performance Setup Need to manage an appliance at each location, update software, etc. Requires specialized training and expertise. High-bandwidth rated appliance required to prevent traffic latency and bottlenecking. Driving traffic through an appliance at a central location can add as much as 2 seconds of latency. Install and configure dedicated appliance and software at each site. Centralized administration through an easy web interface. No equipment or software to purchase, implement, or maintain. Extremely light-weight and fast often speeds up Internet performance by 20% Very simple: set up an online account, configure policies, and reconfigure DNS settings. Location Requires physical install at each site. Cloud-based. Leverages existing equipment at each site. Reliability Scalability Single point of failure driving all traffic through a central appliance, which can fail. Need to scale hardware appliances as bandwidth grows. May need to cluster, which adds more overhead and complexity. No single point of failure. Utilizes a worldwide network of DNS servers. No downtime. Scaling of DNS requests handled by cloud. Level of Control Per user configuration and logging Policies applied to traffic from outward facing IPs. Different group level policies can be set for traffic separated onto different IPs. Domain Intelligence Maintain a proprietary database Utilize Internet community to help keep open databases such as PhishTank up-to-date alongside data sets provided by security partners. A RADICALLY SIMPLER APPROACH TO WEB CONTENT FILTERING & SECURITY PAGE 3 OF 7

4 Issues with Other Cloud-Based Services Besides appliances, there are a number of companies claiming to have cloud based products that provide Web content filtering. The main problem with these approaches is that they proxy all traffic from your company, through their network (and computers) to the Internet and back. Most companies go to great lengths in paying for the best connectivity to the Internet which is completely defeated by this approach, since your connection to the Internet is completely limited by the speed and ability of the cloud provider to actually process the content. Since 100% of your content is going through the proxy, you have to be confident that your traffic, along with the traffic of every other customer, is being handled as well or better than your current Internet connection. This is highly unlikely. Another issue is that this dramatically increases latency and decreases throughput for all Internet traffic. Proxy-based solutions can work for smaller deployments where the amount of traffic is not large and the requirements for overall product speed are not significant. However, as a customer s network speed and sophistication increases, having a provider that will actually get in the middle of your network traffic and not have the same speed and bandwidth can be an issue. Ideal Applications in the Enterprise A number of ideal applications of DNS-based web content filtering and security include: organizations with many locations, such as retail operations, remote, branch or sales offices, organizations that have adopted site-wide policies that apply to all users and organizations or have the ability to segment different groups onto different outward facing IPs, and those offering public Wi-Fi. We have minimal filtering needs and enabled OpenDNS at our California headquarters to filter several categories of content, including Phishing and various work-inappropriate categories. OpenDNS is an excellent solution for our use case and we re in the process of phasing out pre-existing solutions and deploying company-wide. Ray Dzak, Specialized Bicycles, North America headquarters Locations with Site-Wide Policies One ideal application of DNS-based Web content filtering and security is when an organization has decided to have site-wide Internet use policies that are the same for everyone, and doesn t want or need to set up per-user control and logging offered by traditional appliances. Many organizations believe per-user control is an important capability, but then don t actually use it due to the overhead involved. OpenDNS Enterprise customers have the added flexibility of Block Page Bypass, a feature which allows network administrators to grant content filtering policy exceptions for teams and individuals in an organization easily. A RADICALLY SIMPLER APPROACH TO WEB CONTENT FILTERING & SECURITY PAGE 4 OF 7

5 Retail Operations Providing Web content filtering across organizations with widespread locations, such as retail operations, has historically been a challenge. It s simply cost prohibitive and overly time consuming to deploy and manage appliances at each site, particularly when there is no local IT staff. One solution is for an organization to have all of their traffic routed back through their VPN, but this entails a significant performance penalty and costs. Because of these challenges, many retail locations currently go unprotected. DNS-based web content filtering and security can be a perfect solution for retail. It s easy, fast, inexpensive, and hundreds of sites can be managed from a single console. And policies can be configured so that they are consistent with other Web content filtering tools already in use. For example, many organizations ensure that DNS requests are forced to OpenDNS with the use of firewall policies and that users are unable to modify their local Hosts file to prevent bypassing the DNS for lookups. Content filtering for retail locations can help ensure that unsupervised employees are not distracted by recreational applications at the expense of helping customers or doing productive work. We looked at installing hardware appliances in each of our retail locations, but the forecasted cost turned out to be way more than we were willing to spend. We chose OpenDNS because it s not only free but allows us to control the filtering for all of our retail locations from a single interface. Dale Hobbs, LUSH Cosmetics, 149 store locations in North America Remote Offices and Sales Offices Remote offices with mobile workers have also been under-served by web filtering due to the difficulty of using traditional tools, but it is a critical area since many organizations get infected by malware through remote/mobile workers who access the Internet without passing through corporate filtering tools. A DNS-based approach allows remote and mobile workers to access the Internet directly, but still be under centralized policy control. To set up a remote office, a network administrator simply logs in remotely to reconfigure DNS settings on the local router or individual laptops and then manages policies for many remote locations from a single web interface. OpenDNS represents the easiest way to do content filtering at our remote office locations across the United States. Deploying at all sites took us under an hour and we can manage all sites through one Web-based account. Purchasing an appliance for each site would have absolutely been cost-prohibitive. Michael Dragone, Titleserv, remote and branch offices across the US A RADICALLY SIMPLER APPROACH TO WEB CONTENT FILTERING & SECURITY PAGE 5 OF 7

6 Public Wi-Fi For organizations that provide public Wi-Fi, with many hot spots and an unlimited number of guest users, a DNS-based approach fits very well. Its easy to put in place policies that ensure appropriate use of the free service and apply to all guest users, and it s easy to protect them from dangerous web sites and security threats without incurring high overhead. City of Nashville, Tennessee And as a government entity, we continually strive to reduce costs while increasing our security efforts. OpenDNS meets all of our security needs for our free, public Wi-Fi perfectly and saves the City of Nashville a significant amount of money. Allan Que, City of Nashville, TN, operates free, public Wi-Fi citywide OpenDNS for the Enterprise All of these applications are ideal uses for OpenDNS Enterprise, which was developed after three years of experience running a global network of DNS servers, now handling 20+ billion DNS queries per day, and working with some of the World s most trusted brands to understand their filtering and security needs. OpenDNS Enterprise brings an unmatched level of intelligence on top of DNS that provides powerful award-winning web content filtering and security as well as new reporting and navigational features. OpenDNS Enterprise is designed to ensure safe, appropriate, reliable, and productive use of the Internet. It allows network administrators to instantly gain visibility, control, and protection for accessing and using the Internet. They can easily secure their users and networks from online threats, enforce Internet-use policies, increase performance, and reduce costs. OpenDNS Enterprise was launched in October 2009 to meet the sophisticated requirements of a complex enterprise environment. Some of the key features added to the Enterprise version are: Advanced customization Delegated administration Audit Log Malware site protection White list only mode Whitelist/blacklist up to 500 domains Block page bypass Service level agreement (SLAs) And much more.. Advanced reporting and logging features To learn more about OpenDNS Enterprise, please consult the data sheet on our website at A RADICALLY SIMPLER APPROACH TO WEB CONTENT FILTERING & SECURITY PAGE 6 OF 7

7 OpenDNS A Platform for a Growing Array of Services We ve focused on the enterprise-level web content filtering and security that is offered on the OpenDNS platform, but DNS is also a natural place for providing many types of new navigational services beyond those critical functions. There are four main areas of functionality that have emerged on top of DNS so far: security, control, reporting, and assistance, and certainly more to be developed in the future. Security ensuring that users are not accessing dangerous sites that can download malware, propagate botnets, or be used for phishing. Since virtually all botnets use DNS to resolve their connections to command and control sites (such as the recent Conficker virus) a DNS-based approach can easily detect and stop the 1000 s of sites that such worms can connect to through the network. Control (web content filtering) ensuring that users are accessing appropriate web sites and content. Block or limit access to adult sites, social networking sites, and high-bandwidth sites such as video sharing. Reporting gives network administrators a new level of visibility by providing detailed information and statistics about what domains their users are accessing. Assistance provides assistance when users make mistakes entering a domain name or try to reach a blocked site. Moving to a cloud-based DNS approach will yield immediate benefits and cost savings and also offer a growing array of other valuable navigational services going forward. OpenDNS 410 Townsend St, Suite 250 San Francisco, CA A RADICALLY SIMPLER APPROACH TO WEB CONTENT FILTERING & SECURITY PAGE 7 OF 7