ISO 27001 A.8.23: Web filtering

Deploy a web filtering solution with URL categorisation and threat protection. Options include cloud-based secure web gateways (SWG), DNS-based filtering, on-premises web proxies, endpoint-based filtering, or browser security extensions. Whatever you choose, it must cover all users regardless of location - remote workers included.

Set up filtering policies that match your acceptable use policy. At minimum, block known malware and phishing sites, command-and-control domains, and newly registered domains (which are disproportionately used for attacks). Consider blocking or monitoring high-risk categories like file sharing sites, crypto mining sites, and anonymisation services.

Implement SSL/TLS inspection where legally and technically appropriate. Most malicious sites use HTTPS now, so without SSL inspection your filter is essentially blind to encrypted content. Work with legal to get the privacy considerations right and exempt sensitive categories (banking, healthcare) from inspection.

Make sure remote workers are covered. Cloud-based filtering that routes through a cloud proxy, DNS-based filtering that works on any network, or endpoint agents that function regardless of connection type all solve this problem.

Create a process for handling blocked-site requests. People will occasionally need access to something the filter catches. Give them a clear request mechanism, define an approval workflow that weighs risk against business need, and respond quickly. Slow responses drive workarounds.

Monitor and report on filtering activity. Track blocked requests by category and volume. Investigate patterns that suggest malware infections - repeated attempts to reach malicious sites are a red flag. Use the data to inform your security awareness training topics.