Security considerations for Dynamic Categorization

Products

• ProxySG Software - SGOS
• ISG Proxy

Issue/Introduction

The Dynamic Real Time Rating (DRTR) service allows the dynamic classification of uncategorized web content. DRTR integrates with the Symantec Edge SWG policy engine to provide real-time protection and policy enforcement against websites which are not yet known.

 

In order to provide this protection, DRTR leverages the WebPulse Cloud Service to dynamically fetch ratings for unclassified content. More details can be found at the following link:

 

How does Blue Coat WebPulse(DRTR) work with Blue Coat Intelligent services (BCIS)?

 

DRTR is extremely useful to allow the URL categorization to be performed in real time, potentially categorizing Internet sites which have not yet been categorized to allow acceptable use policies to be enforced. However, there’s a risk that some information from web requests initiated within the customer network may be requested by WebPulse during categorization, allowing an external server to see what URLs are being requested as well as additional information from these web requests even if they are eventually blocked by policy.

Resolution

If the policy is set to block uncategorized requests, customers may want to disable DRTR, ensuring that requests to uncategorized URLs will never be sent to external servers, avoiding any request information from being exposed.

 

Note: WebPulse only fetches URLs that are not yet categorized and will only send a subset of the original request information. The specific information forwarded can be controlled through configuration or policy, allowing administrators to trade-off the ability to access new or uncategorized sites and of request information which may be forwarded to perform this categorization.