Web filtering

What the control asks

The organization is to manage which external websites can be reached, so that exposure to malicious content falls. Purpose: keep malware from compromising systems and stop people reaching web resources they are not authorized to use. Guidance: reduce the risk of personnel visiting sites with illegal content or known to host viruses or phishing, for example by blocking the IP addresses or domains concerned, which some browsers and anti-malware tools do automatically or can be set to do. Identify which kinds of website personnel should and should not reach, and consider blocking sites with upload functions unless there is a valid business reason, known or suspected malicious sites distributing malware or phishing, command and control servers, malicious sites identified through threat intelligence (5.7), and sites sharing illegal content. Before deploying filtering, set rules on using online resources safely and properly, including restrictions on undesirable or inappropriate sites and web applications, and keep them current. Train personnel to use online resources safely and properly, covering the rules, the contact point for security concerns and the exception process for reaching restricted resources for legitimate business reasons, and on not overriding browser warnings that a site is insecure. Other information: web filtering can use signatures, heuristics, lists of sites or domains that are allowed or prohibited, and bespoke configuration, to keep malicious software and activity off the network and systems.

Purpose in the standard’s terms, in our words: Keeps malware off systems and blocks unauthorized web resources.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; System and network security; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Current rules on safe, proper use of online resources
• Web filtering or secure web gateway configuration showing blocked categories such as malicious, phishing, command and control, illegal content and upload sites
• Integration of threat intelligence feeds into block lists
• The exception request and approval process with records of approved exceptions
• Training records covering web use rules, reporting contacts, exceptions and not overriding browser security warnings
• Coverage evidence that filtering applies to remote and roaming devices as well as on-site traffic

Where audits commonly find gaps

• Filtering applies only on the office network, not to remote workers
• Upload and file-sharing sites are open to all users without a business reason
• Users routinely click through browser security warnings
• Block lists are static and not updated from threat intelligence

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It is one of the eleven controls added in the 2022 edition, so a register carried over from the previous edition may have no row for it.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 8.18 Use of privileged utility programs
• 8.20 Networks security
• 8.21 Security of network services

Read the five attributes All 93 controls