In some cases, a separate hardware appliance may be desirable, for example, if high availability is required. In this case, the SonicWALL Content Security Manager (CSM 2200 and CSM 3200 Series) delivers a dedicated Web security appliance that includes content filtering, anti-virus, anti-spyware, and intrusion prevention, which can be deployed along with the firewall. High availability can be achieved by deploying a secondary CSM appliance for automatic failover, should the primary unit fail.

The SonicWALL Content Filtering Service, as well as the CSM appliance, is deployed in a wide variety of organizations, from small businesses to large enterprises, schools and universities, libraries, and government agencies, as well as in public Internet "hot spots". In addition to being an easily-managed solution for smaller organization, CFS's scalability and superior performance makes it a favorite among large enterprises with complex configuration requirements.

The Dangers of Unrestricted Access

When employees, students, or other users are allowed to access Web sites that are inappropriate or offensive, there are multiple risks that you are taking. First, there is a legal responsibility and obligation to keep the workplace free from offensive material, and not taking steps to do so could lead to costly lawsuits. Second, unrestricted access drains productivity by promoting wasteful Web surfing and FaceBook updating. Third, bandwidth usage patterns can be seriously affected when employees turn to bandwidth-hungry applications such as file-sharing, and this could affect the productivity of business-related applications. And fourth, unrestricted access can, and often does, lead to infection by viruses, spyware, and malware, since many of the sites that are contained in blocked categories are common sources of malicious attacks. Installing a content filtering solution can eliminate these and other problems.

Flexibility and Policy Enforcement

Administrators are free to create local policies that are specifically designed to meet their own requirements and legislative mandates. The dynamic rating architecture can be used to block up to 56 categories with CFS Premium, which affords a high level of transparent control and ease of administration, and the ability to enforce policies at a granular level. Even more flexibility can be added with the local URL filtering feature, which allows you to go beyond the categories to block or allow specific domains or hosts. Policies can be applied to individuals or entire groups, for example, with different policies for students and teachers in an educational environment; additionally, it can be set to block automatically downloadable files, or apply filtering by time of day.

Caching and Performance

SonicWALL CFS is built around a Web site caching and rating architecture that allows administrators to automatically block sites by category for easier administration. The caching feature stores URL ratings locally on the SonicWALL appliance, so response time is only a fraction of a second. In addition to filtering out offensive Web content, CFS also allows you to focus on performance enhancement by allowing you to filter out MP3 and streaming sites, and freeware and file downloading sites, which consume tremendous amounts of bandwidth, and are often the source of spyware and other malware.

Compliance and Regulations

Several pieces of legislation require content filtering on some level, and SonicWALL's CFS can be used to meet those legislative demands. At the educational level, the Children's Internet Protection Act (CIPA) requires all schools and libraries that receive eRate funding to install content filtering. The flexibility of CFS, and the ability to set custom policies for different groups or different times of day, makes it ideal for educational settings. In addition, the reporting necessary to comply with these mandates can be fulfilled by our Global Management System (GMS) and ViewPoint reporting package. Learn more.

In addition to legislation such as CIPA, CFS is an integral part of internal compliance programs designed to reduce the liabilities that may incur when inappropriate content is allowed into the network. When Web access is unrestricted, not only is the result counter-productive, it can also result in costly problems.

Visibility (Reporting)

SonicWALL's ViewPoint reporting software along with SonicWALL CFS can allow customers to run granular reports summarizing web access details. Both real-time and historical reports can be easily customized and delivered in a variety of formats. In addition to comprehensive graphical reports, users also can take advantage of "at-a-glance" reporting.

How it Works

SonicWALL's CFS is based on a rating architecture that relies on a dynamic database to block objectionable or inappropriate Web sites. SonicWALL CFS cross-references all Web sites as they are requested, against a vast and highly accurate database of URLs, IP addresses and domains. The SonicWALL appliance then receives a rating in real time, and then compares that rating to the local policy setting. The appliance will then either allow or deny the request, based on locally-configured policy.

SonicWALL CFS categorizes millions of URLs, IP addresses and domains in a continuously updated, dynamically rated database. CFS rates over four million URLs, with hundreds more added daily. Because the ratings are determined both by artificial intelligence and human observation, the database is highly accurate, and the instance of false positives is minimized. The policy-based system allows the administrator to block all pre-defined categories or any combination of categories, and to apply these policies on a granular level. For example, if one group of users requires access to sites typically found within one category, this level of access can be granted, while still denying access to other users.

Categories range from offensive types of content such as "Violence," which would include anti-social Web sites that advocate use of weapons or explosives, to sites that may not be offensive but would otherwise cause a potential risk to the network in terms of bandwidth usage, such as "Software downloads" or "Streaming Media/MP3".