A Modern Approach to Protecting Against Web Threats

Today’s cyberattacks continue to grow in sophistication and scale as organizations face an uphill battle protecting a growing mobile workforce that uses multiple devices, accesses sensitive data remotely, and utilizes third-party cloud services. Not surprising, cyberattacks have been considered the fastest growing crime in the US. According to Cybersecurity Ventures, global cybercrime damages are expected to reach $6 Trillion USD this year, continue to grow by 15 percent per year, and reach $10.5 Trillion USD annually by 2025. Data breaches are not only costly but they significantly impact the bottom line of any organization, particularly around reputation and IP loss, which can be unrecoverable. In the wake of the Colonial Pipeline hack, even the White House issued a historic cybersecurity directive requiring agencies to adopt better security practices.

Many security practitioners are tasked with the daunting challenge of keeping their organization’s users, devices and applications secure as cyberattacks continue to become more pervasive and intelligent. IT teams are often hampered by traditional solutions that no longer address the security needs of today’s evolving perimeter-less and dispersed network because they lack the ability to protect users, applications, and devices in an agile manner. For example, with organizations adopting cloud-based solutions – such as Google Workspace, Salesforce, Office365, Box, etc. – and accessing these solutions over the public internet, attackers now have more initial points of compromise to begin their attacks.

A Blast from the Past
Traditionally offered as an on-premises solution, Secure Web Gateways (SWG) have been around for a while and are a staple in most security stacks. With the convergence of networking and security capabilities, SWGs logically became a key component in ensuring both secure and optimized internet browsing. Today, organizations looking to implement Secure Access Service Edge (SASE) need to consider SWG as an important piece to the puzzle for protecting users from web-based threats, all while ensuring that security policies are consistently applied and adherent to state and federal regulations.

The key weaknesses of on-premises SWGs are that they are not optimized for a modern workforce and require time and specialized resources to deploy, configure and manage. Traditional SWGs often share the common trait of being anchored to physical sites and security policy not being dynamically applied to access the risk of an access attempt. Also, because they are not able to extend protection to mobile devices and third-party cloud applications, traditional on-premises SWG provide very little visibility, control, or actionable analytics in a “work-from-anywhere” world.

Now Updated for Cloud
To address evolving IT landscapes and security needs, the next generation of Secure Web Gateways is cloud-native, cloud-delivered, and cloud optimized so that organizations can offer secure connectivity for all users over the internet regardless of location. Cloud SWGs are not tied to legacy appliances and offer an innovative set of security and networking capabilities in a flexible, elastic approach. As users connect to the public internet, a cloud SWG can help organizations by:

1. Blocking access to inappropriate websites to protect users against malicious threats on the web such as malware and phishing sites

2. Ensuring compliance with corporate, state, federal, or industry regulations

3. Identifying and containing potential and suspicious threats for analysis and reporting

4. Prioritizing security incidents to speed up time-to-resolution

Ensuring Data Security
The foundation of protecting web traffic is ensuring data integrity and privacy. Therefore, most of the traffic on the internet needs to be encrypted, and all cloud services need to leverage SSL or TLS encryption to protect user data from malicious actors. However, SWGs needs to be able to decrypt, inspection, and then re-encrypt all traffic to perform security checks that ensure the traffic is compliant with corporate policy.

Traffic to and from the internet introduces risks and modern SWGs should decrypt a data packet only once when performing security checks to minimize points of compromise. Every time a data packet is opened and inspected, there is a corresponding increase in both security risks and network latency. Modern SWGs need to be able to provide a comprehensive set of capabilities for security visibility and control to both on-premises and cloud resources in a single pass. This single pass decryption preserves data integrity, bolsters security hygiene, and optimizes connectivity.

How a Modern SWG Works
A SWG is a cloud service that is able to protect access from any device. When a user accesses the internet from their device, instead of connecting directly to a website, the user traffic is routed through the cloud-based SWG. Before allowing the requested access to traverse to the intended destination, the SWG performs a range of security checks to protect the organization from potential web threats, all while ensuring the access attempt is compliant with policy. As an example, these security checks should include URL and deep packet inspection, SSL/TLS decryption, malware prevention, content filtering, user authentication, application control, and more – all done in one pass. While the SWG is simultaneously performing these critical security checks, all application and traffic activity should be optimized so there is no latency or disruption to the end user experience.

A modern SWG is an important security function that organizations need to consider implementing as they begin their SASE journey. Key benefits can be realized, including preventing data leakage to the web, defending against attacks, controlling and authorizing user access, protecting mobile devices and gathering granular real-time web traffic analytics. Tightly integrated SASE solutions enable organizations to deploy SWG and other SASE functions selectively to start, and easily add on additional functions as they scale. Together, these cloud services provide enterprises with a secure architecture with context- aware, intent-based technologies, enforcing security no matter where devices, users and applications are located.

Featured

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

  • ISC West Announces Keynote Lineup

    ISC West, in collaboration with premier sponsor the Security Industry Association (SIA), announced this year’s dynamic trio of speakers that will headline the Keynote Series at ISC West 2024. Read Now

    • Industry Events

Featured Cybersecurity

Whitepapers

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3