URL Category Filtering

keithcclark71 · ‎05-04-2017

Does anyone have any reccomendation on which categories they filter on and by reputation level? The problem I am having as a consultant is defining which categories the business should have in place. I wish it was as simple as adding all categories high risk but that may cause some issues.

Joshua Edwards · ‎05-05-2017

Hey Keith,

We just set this up in our office and with a bit of trial and error we using the following categories with any reputation:

Adult and Pornography
Abused Drugs
Bot Nets
Cheating
Confirmed Spam Sources
Cult and Occult
Gambling
Games
Gross
Hate and Racism
Hacking
Illegal
Keyloggers and Monitoring
Malware Sites
Nudity
Phishing and Other Frauds
Proxy Avoid and Anonymizers
Questionable
SPAM URLs
Marijuana
Spyware and Adware
Parked Domains
Online Greeting Cards
Social Network
Personal Storage
Auctions
Dating
Dead Sites
Music
P2P
Streaming Media
Swimsuits and Intimate Apparel
Web Based Email

From here, we allow sites on an exception basis. We have a link to our internal ticketing system in our HTTP Response block page and request users provide a business need from that point. The main reasons for the categories are productivity and risk based while trying to strike a balance for "incidental" usage. This is still a work in progress, there are other categories we are still considering. If I was using categories, I would probably set most to block anything with a rating of 1, 2, or 3.

If the business has a defined Rules of Behavior or Acceptable Use Policy that would be a great launching point for you to start defining categories that match the business' needs and are enforceable through policy.

As a side note. be very careful with the Web Advertisements category, if it is set to any reputation, it can end up blocking pretty much every site you try to visit.

Hope that helps.

Marvin Rhoads · ‎05-05-2017

That's a great approach.

I would only add that the Personal storage category may not always be appropriate - it includes things like Dropbox, OneDrive and Box.com which may be approved for use in many enterprises.

If in doubt about a particular site, you can always check the category via the Brightcloud lookup tool:

http://www.brightcloud.com/tools/url-ip-lookup.php

That's what FirePOWER currently uses for URL categories.

keithcclark71 · ‎05-08-2017

This is great info guys. Very much appreciated!!! It is nice to be able to lean on those who have the knowledge. I just don't have enough yet to share and help others out like you guys have. It really has been a pleasure to read through replies such as Marvin's as without people like him to share it would be very hard on someone as myself to take on Firepower alone.

TobiasHilbert · ‎07-10-2018

Hi Marvin

Does FirePower still uses brightcloud?

I currently have a example where the category differs:

http://www.emp-leipzig.de/

Cisco SFR: Adult and Pornography

BrightCloud: Business and Economy

kind regards

Tobias