Web filtering

The legal and logistical implications of employees surfing the Web in company time for unrelated work issues have finally hit...

The idea of filtering software initially started off as a niche product, but within just a few years it has become essential - particularly as firms introduce Web usage policies. Web filtering is now happening at two levels - the Web and e-mail - and those large enterprises that have not yet come across the numerous names of vendors offering products are in the minority. "Filtering is now a standard requirement to protect the corporate network from security breaches and bandwidth-consuming activity from non-business Web and e-mail use," says Martino Corbelli, marketing manager of SurfControl. "Corporates are waking up to the importance of controlling security issues relating to Internet use, as the reality is that by far the biggest threat to a company's security comes from the internal use of the network." There has been rapid development of the technology from its original role as database-linked URL filtering and the focus has widened to take in e-mail activities. "The filtering market has advanced and grown from simple URL filtering to mail filtering and is now moving to areas such as intellectual property management and control - that is, tracking and managing the movement of any type of sensitive corporate data across a network, or by external e-mail. "In other words, it's now becoming a real security management tool," says Andy Wooles, UK managing director of filtering software vendor FutureSoft. "There are two main reasons why companies are increasingly turning to Web filtering. There is a legal issue and then there is the financial issue," says Mark O'Hara, managing director of Hydra. "The original reason companies turned to Web filtering was to stop employees downloading illegal material, mainly pornography. "The legal implications of having an employee filling work computers with child or even regular pornography are huge and companies need to take action - or at least be seen to be taking action to prevent it," he adds. Right now there are other drivers forcing firms to stop staff surfing the Web - the World Cup and Big Brother. "The onset of Big Brother and the World Cup brings new challenges to many organisations. It's not good enough just to put in firewalls to stop intruders hacking and anti-virus to stop virus threats. "The game has changed and potentially the bigger threats are from within. Users are now logging on to the next episode, the next interesting items, the hottest news or even streaming video Web casts," says Raj Panesar, Northern European marketing manager at Clearswift. Some would pose the question: so what if a few people do spend their time watching a bit of Big Brother or checking the latest football results? But these activities can have serious repercussions for a business. "Many employees are spending an unreasonable amount of time viewing content on the Internet which is unrelated to their work. It has many implications. Bandwidth/network usage by employees accessing unrelated work items reduces the speed at which vital business information is accessed," says Panesar. "Also, system downtime increases due to large amounts of files being downloaded and systems failing due to lack of resources. There is also loss of productivity through either system downtime or employee non-productive activity," he adds. With the majority of viruses now coming into organisations via e-mail, it is essential to make sure staff don't spend their days sending and receiving inappropriate material. But it is not just security threats that need to be countered. In an era of tribunals and sackings for sending and receiving indecent material, there are other legal considerations for firms. "Corporates have a requirement to provide a safe working environment for their staff where they are not exposed to abusive or explicit content. Employing filtering software helps protect the company network from abuse or misuse, ensuring it runs efficiently," says SurfControl's Corbelli. E-mail is increasingly seen as an issue that both employer and employee need to be sensible about. Filtering software can help prevent problems entering a company, but it doesn't help when staff flout company policy and turn e-mail into a vehicle that can cause embarrassment or worse. "Employees do have some responsibility, especially with external mail. It carries the company name and staff should be educated to be careful what they send because you never know what information is going out by e-mail," says Julian Bogajski, UK commercial director at Sybari. From an employer's point of view, even the most basic of filtering programs will be required to deal with some common themes. "A company will be obliged to look for inappropriate content, inadvertent transmission and spam. It can cost £1 per spam," he adds. For resellers, the fact the market is expanding rapidly is a double-edged sword. Sales are there to be made but entering into the market comes with its own headaches. Which brand do you stock? Which supplier - broadline or specialist - should you choose to deal with? "There is an enormous amount of competition in the URL filtering market. Many of the solutions are based on inferior quality databases. The basic technology is the same for each manufacturer with the only difference being size and quality of the database and functionality enhancements," says Kay Eggleston, business development manager at Allasso. "The leading products are undoubtedly from WebSense and SurfControl, but there are many more eager contenders such as Smartfilter, MyCio, NetNanny and N2H2 which are gaining some market share," she adds. Others talk about the possible service revenue for resellers that can be gained from selling products to corporate customers because of the updates required. "This is where it gets interesting for resellers. Of course companies are concerned about inappropriate use of the Internet, but the risks of a sensitive document being sent by e-mail, or even accessed by someone not authorised to do so, are far too great to remain unmanaged. New, integrated software suites can do all these tasks, making for an easier sale and deployment," says Wooles. "Resellers can help customers to identify the risks, such as illegal copies of software, offensive adult content, viruses, Trojan horses and other hacker tools sharing the same hard drive as vital informational assets. "These tools can then be used to police and protect corporate assets such as key data and sensitive information," he adds. The security market is buzzing, even as other parts of the industry shrink back in the face of poor economic conditions, and unsurprisingly there is a migration towards it by vendors searching for revenues. That expansion is causing problems for resellers trying to seek out the market leaders, and the confusion has led some into the arms of specialist distributors. "Web filtering is only one element of an overall security package and if you are looking at that [a specialist can tell you] what other opportunities are there," says Phil Goff, technical manager at Allasso. He rejects the theory that the market for security products is becoming commoditised enough for anyone to sell the products, warning resellers that even if a broadliner does sell the right product, it will be short on advice about what other products could be sold in conjunction with Web filtering. For resellers with the right knowledge, there might even be the chance to help a firm draw up a Web usage policy and start a close relationship leading to more business in other areas. "The thing to look out for with Web filtering software is that it should be very flexible. You may set different rules about what you can access for different departments," says Paul Oxley, group product manager at Wick Hill. "Flexibility is a key feature. The requirements of one company may be very different from another." The opportunity in the Web filtering world is a large one. Greater legal restrictions and the financial benefits of freeing up bandwidth produce strong reasons for firms to adopt filtering software. If nothing else, the mass log-ons to Web sites during World Cup games will create network bandwidth problems for all types and sizes of firms and will act as a trigger to start IT directors thinking about the subject. "After the troubles of the last year or so it seems the World Cup has provided a boost to the IT industry," says Hydra's O'Hara. Some users still argue that filtering software is some form of censorship and it is a staff prevention technology rather than a money-saving one. The facts, however, paint a very different picture. It is estimated that in the UK alone companies are losing £9.6bn a year due to employees surfing the Internet on company time. Recent findings revealed that 44 per cent of Britons with Internet access at work spend three hours a week on average browsing the Web for personal interest. "It is also estimated that a company with ten employees earning an average of £19,500 will lose more than £12,000 a year through Internet abuse, based on employees spending 30 minutes a day on non-work-related surfing," says Bob Jones, managing director of Equiinet. "They are finding out that the Big Brother show is costing UK industry well over £1m every week through lost productivity of staff logging on to the site. Issues like this, bandwidth costs and potential litigation from employees distributing controversial content has spurred on the market for Web filtering products from a niche to a volume market," says Barry Mattacott, marketing manager of e92plus. There are different approaches to take to Web filtering and for resellers these varying routes offer the chance to get a sale from more than one type of product. "These solutions include URL filtering where vendors have categorised Web sites, and based on these categories rules can automatically block inappropriate Web sites such as gambling, sports, live Web show/casts, pornography and so on," says Raj Panesar, Northern Europe marketing manager for Clearswift. "There are other solutions above and beyond url filtering, which work by scanning content in real-time. These provide opportunities for resellers to help customers establish rules/policy to block inappropriate content being downloaded. The rules can be established to filter types of documents, embedded Java/Active X scripts - which may contain virus or other malicious code," he adds. "The Web filtering opportunity is as big as the firewall and anti-virus markets. If resellers are implementing any IT security, Web content is vital. This provides incremental revenue without having to go through a huge sales cycle. Resellers must help customers take a holistic approach to IT security, otherwise they are leaving security holes, which customers will not appreciate," he concludes. The legal and logistical implications of employees surfing the Web in company time for unrelated work issues have finally hit home and Web filtering is offering big opportunities for resellers to help companies combat the problem.

Staff versus security

Which product?

A specialist market

Why bother to filter?

Different options

Read more on IT risk management