With an increased reliance on remote workers, secure web gateways are critical for protecting businesses against Internet-borne threats. These security tools require all network traffic to pass through and scan for malware, dubious URLs and other potential dangers. Some SWGs decrypt* encrypted traffic for inspection before it’s sent to users and the web server, enabling granular policy control and helping to prevent data breaches.
HTTPS Inspection
Secure web gateways monitor, inspect and block internet-borne threats before they penetrate your network. This prevents damage to your reputation, data, and bottom line and enables you to meet regulatory compliance standards like GDPR and PCI DSS. Typically delivered as software loaded onto hardware, virtual machines or containers and deployed on-premises or in the Cloud, a secure web gateway sits between users and the internet as a proxy that intercepts and processes all outbound and inbound web traffic. The platform applies essential security technologies, including URL filtering, application control, anti-malware, sandboxing, AV scanning, and DLP.
In addition to basic functionality, some secure web gateways feature a range of more sophisticated capabilities, such as web isolation, which encapsulates and executes malicious code within a virtual instance isolated from the end user. Some also provide current web intelligence, identifying new and unknown threats by analyzing associations and correlations across files, emails, and endpoints.
Inbound and outbound HTTPS inspection (SSL inspection) is another key capability many vendors offer. This involves a secure gateway acting as a man-in-the-middle between the client and the server, decrypting SSL-encrypted content for inspection and protection, then re-encrypting it before sending it back to the client. This prevents malicious actors from stealing sensitive information and helps you enforce acceptable use policies without impacting employee productivity.
Isolation
A secure web gateway acts as a security filter, blocking malware encountered in user-initiated Internet traffic and protecting the organization from data breaches. It also helps to ensure that network-related corporate and regulatory policy compliance standards are enforced. An SWG typically resides on a corporate network perimeter and can be a hardware or software-based solution. It monitors incoming and outgoing web-based Internet traffic on endpoint devices and internal and external applications. As cyberattacks become more sophisticated and attackers use the web as their primary attack vector, a SWG is needed to prevent malware attacks from penetrating the firewalls and making their way into the corporate network. This is why SWGs are deployed as part of a layered security approach.
Most SWGs offer a variety of integration options, including remote browser isolation. This feature allows users – and their IT teams – to be more productive by working from anywhere without sacrificing security. For example, potential phishing websites are routed to remote browser isolation and opened in read-only mode to prevent credential theft and malware injection.
Many SWGs also include a form of data loss prevention (DLP). This feature monitors data movement in and out of a network and protects confidential information, such as 16-digit credit card numbers, from leaving the organization. Depending on an organization’s policies, DLP can redact sensitive data or block it from being sent out altogether.
Malware Detection
A secure web gateway (SWG) is a hardware, software or virtual appliance that sits along the network perimeter or on endpoint devices. It requires all internet traffic to go through the gateway, which is scanned and monitored for malware threats, suspicious URLs, unauthorized file uploads, and more. Some gateways use proxy technology to monitor traffic at the application level. This allows them to identify and stop malware attacks that encrypted files may hide. It also enables them to ban or allow connections or keywords based on corporate usage policies. Gateways are often the only security solutions capable of detecting and stopping sophisticated cyberattacks that hide behind HTTPS. Unlike firewalls, they don’t require access to internal systems or databases to detect malicious code and zero-day vulnerabilities. Most gateways offer multiple layers of protection, with URL filtering and AV being the most common. Some also provide sandboxing, which emulates the environment of suspected malware to identify and stop it. Some vendors even offer web isolation, which operates browsers in a read-only mode to block the execution of malware and server-side scripts. Another critical function some SWGs offer is data loss prevention (DLP), which prevents confidential information from leaving the corporate environment. It identifies sensitive data in outgoing internet traffic and redacts or blocks it before the information is transmitted to external systems.
SSL/TLS Decryption
While SSL/TLS encryption safeguards a web user’s privacy by encrypting a connection, it also leaves the data vulnerable to security breaches. Using a ‘man in the middle attack technique, attackers can steal credentials and tamper with or spoof traffic. Secure web gateways monitor incoming and outgoing web traffic for potential tampering and ensure that only the intended recipients receive encrypted content.
Many cyberattacks use encrypted communications to cloak malware and command-and-control traffic, while others hide stolen data to avoid detection. To counter these threats, gateways employ SSL/TLS decryption to analyze and inspect the content of encrypted traffic before re-encrypting and transmitting it to its destination.
SWGs also provide enhanced visibility into web usage by monitoring and analyzing all incoming and outgoing traffic. This enables them to enforce corporate-acceptable policies on web usage and protect users from security threats that may compromise productivity.
As organizations adopt remote task forces and make wider use of cloud-based software as a service application, the need for effective web protection becomes even more vital. SWGs act as a firewall to protect enterprises from growing cyberattacks and malware threats. They monitor all incoming and outgoing traffic, identify vulnerabilities, suspicious or malicious websites, and block those not complying with corporate policies. In addition, they also prevent the loss of critical and confidential files by preventing unauthorized data from exiting the network.