IWF Filtering

[brownn]

Hi,

I am fairly new to the Palo and was wondering whether it was capable of downloading and filtering IWF (caic) url lists? Maybe as part of the Bright Cloud offering or some other means?

Many thanks

[dyang]

Hello,

BrightCloud (Webroot) is a member of the IWF community, and automatically categorizes the IWF feed as "Adult and Pornography". Due to licensing restrictions between IWF and its members, the content of the IWF list cannot be disclosed, but if you'd like to block sites identified by IWF, you should block the "Adult and Pornography" category.

Best,

Doris

[brownn]

It's unusual to see that IWF illegal sites have been grouped together with the legal adult sites category as most other vendors seem to split these into seperate groups. I appreciate that the IWF list is not viewable. I just find it a bit strange that there is no reference to IWF/caic/illicit urls on the category list and we just have to take their word for it that they have been included in the adult category?

[dyang]

In addition to restricting access to the IWF list and its contents, the broader restriction is that there can be no indication that a URL has been part of the IWF list.  In other words, the Palo Alto Networks device cannot allow someone to reverse engineer and conclude that a URL has been flagged by IWF.

In regards to trusting that a participating member such as Webroot has incorporated the IWF list, all members are subject to regular verification by IWF that they are indeed including the list.  Since there is a system in place to ensure this, it's pretty safe for you to assume that blocking BrightCloud category "Adult and Pornography" will include any sites identified by IWF.

--Doris

[brownn]

Thanks for the clarification. My point would be that a number of well known ISP's (eg. Sky, Vodafone) will filter out IWF but not filter out adult and pornography (unless customer is under 18). So they have the ability to differentiate between the two. In its current state the PAN could not support this configuration. It is grouping 'legal' and 'illegal' together under one category.