Wrong behavior of Advanced URL filter

[AngeloOghittu]

Dear experts,

Here is my question:

Our customer has registered new URL domains and configured the firewall to block all newly registered domains via the URL filtering configuration. They noticed that the new domain is NOT blocked right away but about 15 minutes after the first time it becomes reachable.

Is this behavior expected? The customer pointed out that if this is the intended behavior, it could pose a risk to the security of the internal network.

Thank you for any help

Best regards

Angelo

[harold07douglas]

Hello,

This is an insightful observation by the customer, and their concerns are valid. Here's an interesting way to frame this situation:

"15 minutes might not seem like much, but in cybersecurity, it's a lifetime for an attacker."

The delayed enforcement could indeed provide a narrow window for exploitation, especially in targeted attacks that leverage newly registered domains as part of phishing campaigns, malware distribution, or other malicious activities. However, the delay is likely due to the time it takes for the URL filtering service to process, classify, and propagate updates for new domain registrations across its database. This delay highlights a trade-off between scalability and real-time protection. A system designed to block domains instantly after registration would require an extraordinarily fast feedback loop, which may not always be feasible. The risk can be mitigated by adopting complementary defenses, such as DNS-layer filtering that blocks access to domains with suspicious patterns (e.g., newly registered TLDs) or employing behavioral analysis that flags unusual activities on new domains. Integrating the URL filtering with a broader zero-trust architecture could minimize reliance on the timing of domain classification by ensuring that all external connections, even to "new" domains, are verified and monitored. While the delay might be an inherent limitation, the incident underscores the importance of multi-layered security strategies.