I agree that blocking unknown causes more work as a lot of legit websites are still in the unknown category. Luckily, it is easy to create whitelisting rules for this. I typically create a new URL category and white list the domains there that are blocked via unknown. From the security standpoint though, there may be a lot of malware sites classified as unknown. E.g. when I look through the logs at malware blocked, especially involving files flagged by WF, the domain is classified as unknown. So you certainly reduce the attack surface when you block unknown. You just have to keep in mind, you are committing to your users that you will whitelist the domains they need. As always, security is a balancing act. But I have blocked the unknown category for most of my clients. The first few days is when you find the most domains being blocked due to being category unknown. So you may whitelist a lot in the first few days; once you get past that period, it is pretty smooth sailing. Last note that on that. When you have the PAN do cert checking, most of the OCSP sites it calls out to are flagged as unknown. So do not block unknown for your PAN mgmt interface(s). Other than that, no issues thus far.
... View more
