Maintain and Enforce Network>Based URL Filters
Description
Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Cloud-native secure web gateway with inline inspection, URL filtering, sandboxing, and DLP for web traffic
Zscaler · Per-user subscription
Enterprise firewall and security fabric with NGFW, SD-WAN, IPS, and integrated security services
Fortinet · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Drive-By Download from Compromised Legitimate Websites
IntegrityUsers visit legitimate but compromised websites that redirect to malicious URLs hosting exploit kits, and without network-based URL filtering these malicious redirects succeed in delivering malware payloads.
Credential Harvesting via Category-Spoofed Phishing Sites
ConfidentialitySophisticated phishing campaigns use newly created domains that mimic corporate login portals, and without URL reputation filtering and category-based blocking these sites are accessible to all enterprise users.
Data Exfiltration via Uncategorized Cloud Storage URLs
ConfidentialityAttackers or malicious insiders upload sensitive data to personal cloud storage, file-sharing services, or paste sites, and without URL filtering by category these data exfiltration channels remain unblocked.
Vulnerabilities (When Safeguard Absent)
No Network-Based URL Filtering or Secure Web Gateway
The organization does not enforce URL filtering at the network level, allowing enterprise assets to connect to any website regardless of its reputation, category, or known threat status.
URL Filter Policies Not Updated with Current Threat Intelligence
URL filtering exists but block lists and category databases are not regularly updated with current threat intelligence, allowing recently identified malicious URLs to bypass filtering controls.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |