How does GFI WebMonitor work?

GFI WebMonitor operations can be divided in 4 logical stages:

 

Figure 1 - How does GFI WebMonitor work

Stage 1 - Request initiation: At this stage users request a webpage or a download over the Internet. The incoming traffic generated by the user’s request is received by Microsoft ISA Server which in turn refers to GFI WebMonitor any web traffic (webpage requests, image downloads, file downloads) received.

Stage 2 - Blacklist/Whitelist filtering: This stage comprises an internal GFI WebMonitor blacklist/whitelist filtering mechanism that analyzes user IDs, originating IP address and URL requested.

•	Web traffic requested by blacklisted users and IP addresses or from blacklisted URLs is rejected immediately.

•	Web traffic requested by whitelisted users and IP addresses or from URLs that are whitelisted are automatically granted access and forwarded to the user.

•	Requests that are neither blacklisted nor whitelisted are forwarded to the WebFilter module for processing.

Stage 3 - WebFilter module: The WebFilter module analyzes the uncategorized web traffic received from the blacklist/whitelist filtering mechanism against a comprehensive list of websites categorized in a wide variety of classes. Web traffic is rejected or approved according to policies set up against website categories included within the WebGrade database.

Policies can be set to reject web traffic to a quarantine; where systems administrators can review and approve/deny according to needs and requirements. When the quarantined web traffic is manually approved, the formerly quarantined URL is put in a temporary whitelist so that users can have access to this web resource.

NOTE: The WebFilter module is only available in the WebFilter Edition and the UnifiedProtection Edition of GFI WebMonitor. In the case of the WebSecurity Edition, web traffic is directly sent from the whitelist/blacklist filters to the WebSecurity module.

Stage 4 - WebSecurity module: The WebSecurity module analyzes web traffic through the download control module and scans the incoming material for viruses, spyware and other malware. Infected material is automatically rejected or quarantined based on the policies set up.

Web traffic is also scanned for phishing material through an updatable database of phishing sites. If this data is found to originate from a known phishing element, it is automatically rejected. The approved web material is then sent to the user through ISA Server.

NOTE: The WebSecurity module is only available in the WebSecurity edition and UnifiedProtection editions of GFI WebMonitor. In the case of the WebFilter edition, web traffic is relayed to the user without going through the processes included in the WebSecurity module.