John Pescatore

(My blogging got a bit backed up due to travel and PC upgrades)

I want to see Web Security Gateway vendors (and any other security product vendor who can do this) add a very simple feature:

• Every time there is an update to the list of bad URLs, I would like them to look at the user access logs to see what users went to those URLs before we knew they were bad. That is a good indicator of PCs that are likely to have been compromised.

After all, this is sort of what the desktop AV world has done forever: we run a disk scan to find all the malware that gone on the hard drive before we knew it was malware. When you are stuck using a reactive blacklist, you have to do this – it should be a standard part of web security gateways.

Submit a Comment »

Category: Uncategorized     Tags:

Share