GFI WebMonitor 2009 Review
Note: This is not a sponsored review.
Recently, GFI has released the latest version of their award winning web monitoring and filtering solution, GFI WebMonitor 2009.
With this new release, GFI is taking a step further towards large enterprise security market and what I find the most innovative feature is the optional ability to run the software on any Windows Server / Workstation without requiring a pre-existent ISA Server. Of course, the ISA plugin edition is also available as it has always been.
In my opinion, the next logical step would be providing a dedicated appliance based on a hardened Windows Server as I encounter more and more corporate customers which would prefer an appliance instead of software delivery.
Enough with introduction, let's take a look under the bonnet:
1. Installation
I downloaded the 30 days full edition, available here and one of the first decisions which need to be made is the deployment model.
GFI WebMonitor can be installed as a proxy (default option) or one can chose the Gateway mode which will intercept all HTTP/S traffic trough the network. It's not clear to me (and I did browsed the documentation ) if the Gateway mode requires changes in the IP addressing or is the server placed inline capturing all traffic al layer 2. If you are a GFI tech, please leave a comment on this blog post clearing this issue . Thanks !
2. Monitoring / Management Console
The GFI WebMonitor console presents at a glance the most important real-time statistics about the inspected traffic and the policies which are applied.
Using explicit dashboards and graphs, the administrator can very easily see details about :
- Total bandwidth consumed
- Anti Virus and Anti Phishing statistics
- Bandwidth usage trends
- Top blocked web categories
- Top web categories hits
- Last Blocked Security Threats
3. Configuration
Defining and enforcing content filtering policies is split in several sections for maximum flexibility. For instance, one can define very strict virus, spyware and phishing policies and a more relaxed policy for URL filtering, instant messaging and allowed downloads. I chose to define and impose strict policies for all actions , just to play the role of modern day corporate employee 
, confined in rules and regulations.
I would like to mention that policy enforcement is granular and because not all people are equal, different users or IPs can be the subject of different policies and exceptions which can be defined within one policy. Sweet !
Speaking of users, GFI WebMonitor proxy supports basic authentication or integrated NTLM authentication.
4. User Experience
There are several ways to enforce the GFI WebMonitor proxy settings:
- manual / automatic browser configuration trough GPOs
- publishing the IP of the GFI WebMonitor proxy in WPAD
- transparent proxy redirection
Either way, the end user experience is not affected at all and 10 minutes after I set my browser, I have already forgotten that I'm using a content filtering service. I tried to break the policies by browsing inappropiate websites (adult) , downloading games (spyware) and clicking several phishing links I found on PhishTank.
Each and every time I tried these actions I was blocked and, in the real world, and email could have been sent to security / HR departments. Scary !
Here are a few screenshots of the user side of the action :
|
Anti-Phishing Blocking |
Virus Blocking |
|
Web Policy Violation |
Spyware Blocking |
Here are a few reports (pdf) which I run using GFI WebMonitor Report Pack :
5. Conclusion
GFI WebMonitor 2009 proves to be a very effective security control which protects the largest threat vector in use today : web browsing. It's effectiveness is proven by the short time and small administrative overhead during planning, deploying and maintenance while achieving high quality results. As said, I think that a GFI WebMonitor appliance would complete the picture
One of the core values of GFI has always been the business common sense and ethics which stand behind the "We Care" campaign. You cand download a free copy of GFI WebMonitor or you can buy the full version.
It's good value for the money and, by taking your mind off web content security, it will leave you more time and resources for productivity, creativity or daydreaming & fun.
. Please try 
