Color-Coding Web Searches

Red light, green light is becoming the way to ensure users don't hit the wrong Website: ScanSafe has added a new feature to its Web filtering service that lets enterprises alert users before they visit unsafe Websites they've found in their Google, Yahoo, MSN, or other searches.

ScanSafe's new SearchAhead feature is based on its free Scandoo search utility for consumers, which displays sites in a search with a red "x" for malicious sites, a yellow question mark for suspicious ones, and a green "check" for safe ones.

SearchAhead goes a step further, letting enterprises automatically warn their users of sites that are deemed unacceptable or unauthorized based on company Web filtering policies. ScanSafe scans the sites in real-time, so the site's viability is constantly being checked.

Dan Nadir, vice president of product strategy for ScanSafe, says the SearchAhead feature -- now part of the vendor's Web filtering service at no extra charge -- differs from McAfee's SiteAdvisor search utility in that it does real-time scanning and lets enterprises actually enforce a policy that users can't visit certain sites.

"Red is 'inappropriate,' yellow is 'caution,' green is 'fine,' and a spider [icon] means there's a potential of something malicious on the site," Nadir says. ScanSafe estimates that one in five result pages contain malware or offensive content.

And unlike Scandoo, which basically warns users about dangerous sites, users can't visit the "red" sites with SearchAhead.

But Thomas Ptacek, a security researcher with Matasano Security, says it's risky to move your sensitive Web traffic to a third party for inspection. And the "yellow" or "questionable" designation doesn't add much value.

"The other question is 'What do I do with yellow?' Either it's safe or it isn't," he says. "SMB network operators don't have time to sort through thousands of yellow alerts to decide what is or what isn't okay."

Microsoft's Internet Explorer 7 does some Website-filtering for users based on certificates and focuses mostly on known phishing sites. "We're categorizing every single link," Nadir says. "We know if there's malware content within one minute of someone posting it."

ScanSafe uses a combination of third-party scanning engines, databases, and heuristics for checking Website search requests. Nadir says ScanSafe's Web Filtering and other services, which include Web malware scanning and IM control, are popular among small enterprises that don't have the IT resources or funds to handle their own Web filtering. But the product also has some large enterprise customers who have sites around the globe with different privacy laws and bandwidth speeds.

The full suite of ScanSafe services costs about $6- to $7 per user per month.

— Kelly Jackson Higgins, Senior Editor, Dark Reading