This article applies to:

• R3000
• Web Filter (WF, WFR)

Question:

• Can the R3000 web filter enforce safe-search for the new SSL-based Google search?

Information:

In May of 2010, Google released a public version of their encrypted (SSL) search offering at https://www.google.com/.  It utilizes Secure Sockets Layer (SSL) technology which is usually recognized by a web address starting with “https”. Anytime a user searches via the HTTPS site, an encrypted connection is created between the user’s browser and Google. This secured channel protects the user’s search terms and user’s search results pages from being intercepted by a third party on the network.

Shortly after the debut of encrypted search, Google received feedback from educators who were concerned that the new service would hinder their ability to protect students from undesirable web content.  Google initially responded by establishing a separate hostname for encrypted searches.  When a search query was submitted to https://www.google.com/, the results were served by https://encrypted.google.com/.  By blocking access to encrypted.google.com, schools could continue ensuring safe searches for students.  Later, Google relaunched SSL Search at https://www.google.com/, but they provided an additional means by which educators could ensure that safe searching is still enforced.

It is important to note that Google shares IPs and certificates between many of its SSL services.  Consequently, it is not possible for an out-of-band web filtering solution to surgically prevent encrypted Google searches while allowing full access to all other Google web properties.  Unencrypted searches should be enforced using DNS techniques in order to ensure that other Google web resources continue to operate as expected.  Doing this does not involve any configuration changes on the Web Filter.  Instead, administrators should apply both of the following configurations on their DNS servers:

• Configure the DNS servers so that all lookups for encrypted.google.com resolve to a single IP address which is blocked at the organization's firewall.
   
• Configure the DNS servers so that the DNS entry for www.google.com is a CNAME for nosslsearch.google.com.

Further information on Google SafeSearch and SSL Search for schools is available at:

http://support.google.com/websearch/bin/answer.py?hl=en&answer=186669

Information on contacting Google can be found at:

http://www.google.com/support/websearch/bin/request.py?contact_type=school_ssl_issues

For customers who are looking for more granular control over SSL traffic, Trustwave provides two other solutions that can decrypt SSL traffic: Secure Web Gateway and WebMarshal. You can use either of these solutions to ensure that the traffic over SSL remains filtered.  Additionally, these solutions help to ensure more effective compliance and security by blocking SSL proxies and malware.

If you have interest in providing more granular control over SSL traffic, or if you have questions regarding the Trustwave Web Filter, WebMarshal, or Secure Web Gateway (SWG), please contact our technical support staff or your local sales representative.

FAQ

Q. Why can’t the Web Filter (R3000) enforce safe search on Google SSL Search site (https://www.google.com/)?
A. To enforce safe search, transactions involving www.google.com must be modified.  HTTP transactions are in plain text, so the Web Filter can interpret and modify them.  However, SSL transactions are encrypted, preventing out-of-band / pass-by filtering solutions from reading the data that is transmitted from the client (the browser) to the server (the external web site).  In order to decrypt HTTPS, it is necessary to have an inline filtering solution that has been designed to act as a man-in-the-middle for SSL traffic.

Q. Can the SWG or WebMarshal product work in conjunction with Web Filter?
A. Yes. The Web Filter can work in conjunction with SWG or WebMarshal. In an organization where multiple products are present, the Web Filter can provide URL filtering and the other product can be leveraged to provide more granular SSL compliance and web security.

Q. How much does the SWG product or WebMarshal cost?
A. Please contact your Trustwave Account Representative for pricing.

Q. Where can I get more information on these products?
A. For more information, please click the link below, or contact your local sales representative.
https://www.trustwave.com/web-security/

Q. Where can I find more information regarding Google's original response to educational institutions?
A. Google's statements on this topic can be found in their Official Google Enterprise Blog at:
http://googleenterprise.blogspot.com/2010/06/update-on-encrypted-web-search-in.html