Content filters

[Mike Plass]

I know we discussed this at the last SEMTEC meeting, but I would like to discuss again.

What is everyone using for content filtering?

How much do you pay for the service? per month/per year?
If you have an appliance, how much did you pay for the appliance?  Is there a yearly/monthly maintenance fee?

I remember someone had opendns, lightspeed appliance, HBCI, etc.

This is stemming from some issues we've recently had with HBCI and their CIPA filter.  Their CIPA filter was down for about 2 months and it was finally brought back online for us last week.
I also don't like the fact that when someone puts an "override" credential in, it opens the whole filter, not just the one site.

I would like to have more control of what is filtered and what is not.

Thanks for any input you may have.

Mike Plass

IT Coordinator

St. Charles Public Schools

[Bryan Berg]

D-E is presently using a SonicWall, but we're exploring other options. Presntly we're paying about $1600 per year (cost is dependent on how long of a contract you want to sign, ours is a two year). The cost includes a $1100/year licensing cost (essentially for the content filter and definitions, and SonicWall's ViewPoint software that lets you view traffic and usage reports) and $500 per year for basic support (that level for us is working hours support, five days a week for replacement if it dies...24/7/365 is quite a bit more expensive).

SonicWall has some of the same limitations as you described. I can assign (based on IP address) a device to be free of the content filter restrictions, but it's an "all on" or "all off" sort of a thing in that case. There is no end user override option that I have seen with this device (unlike what I've seen with 8e6 or what it sounds like the CIPA Filter does). We have a flat network at D-E, so se don't have different computers set up in different subnets or vlans, I think SonicWall could differentiate between different subnets and vlans to provide different content filtering for those different areas if we did.

What would be interesting is to maybe make a list of the features that we would expect in a content filter and see if the options we're looking at meet those feature expectations.

Based on what you wrote and what my experiences have been, I would say these are some of the features:
1. Control over what is filtered on a machine by machine basis (IP determined) or other methods
2. More than "all on" or "all off" options for that control
3. Ability to view usage reports down to a machine level (would be great if machine name was included in reports rather than IP or MAC address only)
4. Individual override - but for individual only and perhaps time-limited as an option

Others? I know that this is just for content filtering, and some of these boxes have other capabilities if you want to pay for them (SonicWall, for example can do things like spam filtering and antivirus. I think Lightspeed has some of those options, as do others)

[Brian Moskalik]

At RCS, we've got a Watchguard Firebox.  It has the ability to do multi-tier filtering based on Active Directory security groups, IP address, subnets...  It also has email spam filtering, firewall antivirus, intrusion prevention, and application blocking.  I believe we pay a $800 yearly maintenance agreement for it.  It does daily updates from Watchguard for content filters, AV, and all.

We are still trying to figure out best practices with it, but for the cost it works fairly well.  Some issues here and there, but those tend to be getting denied rather than letting in something we don't want.

[Jeff Thompson]

We use the CIPA filter  I don't remember the costs off hand you can check it out at http://cipafilter.com/.  The unit can act as router, firewall, e-mail filter, web filter.  I use it mainly as a web filter.  Simple to use.  We have the student laptops on a separate subnet which is filtered differently than the staff computers.  You can get down to a specific IP if you want.  I can get reports on one student if I want.  I can view all of our students computers using Apple Remote Desktop (which is built into the operating system) to select an IP address for a student.  Then get a report from the CIPA filter on history.  We also set the CIPA as a proxy in the student laptop proxy settings so they are filtered when they are at home.

Tech support from the company has been super and is included with the annual fee.  I call them often to help with firewall rules with i-pad apps etc.