Every web request checked against the person’s own policy — and a page that says why

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

SurfGuard checks every web request against the policy of the person who made it: the DNSGuard security engine first, then about 57 content categories, then your lists. Blocks explain themselves and can be appealed; approved sites reach every proxy within a minute.

2The challenge

Most attacks still start with a click: a phishing page that looks like the bank, a download from a look-alike site, a link in an SMS. DNS filtering stops many of them but sees only the name, not the person or the file, and gives the user no explanation. Content rules differ by team — the newsroom needs social networks, accounts does not — and when a site is blocked by mistake there is no simple way to ask for it.

The TotalHeal approach. SurfGuard is a secure web gateway. Browsers send their web traffic to it — the TotalHeal cloud proxy or a proxy in your office — and each person signs in with their e-mail and a proxy token. Every request is checked against that person’s policy: the security checks of DNSGuard first, then content categories, then your own lists. A blocked or warned site shows a page that says why, with a button to request access.

3Architecture

4How it works

1. ConnectBrowsers take the PAC file; people sign in with their e-mail and a proxy token.
2. DecideSecurity checks, content categories and your lists decide each request for that person’s policy.
3. ExplainBlocked and warned sites show the reason; a warning can be continued for an hour.
4. AskPeople request access from the page; an administrator approves for them or for the policy.
5. RecordEvery block is logged and security blocks raise alerts in the incident queue.

5Capabilities in detail

• A policy per personEach person gets their own policy, the policy of the first group rule that matches, or the default. Allow, warn or block each content category; add sites to always allow or always block; turn on safe search for Google, Bing, YouTube and DuckDuckGo.
• Security firstMalware and phishing hosts (URLhaus), your own threat intelligence, analyst blocks from incident response and look-alike domains of your brands and Indian banks are decided by the same engine as DNSGuard, before any category. Security blocks raise alerts in the incident queue with MITRE ATT&CK.
• 57 content categoriesAdult, gambling, piracy, proxies and anonymisers, social networks, streaming, shopping, games, webmail and more — about 5 million domains from the Université Toulouse Capitole (UT1) lists, rebuilt daily. A site in several categories is decided by all of them.
• Pages that explainBlocked and warned sites show a page with the reason — on HTTPS too, when devices trust the organisation’s SurfGuard root. A warning lets the person continue for an hour; a block lets them request access with a reason.
• Access requestsRequests arrive in the console with the site, its categories and the reason. Approve for that person only, or add the site to their policy’s allow list for everyone; the proxies have it within a minute.
• TLS inspectionOn the Professional tier, allowed HTTPS sites can be decrypted with the organisation’s root, except the categories and sites you exempt (online banking and finance by default), so the activity shows full addresses and downloads can be checked.
• File typesOn the Professional tier, downloads of chosen file types — exe, msi, apk, iso — are blocked, by name and by the file name the server sends.
• Cloud or officeThe TotalHeal cloud proxy serves people anywhere; on the Professional tier a self-hosted proxy runs in the office, where listed office networks need no sign-in. Both take the same signed policy and keep working on the last good one if the cloud cannot be reached.
• Work hoursOn the Elite tier, categories can be blocked only inside work hours — for example streaming and games from 09:30 to 18:30 on weekdays, in your time zone.

6Security and data handling

• Signed policyProxies run only a policy signed by TotalHeal and keep the last good one if the cloud cannot be reached.
• Tokens are never storedSurfGuard keeps only a fingerprint of each person’s proxy token.
• Exempt is exemptSites and categories you exempt from inspection are never decrypted.
• No silent blocksEvery block says why and who to ask.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• Browsers set to the SurfGuard PAC file (by Group Policy, MDM or TotalHeal UEM)
• The SurfGuard root trusted on devices for pages on HTTPS and for inspection

Start a 30 days, up to 25 people trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.