Businesses that want to start content filtering have a choice: A DNS filter or appliance, but which is best? In this post we explain the benefits of DNS filtering over on-premise solutions.
Traditionally, businesses that wanted to restrict Internet access and block web-based threats would purchase a physical appliance through which all internet traffic would flow. The appliance would be installed on-premise and controls would be applied to cover anyone connected to the network. The appliance would prevent employees and guest users from accessing certain types of web content, block malicious traffic, and ensure malware is not downloaded onto endpoints.
Today, businesses have a choice. They can purchase a physical appliance or they can install a virtual appliance. A virtual appliance performs the same functions as a physical appliance, but it is software-based solution that is installed on existing hardware. This means it is not necessary to purchase any hardware and businesses can save money. In this article we will treat physical and virtual appliances as one.
Another alternative is a DNS filter. A DNS filter requires no hardware purchases or software downloads. The filter works at the DNS level and all filtering takes place in the cloud.
Both types of content filtering solutions allow businesses to prevent users from accessing malicious websites when connected to the network and restrict the types of content that can be accessed.
DNS Filter or Appliance?
If you are unsure whether to opt for a DNS filter or appliance, consider the following benefits of DNS filtering over appliances.
No costly appliance to purchase and quick and easy filtering
Appliances can be costly and they need to be ordered, delivered, and installed. That means the IT team will need to be on site to complete the install. The hardware will also need to be maintained. With a DNS filter deployment is quick and easy. Simply point the DNS to the service provider and you can be up and running in minutes.
Avoid scalability issues
An appliance can be used for a limited number of users. If the business grows or if more devices need to connect the internet, it may be necessary to upgrade the appliance or buy multiple appliances. Similarly, if the number of users falls, you will be left with an expensive appliance that is surplus to requirements. With a DNS filter, you just pay for the number of users and can scale up and down as necessary.
Appliances require content to be downloaded
With an appliance the filtering takes place on the appliance itself, which means any malicious content must be accessed and downloaded before it is blocked. A connection must be made to a malicious site before any filtering takes place, however briefly. Further, since content is downloaded, that has an impact on bandwidth. With a DNS filter, the filtering takes place at the DNS level before a connection to a site is established which means threats are eliminated before any malicious code reaches the perimeter. A DNS filter can also block command and control center callbacks and data exfiltration attempts and protects all ports and protocols, not just port 53.
DNS filters inspect SSL traffic using the service providers resources
Most websites are now SSL enabled, which means web traffic must be decrypted, inspected, then re-encrypted. That requires a lot of processing power which can have a negative impact on end users. During heavy usage, slow downs are inevitable and CPU usage can be intensive. With a cloud-based DNS filter, the service provider performs the processing and, regardless of traffic volume, the user experience is the same.
DNS Filters make it easy to filter at multiple locations
If you buy an appliance, protecting remote workers and satellite offices is a problem. You need to backhaul traffic to the location where the appliance is located, so regional offices and remote workers will have slower internet speeds. With a DNS filter, it is possible to filter in multiple locations and to protect remote workers no matter where they are located, without the need to backhaul traffic. That means no latency.
DNS filters allow managed service providers to offer filtering to their clients
A DNS filter makes it easy for managed service providers to add content filtering to their service stacks. There is no need for an appliance to be sent to a client and installed by MSP staff. A cloud-based DNS filter is a turnkey solution that can easily be set up and managed remotely. All clients can be managed through a single pane of glass, making monitoring and management simple with little time investment required.
In short, for the majority of businesses considering a DNS filter or appliance, a DNS filter wins hands down. It is quick, easy, simple, efficient, and is the most cost-effective way of content filtering and blocking web-based threats.
Further, you can try DNS filtering before committing to a purchase. With TitanHQ’s WebTitan Cloud, you can have a two-week trial of the full product to evaluate it in your own environment.