IT‑IS‑Networking
Technology › Security Architecture

Web Filtering and Content Security

Eighteen years and five vendor generations of the one control that touches every user every day — and, in a government estate, the one whose decisions are public records.

Also known as Web Gateway, Content Filtering, Secure Web Gateway

Left to right is time. Each row is one of the 8 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Websense from 2005, BlueCoat evaluated against IronPort and migrated floor by floor, OpenDNS, McAfee Web Gateway — later SkyHigh — and finally Palo Alto. Each migration overlapped the one before it rather than replacing it cleanly, because the estate has to keep enforcing while it moves.

Filtering is unusual among security controls in that every user meets it every day. That makes a migration a renegotiation of what people may reach from a city desk rather than only a technical cutover. Capacity was the recurring constraint rather than policy: the gateways ran to processor exhaustion under load, and the answer was standing up four more.

What makes it a government problem rather than a corporate one is that the decisions are public records. A block is a decision somebody made, it can be requested under Florida public records law, and it was. So the estate needed a governance instrument as much as it needed a gateway.

Applied in

  • E-Rate Funded Network Programs2024–2026Roughly fifteen engagements across school districts, a regional education service agency and a public library consortium — every design constrained by federal funding eligibility and the funding-year window.
  • Clerk of the Court Filtering and DMZ Architecture2016–2023A separate filtering estate and demilitarized zone for an independently governed constitutional officer sharing City facilities.
  • Electronic Paper Tablet Assessment and Rollout2019–2023A personal device that became a supported city endpoint — after the enterprise web filtering estate I had built turned out to be the thing breaking it.
  • Enterprise Web Filtering and Content Security2005–2023 · final platform decision scored 17 May 2023Eighteen years and five vendor generations, split two ways between a government workplace and a public library on the same infrastructure.
  • Enterprise Firewall Policy and OperationsMay 2009 – March 2017Eight years running the rule base directly across two platform generations — every rule, change and upgrade — then handing it down to a dedicated post rather than holding it.

See also

Also searched as

  • SASE
  • SSE
  • secure service edge
  • cloud-delivered security