New tool plugs search engine malware risk

ScanSafe has added a new safe search feature to its web filtering service, which reduces the risk of employees inadvertently visiting rogue websites from search engine results.

The new SearchAhead tool, free to all customers using its business filtering service, alerts users to risk using colour-coded annotations to search results returned by popular search engines such as Google, MSN and Yahoo!. Links clicked on are also scanned for malware in real time.

The websites included would depend on the policies implemented by a particular company, but would be drawn from Scansafe’s database of problem or unknown sites. The system is seen as a more practical solution than simply blocking sites, though the system did block and log visited sites using specific policies, giving users advance warning.

According to ScanSafe’s 2006 Annual Global Threat Report [PDF], search engines are now one of the biggest risks to business use of the web. Using the commonest search terms as defined by Google Zeitgeist report, one in five search pages contained malware or offensive content, the company said. Apparently harmless search terms could return a high number of malware-infected websites with company users oblivious to the
dangers.

“Search engines are an essential tool in the workplace, yet they can also be an Achilles’ heel in corporate Web filtering policies. SearchAhead provides immediate feedback to end users on the safety of unknown, new websites returned in their search,” said ScanSafe’s Dan Nadir.

The technology reduced workload on admins and made it possible for employees to implement company security policies without resorting to outright site blocking, he said.

Another addition to Scansafe’s filtering service is the ability to control access to websites using https encryption. This would let employees visit legitimate websites such as online banking, while blocking other https sites not classified by the service.