Web content filtering blocks high-risk categories

Overview

When you don’t block high-risk web content filtering categories like criminal activity, hacking, and illegal software, users who connect through Global Secure Access stay exposed to dangerous attack vectors and liability risks. These high-risk sites can distribute exploit code, malware-embedded software, and guidance on committing illegal acts that threat actors can use to compromise your environment.

Without this protection:

• Users can access sites that provide tools, scripts, and tutorials for unauthorized access, enabling threat actors to escalate their capabilities within the network.
• Pirated software and license key generators downloaded from illegal software sites frequently contain embedded malware that establishes persistence and enables lateral movement.
• The organization faces both security vulnerabilities and legal liability from uncontrolled access to high-risk content categories.

Remediation

• Configure web content filtering to block high-risk web content categories Criminal activity, Hacking, and Illegal software.
• Review all available Global Secure Access web content filtering categories.
• Create security profiles to group filtering policies for Conditional Access enforcement.
• Enable the Internet Access traffic forwarding profile to route traffic through Global Secure Access for web content filtering to apply.
• Link security profiles to Conditional Access to enforce web content filtering for targeted users and groups.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1189 Drive-by Compromise, T1204.001 Malicious Link
Licence	Entra_Premium_Internet_Access
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.