An organization implements URL filtering to block high-risk websites. During a review of the network logs, the security team discovers users are accessing malicious websites via encrypted HTTPS connections. Which additional feature is critical to ensure effective URL filtering in this scenario?

Standard URL filtering cannot inspect the content or full URL path of traffic encrypted with HTTPS. It can only see the destination domain name in the unencrypted Server Name Indication (SNI) field of the TLS handshake. To effectively filter malicious URLs (e.g., https://legitimate-site.com/malicious-page) and not just block the entire domain, the security appliance must see the full, unencrypted HTTP request. Implementing SSL/TLS decryption allows the device to intercept and decrypt the traffic, apply the URL filtering policy to the plaintext content, and then re-encrypt it. This provides the necessary visibility to enforce granular policies on encrypted connections.

A. A standard Intrusion Detection System (IDS) is also blind to the payload of encrypted traffic and cannot enforce URL filtering policies on it.
B. IP blacklisting is a separate control that operates at the network layer based on IP addresses, not the application-layer URL, and does not enhance URL filtering.
D. DNS filtering blocks access at the domain level before a connection is made and cannot distinguish between benign and malicious URLs on the same domain.

1. Palo Alto Networks. (2023). What Is SSL/TLS Decryption? Palo Alto Networks TechDocs. In the section "Why Is SSL/TLS Decryption Necessary?", it states, "To detect threats hidden in encrypted traffic, you must be able to decrypt the traffic... Decryption enables the firewall to inspect the traffic to prevent malicious content... from compromising your network."

2. Cisco. (2023). Configure TLS/SSL Decryption Policy. Cisco Secure Firewall Management Center Device Configuration Guide, 7.3. Section: "About TLS/SSL Decryption". It explains, "The TLS/SSL decryption policy determines how the system handles encrypted traffic... Decrypting traffic allows the system to perform deep inspection and fully evaluate it for threats and policy violations."

3. Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann. Chapter 10, "Communications," discusses the role of proxies in network security. Section 10.5.3 describes how a proxy can terminate and inspect SSL/TLS connections to enforce security policies, which is the principle behind SSL/TLS decryption for URL filtering. (Referenced concept is foundational to the technology).