The proxy is fed automatically with a blacklist maintained by its vendor, a US security company, and that list blocks not only known malware sites but the whole category "Drugs", which covers practically the company's entire customer base of breweries and distilleries. The tool was installed, but nobody adapted it to the business it protects.

* The vendor's category list blocked the malware sites and the customers' sites alike. *

The management's view was "great, it protects and makes little work". The users' view was that they could no longer do their jobs. A vendor's category list encodes the vendor's idea of unwanted content, in this case from a market where alcohol sites fall under "drugs", not the needs of a particular company. The result is low acceptance of the whole measure, which is a security problem in its own right, as the next card shows.

Go deeper:

• Internet filter (content-control software) — Wikipedia — category lists, blacklists and their side effects.

Users will find workarounds, each bringing new risks: internet via a phone hotspot, calling the site by IP address without DNS, an anonymising VPN, another proxy, or simply a private PC. The introduction and further operation of a content-control proxy must always come with support processes; here the administrator should, after a short check, add the sites to an exception list or release the whole category.

* Every workaround takes traffic around the control, so the company sees and protects less than before. *

Every one of these workarounds takes traffic around the control instead of through it, so the company ends up with less protection than before the proxy, plus traffic it can no longer see. This is the operational side of the gateway rule "all traffic must pass through it": people only keep routing through a control they can live with.

Tip: a security measure that blocks the business is not neutral; it pushes users toward shadow IT.

Go deeper:

• Shadow IT — Wikipedia — what users build when official IT blocks their work.
• Internet filter (content-control software) — Wikipedia — category lists, blacklists and their side effects.