Under Review

Report back local Web Threat Shield 'Unblock' activity to Brighcloud

  • 21 August 2014
  • 12 replies
  • 3843 views

Userlevel 7
From comments made in various threads in the Community re. the Web Threat Shield and the associated URL Reputation Service, of which the following is a very recent example:
 
https://community.webroot.com/t5/Webroot-SecureAnywhere-Antivirus/Still-confused-about-brightcloud-reputation-vs-unsafe-website/td-p/140705
 
It has struck me that a useful feature to help the Threat Researchers at Webroot & Brightcloud, would be the capturing & transmission of information back to base, of when the user locally uses the 'Unblock' option to advance past the blocking webpage thrown up by the Web Threat Shield.
 
Whilst I am not suggesting that this is input directly into the URL reputation determination process, it may be worth considering whether the collection of such statistics would help Brightcloud spot sites that need to be investigated more closely because of a large number of local overrides...not only sites that are potentially popular or becoming so but which might also indicate that there is an issue with reputation, etc.
 
Just an idle tbought that may be of use going forward.
 
Regards
 
 
Baldrick
 
 

12 replies

Userlevel 7
One thing that I have noticed is often when the Web Filter has a False Positive problem affecting many users is that it may take quite a while for the problem to be actually reported.  Many users will simply click "Unblock and Continue", which will of course Whitelist the URL on their own machine, but it will not help fix the actual problem.
 
Much of the time, when encountering a False Postive on a site we have long trusted to be quite safe, such as Facebook for example, most people will just wonder "Why did it do that??", and then click to Unblock and Continue, and will not even think about submitting a Trouble Ticket or any other action to have the FP reviewed.
 
Would it be possible or even adviseable to add a function to the Unblock and Continue button to also submit a possible FP report for review at Support or Brightcloud?  I think that would significantly reduce the response time of major FP incidents, bring attention to problems MUCH faster, and reduce customer frustration.
 
What do you all think?
 
Userlevel 7
Badge +55
Hi David!
 
I totally agree to be able to have a function that we can send to Support and/or Brightcloud!
 
I think it's a great idea to reduce major FP incidences.
 
Of course I'm in total agreement in having  this added feature for the users which you say is alot quicker.
 
 
Thanks David!
 
 
Userlevel 7
If it would help to make this more feasible, as well as more acceptable to the user base, add an Opt In box so that the customer can decide whether to send the report or not, but even with that I think it would help bring attention to significant FP problems much faster.  Many would be willing to Opt In (Or Opt Out) whereas they are not likely to seek out the report making process.
Userlevel 7
Badge +55
Thats wonderful!
 
Good explanation...Opt in or  Opt Out. If users want to apply this feature then it would become very useful.
Userlevel 7
Badge +48
I think that is a great idea actually.
Userlevel 7
Hi David
 
Thought that this sounded familiar and indeed it is...I made a similar suggestion a while back:
 
https://community.webroot.com/t5/Ideas-Exchange/Report-back-local-Web-Threat-Shield-Unblock-activity-to/idi-p/140913
 
Not as eloquently put as yours but I think that it would be best to merger these two if possible rather than divide potential support. What do you think?
 
Regards, Baldrick
Userlevel 7
My good friend Baldrick, I am really very sorry!  I did not know that you had one going already!  That is what I get for not properly researching before i post.... my fault entirely.
 
As for merging, etc, what say we let @ decide how this can be handled?  We have the same situation with the PUA ideas that both Dermot and I have proposed, and that is not really causing an issue.  we are simply Kudo'ing both 🙂  Whichever exact way of doing it works either way.
 
Now.. I am on my way to make sure I have Kudo's your Idea 🙂
Userlevel 7
Badge +56
I merged the ideas together - looks like it only merges comments and not votes though.
Userlevel 7
Thank you @ , I think that this will work fine  :)
Userlevel 7
My good Buddy DavidABSOLUTELY NO NEED to apologise...I was only drawing attention that great minds think alike. And as for merging yours into mine, thanks Nic, but to be honest I would have been fine if it had been done the other way around...at the end of the day the main idea is to get the feature noticed, discussed, hopefully supported and then into the product.And to be honest also, David, your rendition of the idea is far superior to my rambling effort...and much better describes what is replied...so all kudos are due to you.Regards, Baldrick
Userlevel 7
Badge +56
Yours had more votes though 🙂
Userlevel 7
Personally,. I like it better this way.  A good strong supporting comment adding to the original Idea. 
 
I am again sorry I missed it.... we know why though.  I was mainly 'offine' at the time it was posted :(
 
 

Reply