Policy Management Overview

What is a filtering policy?

A filtering policy is a set of rules or settings that the Lenovo NetFilter Policy Service uses in making decisions about whether requests for Internet content should be allowed or denied. The Lenovo NetFilter solution allows you to create one or more unique policies for groups of people or workstations. Lenovo NetFilter refers to all of these workstations and/or persons in the Lenovo NetFilter system as ‘Clients’, and each has a corresponding client record in the system. The Lenovo NetFilter system doesn't tie client records directly to filtering policies. Instead, all client records are members of client groups (even if a group consists of only one client record) and each group owns one or more filtering policy records. The Lenovo NetFilter solution also allows you to apply different policies to a group and its client members at different times of the day or week.

One policy is designated as the default policy for a Lenovo NetFilter installation. Lenovo NetFilter applies this policy if the client or group making a request is unknown or not yet configured. Each group, when created, automatically has one policy with some default settings specified in the 'WebAdmin Settings'. That policy is named 'default,' which can be used as a template in creating new policies for the group.

Each filtering group can have either one or many policies. If there are many, each policy applies to a different time segment.

Basic Elements of Filtering Policies

All Group policies contain the same basic elements:

• A set of selected content categories

• A setting for the default status, which determines whether the sets of selected categories and protocols are allowed or denied

• Lists that let you add URL/Keywords to Local and Shared Lists for the Group.  These Lists allow exceptions to the selected content categories and protocols on the individual policy. Individual policies start out with an empty Local URL/Keyword List, but admins or system operators (SysOps) can add entries by importing lists or creating individual entries in the list.  See 'Policy Management - Lists' for more information.

Configuring the Default Group and Policy

The master admin defines the elements of the default policy by configuring certain settings on the ‘WebAdmin Settings’ page. Later, admins or system operators (SysOps) create groups and policies. Each group is created with a policy named ‘default’. This default group policy initially shares some settings with the default system policy, but the admins and SysOps can rename it and complete the optional features so that it is radically different from the default system policy. In addition, the admins and SysOps can clone this policy and then alter it to create additional policies that rule different portions of the group’s week.

Rather than create individual filtering policies for each user (a client), it is more efficient to create a few filtering policies with a group of users that share similar filtering requirements.  The basic concept of policy management within the Lenovo NetFilter filtering solution is that clients are assigned to groups that have filtering policies applied with Time Segments.

Group, Policy and Category Templates

Template-driven Group and Policy management allows you to standardize Group settings using Group, Policy and Category Templates. Please see 'Policy Management – Templates' for more information.

Categorizing Internet Content

Category filtering is the sorting of URLs into subject categories for subsequent filtering based on that subject content. It forms one of the core technologies used in the Lenovo NetFilter filtering system.

Categorization Basics

This example shows five URLs.  Each URL has been categorized by the Lenovo NetFilter CNS.  Based on these Categories, they can be allowed or denied.  Remember in this example that it is the Category that is denied and not the URL.

If a Category is denied, a Deny Page is served.

The Lenovo NetFilter categorization engines and review team assign content categories…

Lenovo NetFilter’s Categorization Engines use artificial intelligence to scan and sort the content of billions of websites and add this information to a database of categorized sites maintained on the Lenovo NetFilter Category Name Server (CNS) and periodically downloaded to local Lenovo NetFilter Policy Servers. Lenovo NetFilter also has a human review team that trains and reviews the Categorization Engines’ AI (Artificial Intelligence) logic. If you detect a mistake in Lenovo NetFilter’s category assignment and report it to us as a URL Alert, our human review team will review the category assignment and exert their oversight on the AI logic. The human review team can also use this information to adjust the AI logic.

Customer Input is Equally Important and has Higher Priority

However, this is just one part of the categorization process. You have an equally important role to play in the categorization process and your role is ultimately given higher priority in determining the categories assigned to the URLs your own clients visit.

Creating Custom Category Assignments for URLs

As an Admin or SysOp working with a Lenovo NetFilter system, you can assign URLS your customers/clients routinely access to categories of your choice. These categories can disagree with the categories assigned by the Lenovo NetFilter categorization process and are given a higher priority when your customers/clients attempt to access sites you have added to your Category URL list.

The Category URL List you create is among the first sources of information Lenovo NetFilter checks when customers/clients attempt to visit a website. If the URL is listed on the Category URL list, Lenovo NetFilter issues an allow or deny ruling, based on the allow or deny status of that category on the relevant policy.

Creating Custom Categories and Groups

You can not only customize the category assignments of URLs but also create custom categories and custom groups to serve your customers and clients’ URL access requirements. For example, teachers or schools may want to add URLs they commonly used for instruction or guidance to a custom “allowed” category called “Instructional Websites.” Or perhaps you want to consolidate all of the universally banned categories in a custom group called ‘Banned Categories’.  The Master Admin is able to add these Custom Categories using the ‘Category Manager’

URL Allow and Deny Lists Provide Exceptions to Category Filtering

The System, Local and Shared URL Lists provide exceptions to category filtering. For information about how to use the URL Lists to create exceptions to category filtering, see the Lenovo NetFilter document entitled “Using the WebAdmin URL Tools.”