Firewall informed by web server security policy identifying authorized resources and hosts

A non-transitory computer readable storage medium having embodied thereon a program executable by a processor for implementing a method for controlling access to unauthorized digital content, the method comprising:

• forwarding a request originating at a client computer regarding access to digital content hosted at a content server;
• receiving a response to the request from the content server, wherein the response includes undetected malware that triggers the client computer to request content from a malware server;
• intercepting the triggered request from the client computer, wherein the triggered request is addressed to the malware server;
• identifying that the malware server designated in the triggered request is an unauthorized data source in accordance with one or more security policies;
• blocking the triggered request from being sent to the malware server;
• and
• sending the client device an error message based on the identification that the triggered request is associated with the unauthorized data source in accordance with the one or more security policies.

An apparatus for controlling access to unauthorized digital content, the apparatus comprising:

• a communication interface that communicates over a communication network to:
• forward a request originating at a client computer regarding access to digital content hosted at a content server,
• receive a response to the request from the content server, wherein the response includes undetected malware that triggers the client computer to request content from a malware server, and
• intercept the triggered request from the client computer, wherein the triggered request is addressed to the malware server,
• a processor that executes instructions stored in memory, wherein execution of the instructions by the processor:
• identifies that the malware server designated in the triggered request is an unauthorized data source in accordance with one or more security policies, and
• blocks the triggered request from being sent to the malware server;
• wherein the communication interface sends the client device an error message based on the identification that the triggered request is associated with the unauthorized data source in accordance with the one or more security policies.