Week 5 Domain 4 Securing Traffic.pdf - Week 5: Domain 4...

Week 5: Domain 4 Securing Traffic
p.133-163
Antivirus
Avs protect against viruses, worms, and trojans w/ spyware downloads
Palo Alto uses stream-based malware prevention. Engine – inspects traffic the moment the first
packet is received to provide protection for client’s w/o significantly impacting performance of
the firewall.
• Default profile inspects listed protocol decoders for viruses and generate alerts for
SMTP, IMAP, and PoP3 protocols while blocking FTP, HTTP, and SMB protocols.
Wildfire: provides signatures for persistent Threats that are evasive and haven’t been
discovered by other Avs.
• Once discovered integrates them into normal AV signatures.
o Admin can download these signatures: sub-hourly.
Anti-Spyware
• Block SW on compromised hosts from communicating to C2 servers.
Vulnerability Protection
• Stop attempts to exploit system flaws/gain unauth access to systems.
• Anti-SW sec profiles identify infected hosts when traffic leaves net
• Vulnerability Protection Sec profiles protect against threats entering net.
o Buffer overflows, illegal code exe, etc.
URL Filtering
• Profile determining web access/credential-submission permissions for URL cats.
• Default set to allow.
• Default set to no logging
• Default allows access to all URL cats except threat prone categories:
o Abused-drugs, adult, gambling, hacking, malware phishing, questionable,
weapons.
• User Cred Submission: allow or disallow users to submit valid corporate creds to URL
categories.
o prevents credential phishing.

Wildfire Analysis
• Turns PA Nets into a distributed sensor and enforcement point to stop zero-day
malware and exploits before they spread.
o Threats detonates, intel gathered, prevention auto orchestrated across NG sec
products as soon as signatures generated.
▪ Multitechnique approach, combines dynamic/static analysis, machine
learning, and groundbreaking bare metal analysis.
Antivirus
– again
• Decoder actions:
o Default, usually an alert or reset both.
o Allow ……
o Alert: Generates a alert saved in the threat log ….shocker .
o Drop ……
o Reset Client: TCP resets client-side connection
▪ UDP: drops it
o Reset Server: TCP resets server-side connection.
▪ UDP: Drops
o Reset Both: TCP resets connection on client and server.
▪ UDP: You will never guess …..
• Can make customized profiles to min av inspection on trusted security zones.
o Can also max inspections for traffic on untrusted zones.
Anti-SW
• Default profiles: Default and Strict
o Strict overrides default action of critical, high, medium severity threats to the
block action, regardless of defined action in signature file.
• After threat event is detected, you can configure the following actions for Anti-Spyware
Profile
o Default: Default action of alert or reset-both.