Threat Prevention Policies

IPS

A Check Point Firewall can block traffic based on source, destination and port information. You can increase network security with the IPS Software Blade and analyze traffic for possible risks. The IPS detection engine has multiple defense layers, detects and prevents against known threats, and often protects against future ones.

For example IPS protects against drive-by-downloads, where a user can go to a legitimate web site and unknowingly download malware. The malware can exploit a browser vulnerability that lets it create a special HTTP response that sends the malware to the client. The Firewall allows the HTTP traffic from the web site and the computer is at risk for this malware. IPS protects the computer, it can identify and then block the drive-by download connection.

For more about using the IPS Software Blade, see the R76 IPS Administration Guide.

IPS Protection Profiles

An IPS protection is a set of rules that lets you define how IPS analyzes network traffic. Create IPS profiles to easily configure one or more protections for groups of Security Gateways. You can customize the profile for the specified protections to identify specified attacks. These profiles can then be applied to the groups of Security Gateways to protect them against those attacks.

To create a new IPS protection profile:

1. In the IPS tab, select Profiles.
2. Click New and select Create New Profile.

   The General page of the Profile Properties window opens.

3. Enter the Profile Name.
4. In IPS Mode, select the default action for an IPS protection.
   • Prevent - Protections block traffic that matches the definitions.
   • Detect - Protections log traffic that matches the definitions.
5. In Protections Activation, select if protections are enabled automatically or manually.
6. From the navigation tree, click IPS Policy > Updates Policy.
7. Select the default IPS Mode for new protections that are downloaded: Prevent or Detect.
8. Click OK to create the profile.

Enabling IPS

The Enforcing Gateways page in the IPS tab shows all the Security Gateways that the IPS Software Blade is enabled. You can enable IPS on a Security Gateway that has the Firewall Software Blade enabled.

To enable IPS on a Security Gateway:

1. From the IPS tab, click Enforcing Gateways.

   The Enforcing Gateways page opens.

2. Click Add.

   The Assign Profile window opens.

3. Select a Security Gateway and click OK.

   IPS is enabled on the Security Gateway and it is shown in the Enforcing Gateways page.

4. Install the policy.

Using IPS Profiles

The Enforcing Gateways page shows all the Security Gateways that have the IPS Software Blade enabled. From this page, you can open the Gateway Properties window and assign an IPS profile to a Security Gateway.

To assign a profile to a gateway:

1. In the IPS tab, select Enforcing Gateways.
2. Select a gateway and click Edit.

   The IPS page of the Gateway Properties window opens.

3. From Assign profile, select an IPS profile.
4. Click OK.

To show the Security Gateways for a profile:

1. In the IPS tab, select Profiles.
2. Select the IPS profile.
3. Click Actions > Show Protected Gateways.

   The Protected Gateways window opens and shows the Security Gateways that are assigned to the IPS profile.

Adding Network Exceptions

You can configure exceptions for a protection with the Prevent action, so that it does not identify the specified traffic. These are some situations where it is helpful to use exceptions:

• Traffic that is legitimate for some machines or services can match the protection criteria for malware.
• A server that does not comply with RFC standards.

Adding an IPS Exception

To add a new exception:

1. In the IPS tab, select Network Exceptions.
2. Click New.

   The Add/Edit Exception Rule window opens.

3. From Profile, select a profile or Any.
4. From Protection, select the excluded protection(s).
   • Single protection - Click Select and then select the protection.
   • All supported protections - Only protections that support the Network Exceptions feature are excluded.
5. Define the Source and Destination, and Service for the excluded protection.
   • To use a SmartDashboard object, click Manage and then select the object.
   • To enter a value, click IP Address or Port and then enter the value.
6. Define on which Security Gateways this exception is installed. Select one of these options:
   • All R70 gateways
   • Apply this exception and select the Security Gateway object.
7. Click OK and then install the policy.

Browsing IPS Protections

The Protections window lets you quickly see IPS protections and shows a summary of each protection.

To browse IPS protections:

Click the IPS tab and from the navigation tree click Protections.

These columns give information about the IPS protections.

Updating IPS Protections

Check Point is constantly developing and improving its protections against the latest threats. You can manually update the IPS protections and also set a schedule when updates are automatically downloaded and installed.

To show the IPS update settings:

Click the IPS tab and from the navigation tree click Download Updates.

IPS Update Options

You can use these IPS update options to easily manage new IPS protections:

• New protections are marked for Follow Up - New protections can be automatically marked with a flag and are listed on the Follow Up page in the IPS tab. Click Configure to change these settings.
• Use SmartDashboard Revision Control - Automatically create a database revision before the IPS protections are updated. You can revert the SmartDashboard database back to the earlier IPS protections. For more information about Database Revision Control, see the R76 Security Management Administration Guide.

Configuring Geo Protections

Geo Protection lets you control network traffic for specified countries. An IP-to-country database connects packet IP addresses to the countries. Configure one set of policies for each Profile to block or allow traffic for one or more countries. Configure a different policy that applies to the other countries. Private IP addresses are allowed unless the other side of the connection is explicitly blocked. Check Point control connections (such as between Security Gateways and the Security Management Server) are always allowed, regardless of the Geo Protection policy.

Configure the Geo Protections for each of the IPS Profiles separately. Policies with a Block action for Specific and Other Countries are only enabled when the Profile Action is set to Prevent.

To configure Geo Protection for specified countries:

1. Click the IPS tab and from the navigation tree click Geo Protection.

   The Geo Protection page opens.

2. Select the IPS Profile and one of these Geo Protection Actions for this Profile:
   • Prevent - The Block actions for these countries are enabled.
   • Detect - All traffic is allowed. Traffic that matches a policy with a Block action is logged.
   • Inactive - Geo Protection is disabled.

   

3. Optional: Click Exceptions and configure exceptions for the Geo Protection for this Profile.
4. To configure new Geo Protection policies, click Add.

   The Geo Protection window opens.

   1. Click Country and select the country for this policy.
   2. Select the traffic Direction for this country.
   3. From Action, select Block or Allow.
   4. From Track, select a logging option.

      If a connection matches more than one Geo Protection policy, the first policy is logged.

   5. Click OK.
5. Configure the Geo Protection policy for the other countries.
   1. From the drop-down menu, select Block or Allow.
   2. From Track, select a logging option.
6. Do these steps for all the IPS Profiles.
7. Install the policy.

   We recommend that after some days, you review the Geo Protection logs.

Anti-Bot and Anti-Virus

Protecting Networks from Bots

A bot is malicious software that can infect your computer. There are many infection methods, for example:

• Opening attachments that exploit a vulnerability
• Accessing a web site that results in a malicious download

When a bot infects a computer, it:

• Takes control of the computer and neutralizes its Anti-Virus defenses. It is not easy to find bots on your computer, they hide and change how they look to Anti-Virus software.
• Connects to a C&C (Command and Control center) for instructions from cyber criminals. The cyber criminals, or bot herders, can remotely control it and instruct it to do illegal activities without your knowledge. Your computer can do one or more of these activities:
  • Steal data (personal, financial, intellectual property, organizational)
  • Send spam
  • Attack resources (Denial of Service Attacks)
  • Consume network bandwidth and reduce productivity

One bot can often create multiple threats. Bots are frequently used as part of Advanced Persistent Threats (APTs) where cyber criminals try to damage individuals or organizations. A botnet is a collection of compromised and infected computers.

The Anti-Bot Software Blade detects and prevents these bot and botnet threats. For more about using the Anti-Bot Software Blade, see the R76 Anti-Bot and Anti-Virus Administration Guide.

Identifying Bot Infected Computers

The Anti-Bot Software Blade uses these procedures to identify bot infected computers:

• Identify the C&C addresses used by criminals to control bots

  These web sites are constantly changing and new sites are added on an hourly basis. Bots can attempt to connect to thousands of potentially dangerous sites. It is a challenge to know which sites are legitimate and which are not.

• Identify the communication patterns used by each botnet family

  These communication fingerprints are different for each family and can be used to identify a botnet family. Research is done for each botnet family to identify the unique language that it uses. There are thousands of existing different botnet families and new ones are constantly emerging.

• Identify bot behavior

  Identify specified actions for a bot such as, when the computer sends spam or participates in DOS attacks.

Check Point uses the ThreatSpect engine and ThreatCloud repository to find bots based on these procedures.

Protecting Networks from Viruses

The Anti-Virus Software Blade inspects connections to the Internet and scans file transfers and downloads to the internal network to find and prevent malware attacks. It also gives pre-infection protection from external malware and malicious servers.

ThreatSpect Engine and ThreatCloud Repository

The ThreatSpect engine is a unique multi-tiered engine that analyzes network traffic and correlates information across multiple layers to find bots and other malware. It combines information on remote operator hideouts, unique botnet traffic patterns and behavior to identify thousands of different botnet families and outbreak types.

The ThreatCloud repository contains more than 250 million addresses that were analyzed for bot discovery and more than 2,000 different botnet communication patterns. The ThreatSpect engine uses this information to classify bots and viruses.

The Security Gateway gets automatic binary signature and reputation updates from the ThreatCloud repository. It can query the cloud for new, unclassified IP/URL/DNS resources that it finds.

The layers of the ThreatSpect engine:

• Reputation - Analyzes the reputation of URLs, IP addresses and external domains that computers in the organization access. The engine searches for known or suspicious activity, such as a C&C.
• Signatures - Detects threats by identifying unique patterns in files or in the network.
• Suspicious Mail Outbreaks - Detects infected machines in the organization based on analysis of outgoing mail traffic.
• Behavioral Patterns - Detects unique patterns that indicate the presence of a bot. For example, how a C&C communicates with a bot-infected machine.

Learning about Malware

The Threat Wiki is an easy to use tool that lets you search and filter the ThreatCloud repository to find more information about identified malware. The Threat Wiki helps you to learn more about malware, you can:

• Filter by category, tag, or malware family
• Search for a malware

To show the Threat Wiki:

In the Anti-Bot and Anti-Virus tab, click Threat Wiki. The Threat Wiki page opens.

Examining Anti-Bot and Anti-Virus Protections

The Protections browser shows information about the Anti-Bot and Anti-Virus protections.

To show the Protections browser:

In the Anti-Bot and Anti-Virus tab, click Protections. The lower pane shows a detailed description of the protection type.

Enabling the Anti-Bot and Anti-Virus Software Blades

Enable one or more of these Software Blades on a Security Gateway: Anti-Bot and Anti-Virus.

To enable the Software Blades:

1. In SmartDashboard, right-click the gateway object and select Edit.

   The Gateway Properties window opens.

2. In Network Security tab, select Anti-Bot, Anti-Virus, or both of them.

   The Anti-Bot and Anti-Virus First Time Activation window opens.

3. Select one of the activation mode options:
   • According to policy - Enable the Anti-Bot and Anti-Virus Software Blades and use the profile settings in the Anti-Bot and Anti-Virus policy.
   • Detect only - Packets are allowed, but the traffic is logged according to the settings in the Rule Base.
4. Click OK and then install the policy.

Anti-Bot and Anti-Virus Rule Base

There is a different Rule Base for Anti-Bot and Anti-Virus. The Anti-Bot and Anti-Virus rules use the Malware database and network objects. Security Gateways that have Identity Awareness enabled can also use Access Role objects as the Protected Scope in a rule. The Access Role objects let you easily make rules for individuals or different groups of users.

The first Anti-Bot or Anti-Virus rule that matches the traffic is applied. There are no implied rules in this Rule Base, all traffic is allowed unless it is explicitly blocked. A rule that is set to the Prevent action, blocks activity and communication for that malware.

When necessary, you can add an exception directly to a rule. The object in the Protected Scope, can have a different Action from the specified Anti-Bot and Anti-Virus rule. Here are some examples of exception rules:

• A profile that only detects protections. You can set one or more of the protections for a user to Prevent.
• The RnD network is included in a profile with the Prevent action. You can set that network to Detect.

Managing the Anti-Bot and Anti-Virus Rule Base

These are the fields that manage the rules for the Anti-Bot and Anti-Virus threat prevention policy.

Sample Rule Base

This table shows a sample Anti-Bot and Anti-Virus Rule Base. (The Install On column is not shown and is set to All.)

1. High Security - Traffic for the Finance server and two corporate networks are inspected for bots and viruses according to the settings in the High_Security profile. The traffic is logged and the packets are captured for analysis in SmartView Tracker.

2. Malware Rule - All traffic in the network is inspected for bots and viruses according to the settings in the Recommend_Profile.

E-2.1 RnD Server - A global exception rule for the Server-1 object, that only detects the Backdoor.Win32.Shark.A protection.

E-2.2 Users_3 - An exception rule for the Users_3 Access Role, that only detects some protections.

Anti-Spam

Employees waste more and more time to sort through bulk emails commonly known as spam. The amount of resources (disk space, network bandwidth, CPU) devoted to handling spam also increases from year to year. In addition, unwanted emails continue to grow and can be an unexpected security threat to networks. Cyber-criminals can use emails to let viruses and malware into your network. The Anti-Spam and Mail Software Blade gives system administrators an easy and central tool to eliminate most of the spam that reaches their networks.

These are some of the Anti-Spam features. For more about using Anti-Spam, see the R76 Anti-Bot and Anti-Virus Administration Guide.

Enabling Anti-Spam

Use the Overview page in the Anti-Spam & Mail tab to enable Anti-Spam on a Security Gateway.

To enable Anti-Spam:

1. In the Anti-Spam & Mail tab, select Overview.
2. Click Anti-Spam.

   The Anti-Spam Enforcing Gateways window opens.

3. Select one or more Security Gateways.
4. Click OK.

Sample Configuration

The Zero hour malware protection feature is set to Off because enabling the feature has a negative effect on network performance.