The Threat Prevention Policy

In This Section: Workflow for Creating a Threat Prevention Policy To Learn More about Policy Packages Threat Prevention Policy Layers Threat Prevention Layers in Pre-R80 Gateways Threat Prevention Rule Base Parts of the Rules

Workflow for Creating a Threat Prevention Policy

Threat Prevention lets you customize profiles that meet the needs of your organization.

Ideally, you might want to set all protections to Prevent in order to protect against all potential threats. However, to let your gateway processes focus on handling the most important traffic and report only the most concerning threats, you need to determine the most effective way to apply the Threat Prevention settings.

When you define a new Threat Prevention profile, you can create a Threat Prevention Policy which activates only the protections that you need and prevents only the attacks that most threaten your network.

This is the high-level workflow to create and deploy a Threat Prevention policy:

1. Enable the Threat Prevention Software Blades on the Security Gateways.
2. Update the IPS database and Malware database with the latest protections.
3. Optional: Create Policy Packages.
4. Optional: For each Policy Package, create Threat Prevention Policy Layers.

   Note - For each Policy Layer, configure a Threat Prevention Rule Base with the Threat Prevention profile as the Action of the rule.

5. Install the Threat Prevention policy.

To Learn More about Policy Packages

To learn more about Policy Packages, see the R80.20 Security Management Administration Guide.

Threat Prevention Policy Layers

You can create a Threat Prevention Rule Base with multiple Policy Layers. Policy Layers help you organize your Rule Base to best suit your organizational needs. You can divide the Policy Layers by Software Blades, services or networks. Each Policy Layer calculates its action separately from the other Layers. In case of one Layer in the policy package, the rule enforced is the first rule matched. In case of multiple Layers:

• If a connection matches a rule in only one Layer, then the action enforced is the action in that rule.
• When a connection matches rules in more than one Layer, the gateway enforces the strictest action and settings.

Important - When Threat Emulation and Threat Extraction run in MTA mode, the gateway enforces the action of the first rule matched. It does not necessarily enforce the strictest rule.

Action Enforcement in Multiple-Layered Security Policies

These examples show which action the gateway enforces when a connection matches rules in more than one Policy Layers.

Example 1

	Data Center Layer	Corporate LAN Layer
Rule matched	Rule 3	Rule 1
Profile action	Prevent	Detect

Enforced action: Prevent

Example 2

	Data Center Layer	Corporate LAN Layer
Rule matched	Rule 3	Rule 1
Profile action	Prevent	Detect
Exception for protection X	Inactive	-

Enforced action for protection X: Detect

Example 3

	Data Center Layer	Corporate LAN Layer
Rule matched	Rule 3	Rule 1
Profile action	Prevent	Detect
Override for protection X	Detect	-
Exception for protection X	Inactive	-

Exception is prior to override and profile action. Therefore, the action for the Data Center Layer is Inactive.

The action for the Corporate LAN Layer is Detect.

Enforced action for protection X: Detect.

Example 4

	Data Center Layer	Corporate LAN Layer
Rule matched	Rule 3	Rule 1
Profile action	Deep Scan all files	Process specific file type families: Inspect doc files and Drop rtf files.

Enforced action: Deep Scan doc files and Drop rtf files.

Example 5

MIME nesting level and Maximum archive scanning time

The strictest action is:

Block combined with the minimum nesting level/scanning time, or

Allow combined with the maximum nesting level/scanning time, or

If both Block and Allow are matched, the enforced action is Block.

Example 6

UserCheck

	HR Layer	Finance Layer	Data Center Layer 3
Rule matched	Rule 3	Rule 1	Rule 4
Profile action	Detect	Prevent	Prevent
Configured page	Page A	Page B	Page C

The first Layer with the strictest action is enforced.

Enforced Action: Prevent with UserCheck Page B.

Creating a New Policy Layer

This section explains how to create a new Threat Prevention Policy Layer. You can configure reuse of Threat Prevention Policy Layers in different Policy Packages, and set different administrator permissions per Threat Prevention Layer.

To create a new Threat Prevention Layer:

1. In SmartConsole, go to Threat Prevention.
2. Right-click Policy and select Edit Policy.
3. In the General tab, go to Threat Prevention and click the + sign.
4. Select New Layer.

   The New Threat Prevention Layer window opens

5. Enter the Layer Name.
6. Optional: In the General tab, in the Sharing area, you can configure reuse of the layer in different policy packages. Select Multiple policies and rules can use this layer.

   Note - you cannot share the first Threat Prevention layer because it contains the MTA and ICAP rules. If this layer is shared with other policy packages then there can be conflicting MTA and ICAP rules in the same policy package.

7. In the Permissions tab, select the permission profiles that can edit this layer.

   Note - There is no need to add permission profiles that are configured to edit all layers.

8. Click OK.

To Learn More about Permission Profiles

To learn more about configuration of permission profiles, see the R80.20 Security Management Administration Guide.

Threat Prevention Layers in Pre-R80 Gateways

In pre-R80 versions, the IPS Software Blade was not part of the Threat Prevention Policy, and was managed separately. In R80.xx versions, the IPS Software Blade is integrated into the Threat Prevention Policy.

When you upgrade SmartConsole to R80.xx from earlier versions, with some Security Gateways upgraded to R80.xx, and other Security Gateways remaining in previous versions:

• For pre-R80 gateways with IPS and Threat Prevention Software Blades enabled, the policy is split into two parallel layers: IPS and Threat Prevention.

  To see which Security Gateway enforces which IPS profile, look at the Install On column in the IPS Layer.

• R80.xx gateways are managed separately, based on the R80 or higher Policy Layers.

Best Practice - For better performance, we recommend that you use the Optimized profile when you upgrade to R80 or higher from earlier versions.

Threat Prevention Rule Base

Each Threat Prevention Layer contains a Rule Base. The Rule Base determines how the system inspects connections for malware.

The Threat Prevention rules use the Malware database and network objects. Security Gateways that have Identity Awareness enabled can also use Access Role objects as the Protected Scope in a rule. The Access Role objects let you easily make rules for individuals or different groups of users.

There are no implied rules in this Rule Base, traffic is allowed or not allowed based on how you configure the Rule Base. For example, A rule that is set to the Prevent action, blocks activity and communication for that malware.

Parts of the Rules

The columns of a rule define the traffic that it matches and what is done to that traffic.

Number (No.)

The sequence of rules is important because the first rule that matches traffic according to a protected scope and profile is applied.

For example, if rules 1 and 2 share the same protected scope and a profile in rule 1 is set to detect protections with a medium confidence level and the profile in rule 2 is set to prevent protections with a medium confidence level, then protections with a medium confidence level will be detected based on rule 1.

Name

Give the rule a descriptive name. The name can include spaces.

Double-click in the Name column of the rule to add or change a name and click OK.

Protected Scope

Threat Prevention rules include a Protected Scope parameter. Threat Prevention inspects traffic to and/or from all objects specified in the Protected Scope, even when the specified object did not open the connection. This is an important difference from the Source object in Firewall rules, which defines the object that opens a connection.

For example, the Protected Scope includes a Network Object named MyWebServer. Threat Prevention inspects all files sent to MyWebServer for malware threats, even if MyWebServer did not open the connection.

Protected Scope objects can be:

• Network objects, such as Security Gateways, clusters, servers, networks, IP ranges, and so on
• Network object groups
• IP address ranges
• Roles
• Zones

You can set the Protected Scope parameter to Any. This option lets Threat Prevention inspect traffic based on the direction and interface type as defined by the Profile assigned to the applicable rule. By default, the predefined Optimized Rule sets the Protection Scope to Any.

Traffic Direction and Interface Type Settings

You can configure the traffic direction and Security Gateway interface types that send files to Threat Prevention for inspection. You do this in the Protected Scope section of the Anti-Virus or Threat Emulation Settings window. The options are:

• Inspect incoming files from:

  Sends only incoming files from the specified interface type for inspection. Outgoing files are not inspected. Select an interface type from the list:

  • External - Inspect incoming files from external interfaces. Files from the DMZ and internal interfaces are not inspected.
  • External and DMZ - Inspect incoming files from external and DMZ interfaces. Files from internal interfaces are not inspected.
  • All - Inspect all incoming files from all interface types.
• Inspect incoming and outgoing files - Sends all incoming and outgoing files for inspection.

When you select the Any option in the Protected Scope section of a rule, the traffic direction and interface type are defined by the Profile assigned to that rule. If you add objects to the Protected Scope in a rule, files that match these objects are inspected for all connections.

Using Protected Scope with SPAN and TAP Configurations

The default global parameter for SPAN and TAP configuration is set to inspect all. You can use these commands to configure the Security Gateway to use the Protected Scope settings for SPAN and TAP with Threat Emulation.

• fw ctl set int - Changes current Protected Scope settings for SPAN and TAP, does not survive reboot
• Change $FWDIR/module/fwkern.conf - This changes the settings after reboot.

Run these commands to set the SPAN port to use the Policy instead of the global default setting (inspect all):

# fw ctl set int te_handle_span_port_interfaces_according_to_topolgy 1 # echo “te_handle_span_port_interfaces_according_to_topolgy=1” >> $FWDIR/module/fwkern.conf

Limitations and Troubleshooting

• If no topology is defined for the Security Gateway interfaces, all traffic is inspected or sent for emulation
• When you upgrade from R76 and earlier, the Inspect incoming files option is set to All by default
• When the topology of the interfaces is defined and you are using SPAN or TAP modes, it is possible that some of the connections are not defined correctly

Protection

The Protection/Site column shows the protections for the Threat Prevention policy.

• For rules, this field is always set to n/a and cannot be changed. Protections for Rule Base rules are defined in the configured profile (in the Action column).
• For rule exceptions and exception groups, this field can be set to one or more specified protections.

To add a protection to an exception:

1. In SmartConsole, select Security Policies > Threat Prevention.
2. From the navigation tree, select a Policy Layer.
3. Right-click the rule and select New Exception.

   An exception sub-rule is added to the policy.

4. Right-click the Protection/Site cell and select Add new items.
5. From the list of Anti-Bot, Anti-Virus, or IPS protections, click the add button of protections to add to the exception.

   The protections are added to the exception sub-rule.

6. Install Policy.

To search for a malware in the Protection viewer:

1. Put your mouse in the Protection/Site column and click the plus sign to open the Protection viewer.
2. Select the protection category.
3. Enter the malware name in the search field.

Action

Action refers to how traffic is inspected.

• For rules, this is defined by the profile. The profile contains the configuration options for different confidence levels and performance impact.
• For rule exceptions and exception groups, the action can be set to Prevent or Detect.

To select a profile for a rule:

1. Click in the Action column.
2. Select an existing profile from the list, create a new profile, or edit the existing profile.

Threat Prevention Track Options

• None - Do not generate an alert.
• Alert - Generate a log and run a command, such as display a popup window, send an email alert or an SNMP trap alert, or run a user-defined script as defined in the Menu > Global Properties > Log and Alert > Alerts.
• Packet Capture - Adds raw IPS, Anti-Virus, Anti-Bot, Threat Emulation and Threat Extraction packet data to the Threat Prevention logs. Only blocked packets are added.

Install On

Select the gateways on which to install the rule. The default is All (all gateways that have a Threat Prevention blade enabled). Put your mouse in the column and a plus sign shows. Click the plus sign to open the list of available gateways and select. If you right-click a column in the table, you can add more columns to the table from the list that shows.