Create Best Practice Security Profiles for the Internet Gateway
Most malware sneaks onto the network in legitimate applications
or services. Therefore, to safely enable applications you must scan
all traffic allowed into the network for threats. To do this, attach
security profiles to all Security policy rules that allow traffic
so that you can detect threats—both known and unknown—in your network
traffic. The following are the recommended best practice settings
for each of the security profiles that you should attach to every
Security policy rule on your internet gateway policy rulebase.
Consider adding the best practice security
profiles to a default security profile group so that
it will automatically attach to any new Security policy rules you
create.
Best Practice Internet Gateway File Blocking Profile
Use these File Blocking settings as a best practice at
your internet gateway.
Use the predefined strict file blocking profile to block files that
are commonly included in malware attack campaigns and that have
no real use case for upload/download. Blocking these files reduces
the attack surface. The predefined strict profile blocks batch files,
DLLs, Java class files, help files, Windows shortcuts (.lnk), BitTorrent
files, .rar files, .tar files, encrypted-rar and encrypted-zip files,
multi-level encoded files (files encoded or compressed up to four
times), .hta files, and Windows Portable Executable (PE) files,
which include .exe, .cpl, .dll, .ocx, .sys, .scr, .drv, .efi, .fon,
and .pif files. The predefined strict profile alerts on all other file
types for visibility into other file transfers so that you can determine
if you need to make policy changes.
In some cases, the need to support critical applications
may prevent you from blocking all of the strict profile’s file types.
Review the data filtering logs ()
to identify file types and talk with business stakeholders about
the file types their applications require. Based on this information,
if necessary, clone the strict profile and modify it as needed to
allow only the other file type(s) that you need to support the critical applications.
You can also use the Direction setting to restrict files types from
flowing in both directions or block files in one direction but not
in the other direction.
Why do I need this profile?
There are
many ways for attackers to deliver malicious files: as attachments
or links in corporate email or in webmail, links or IMs in social
media, Exploit Kits, through file sharing applications (such as
FTP, Google Drive, or Dropbox), or on USB drives. Attaching the
strict file blocking profile reduces your attack surface by preventing
these types of attacks.
What if I can’t block all of the file types covered
in the predefined strict profile?
If you have mission-critical
applications that prevent you from blocking all of the file types
included in the predefined strict profile, you can clone the profile
and modify it for those users who must transfer a file type covered
by the predefined profile. If you choose not to block all PE files
per the recommendation, make sure you send all unknown files to
WildFire for analysis. Additionally, set the Action to continue
to prevent drive-by downloads, which is when an end user downloads content
that installs malicious files, such as Java applets or executables,
without knowing they are doing it. Drive-by downloads can occur
when users visit web sites, view email messages, or click into pop-up
windows meant to deceive them. Educate your users that if they are
prompted to continue with a file transfer they didn’t knowingly
initiate, they may be subject to a malicious download. In addition,
using file blocking in conjunction with URL filtering to limit the
categories in which users can transfer files is another good way
to reduce the attack surface when you find it necessary to allow
file types that may carry threats.
Best Practice Internet Gateway Antivirus Profile
Use these Antivirus security profiles settings as a best
practice at your internet gateway.
Clone the default Antivirus profile, modify it as shown, and
attach it to all Security policy rules that allow traffic. The Antivirus
profile has decoders that detect and prevent viruses and malware
from being transferred over six protocols: HTTP, SMTP, IMAP, POP3,
FTP, and SMB. You can set WildFire actions for all six protocols
because the Antivirus profile also enforces actions based on WildFire
signatures.
Configure the cloned best practice Antivirus profile to reset
both the client and the server for all six protocol decoders and
WildFire actions, and then attach the profile to the Security policy
allow rules.
Why do I need this profile?
By attaching
Antivirus profiles to all Security rules you can block known malicious
files (malware, ransomware bots, and viruses) as they are coming
into the network. Common ways for users to receive malicious files
include malicious attachments in email, links to download malicious
files, or silent compromise facilitated by Exploit Kits that exploit
a vulnerability and then automatically download malicious payloads
to the end user’s device.
Best Practice Internet Gateway Vulnerability Protection Profile
Use these Vulnerability Protection security profile settings
as a best practice at your internet gateway.
Attach a Vulnerability Protection profile to all
allowed traffic to protect against buffer overflows, illegal code
execution, and other attempts to exploit client- and server-side
vulnerabilities. The best practice profile is a clone of the predefined
Strict profile, with single packet capture (PCAP) settings enabled
to help you track down the source of any potential attacks.
Why do I need this profile?
Without strict
vulnerability protection, attackers can leverage client- and server-side
vulnerabilities to compromise end-users. For example, an attacker
could leverage a vulnerability to install malicious code on client
systems or use an Exploit Kit (Angler, Nuclear, Fiesta,
KaiXin) to automatically deliver malicious payloads to the end user.
Vulnerability Protection profiles also prevent an attacker from
using vulnerabilities on internal hosts to move laterally within
your network.
Don’t enable PCAP for informational activity
because it generates a relatively high volume of that traffic and
it’s not particularly useful compared to potential threats. Apply
extended PCAP (as opposed to single PCAP) to high-value traffic
to which you apply the
alert
Action. Apply
PCAP using the same logic you use to decide what traffic to log—take
PCAPs of the traffic you log. Apply single PCAP to traffic you block.
The default number of packets that extended PCAP records and sends
to the management plane is five packets, which is the recommended
value. In most cases, capturing five packets provides enough information to
analyze the threat. If too much PCAP traffic is sent to the management
plane, then capturing more than five packets may result in dropping PCAPs.Best Practice Internet Gateway Anti-Spyware Profile
Use these Anti-Spyware security profile settings as a
best practice at your internet gateway.
Attach an Anti-Spyware profile to all allowed traffic
to detect command and control traffic (C2) initiated from malicious
code running on a server or endpoint and prevent compromised systems
from establishing an outbound connection from your network. To create
the best practice profile, clone the predefined strict Anti-Spyware
profile. Edit the profile to enable DNS sinkhole and packet capture
to help you track down the endpoint that attempted to resolve the
malicious domain. The best practice Anti-Spyware profile retains
the default
Action
to reset the connection
when the firewall detects a medium, high, or critical severity threat,
and enables single packet capture (PCAP) for those threats.
Don’t enable PCAP for informational activity because it generates
a relatively high volume of that traffic and it’s not particularly
useful compared to potential threats. Apply extended PCAP (as opposed
to single PCAP) to high-value traffic to which you apply the
alert
Action.
Apply PCAP using the same logic you use to decide what traffic to
log—take PCAPs of the traffic you log. Apply single PCAP to traffic
you block. The default number of packets that extended PCAP records
and sends to the management plane is five packets, which is the
recommended value. In most cases, capturing five packets provides
enough information to analyze the threat. If too much PCAP traffic
is sent to the management plane, then capturing more than five packets
may result in dropping PCAPs.The best practice
Action on DNS Queries
is
to block or to sinkhole DNS queries for known malicious
domains. It is also a best practice to enable PCAPs.Enabling DNS sinkhole identifies potentially compromised hosts
that attempt to access suspicious domains by tracking the hosts
and preventing them from accessing those domains. Enable DNS sinkhole
when the firewall can’t see the originator of the DNS query (typically
when the firewall is north of the local DNS server) so that you
can identify infected hosts. Don’t enable DNS sinkhole when the
firewall can see the originator of the DNS query (typically when
the firewall is south of the local DNS server; in this case, the
firewall’s blocking rules and logs provide visibility into the traffic)
or on traffic you block.
Best Practice Internet Gateway URL Filtering Profile
Use these URL Filtering security profile settings as
a best practice at your internet gateway.
As a best practice, use PAN-DB URL filtering to prevent access to web
content that is at high-risk for being malicious. Attach a URL Filtering profile to all rules that
allow access to web-based applications to protect against URLs that
have been observed hosting malware or exploitive content.
The best practice URL Filtering profile sets all known dangerous
URL categories to block. These include command-and-control, copyright-infringement, dynamic-dns,
extremism, malware, phishing, proxy-avoidance-and-anonymizers, unknown,
newly-registered-domain, grayware, and parked. Failure to block
these dangerous categories puts you at risk for exploit infiltration,
malware download, command and control activity, and data exfiltration.
In addition to blocking known bad categories, you should also
alert on all other categories so that you have visibility into the
sites your users are visiting. If you need to phase in a block policy,
set categories to continue and create a custom response page to educate
users on your acceptable use policies and alert them to the fact
that they are visiting a site that may pose a threat. This will
pave the way for you to outright block the categories after a monitoring
period.
If you are running PAN-OS 8.1.10 or later, ensure that the firewall
handles user web requests as securely as possible by enabling the
option to hold client requests (
set system setting ctd hold-client-request yes
).
By default, the firewall allows requests while it looks up an uncached
URL category in PAN-DB and then enforces
the appropriate policy when the server responds. Maximize security
by opting to hold requests during this lookup. For details, see Configure URL Filtering.What if I can’t block all of the recommended categories?
If
you find that users need access to sites in the blocked categories,
consider creating an allow list for just the specific sites, if
you feel the risk is justified. On categories you decide to allow,
make sure you set up credential phishing prevention to
ensure that users aren’t submitting their corporate credentials
to a site that may be hosting a phishing attack.
Allowing
traffic to a recommended block category poses the following risks:
- malware—Sites known to host malware or used for command and control (C2) traffic. May also exhibit Exploit Kits.
- phishing—Known to host credential phishing pages or phishing for personal identification.
- dynamic-dns—Hosts and domain names for systems with dynamically assigned IP addresses and which are oftentimes used to deliver malware payloads or C2 traffic. Also, dynamic DNS domains do not go through the same vetting process as domains that are registered by a reputable domain registration company, and are therefore less trustworthy.
- unknown—Sites that have not yet been identified by PAN-DB, perhaps because they were just registered. However, oftentimes these are sites that are generated by domain generation algorithms and are later found to exhibit malicious behavior.
- newly-registered-domain—Newly registered domains are often generated purposely or by domain generation algorithms and used for malicious activity.
- command-and-control—Command-and-control URLs and domains used by malware and/or compromised systems to surreptitiously communicate with an attacker's remote server to receive malicious commands or exfiltrate data.
- copyright-infringement—Domains with illegal content, such as content that allows illegal download of software or other intellectual property. This category was introduced to enable adherence to child protection laws required in the education industry as well as laws in countries that require internet providers to prevent users from sharing copyrighted material through their service.
- extremism—Websites promoting terrorism, racism, fascism or other extremist views discriminating people or groups of different ethnic backgrounds, religions or other beliefs. This category was introduced to enable adherence to child protection laws required in the education industry.
- proxy-avoidance-and-anonymizers—URLs and services often used to bypass content filtering products.
- grayware—Websites and services that do not meet the definition of a virus but are malicious or questionable and may degrade device performance and cause security risks. Prior to Content release version 8206, the firewall placed grayware in either the malware or questionable URL category. If you are unsure about whether to block grayware, start by alerting on grayware, investigate the alerts, and then decide whether to block grayware or continue to alert on grayware.
- parked—Domains registered by individuals, oftentimes later found to be used for credential phishing. These domains may be similar to legitimate domains, for example, pal0alto0netw0rks.com, with the intent of phishing for credentials or personal identify information. Or, they may be domains that an individual purchases rights to in hopes that it may be valuable someday, such as panw.net.
Best Practice Internet Gateway WildFire Analysis Profile
Use these WildFire Analysis security profile settings
as a best practice at your internet gateway.
While the rest of the best practice security profiles
significantly reduce the attack surface on your network by detecting
and blocking known threats, the threat landscape is ever changing
and the risk of unknown threats lurking in the files we use daily—PDFs,
Microsoft Office documents (.doc and .xls files)—is ever growing.
And, because these unknown threats are increasingly sophisticated
and targeted, they often go undetected until long after a successful
attack. To protect your network from unknown threats, you must configure
the firewall to forward files to WildFire for analysis. Without
this protection, attackers have free reign to infiltrate your network
and exploit vulnerabilities in the applications your employees use everyday.
Because WildFire protects against unknown threats, it is your greatest defense
against advanced persistent threats (APTs).
Set up WildFire appliance content updates to
download and install automatically every minute so that you always
have the most recent support. For example, support for Linux and
SMB files were first delivered in WildFire appliance content updates.
The best practice WildFire Analysis profile sends all files
in both directions (upload and download) to WildFire for analysis.
Specifically, make sure you are sending all PE files (if you’re
not blocking them per the file blocking best practice), Adobe Flash
and Reader files (PDF, SWF), Microsoft Office files (PowerPoint,
Excel, Word, RTF), Java files (Java, .CLASS), and Android files
(.APK).
