Device Security
Apply a Virtual Patch to Risky Assets
Table of Contents
Apply a Virtual Patch to Risky Assets
Create Security policy rules to apply virtual patches to risky assets.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of the following subscriptions:
|
To apply a virtual patch to risky assets, you create a Security
Policy Rule. Applying a virtual patch requires an account with
the Superuser role.
To begin, in Device Security in Strata Cloud Manager,
navigate to
In the Risk Score table, click View More to
expand the table and review active vulnerabilities.
Verify Firewall Status
When viewing a vulnerability with an available Threat Signature,
you may need to update your firewalls before you can apply a
virtual patch.
- Choose a vulnerability with a Threat Signature and view the virtual patching vulnerability information.In the Mitigate the vulnerability risk section, look for a warning to "Verify Threat Prevention License and/or the Application and Threat Content Update Version on your firewalls."If there is no warning, you can skip to Create a Security Policy Rule.In the warning, click View Details to bring up the Warning pop-up.The pop-up displays all firewalls managed by Strata Cloud Manager which don't have an active Threat Prevention license with the latest Applications and Threats content version to leverage the Threat Signature. The table includes information about the current content version on each firewall, as well as the first release and the last update which contain the threat signature for the vulnerability. The current content version needs to match the last update.Click View Firewalls to go to the Device Management page in Strata Cloud Manager.This takes you out of Device Security and to the firewall management page in Strata Cloud Manager, where you can configure Threat Prevention and update your Applications and Threats content version.
Create a Security Policy Rule
You can apply a virtual patch by creating Security Policy Rules based on recommended behaviors detected by Device Security.- Choose the vulnerability that you want to create a Security policy rule for and view the virtual patching vulnerability information.In the Mitigate the vulnerability risk section, click Create Security Policy Rules to go to the page for the associated device profile.Click .Optional Filter the profile behaviors based on the direction you want to create a Security policy rule for.You can filter by inbound, outbound, or both directions.Select the profile behaviors you want to create a Security Policy Rule for, and then click Next to go to the Policy Configuration page of the workflow.In the Configure Security Policy Rules section, select Folders or Snippets, and then select the specific Location or Snippet for the Configuration Scope.Select the Profile Group.Select Security Rules to see configuration options, and then define the Source Zone, Destination Zone, Service, or Tag for the behavior that you want to create a rule for.Click Next to to to the Review page of the workflow.Optional Click the Edit (pencil) icon on each row to change the Security policy rule name.Security policy rules need to have unique names. The system generates a unique name that you can change to suit your needs.Click Create to send the Security policy rule configuration to Strata Cloud Manager and bring up the Security Policy Rules Created popup.From the Security Policy Rules Created popup, you can edit your Security policy rules or update the vulnerability status on your devices.Click Review or edit security policies to open the Security Policy page in Strata Cloud Manager in a new tab and view your Security Policies.Resolve the vulnerability or add a comment in the Change Status section to complete the virtual patching workflow.
- Choose whether to Resolve: Vulnerability Mitigated or Do not resolve.Choosing Resolve: Vulnerability Mitigated means that you applied compensating controls (Security policy rules). This removes the contribution of the vulnerability towards the affected devices' risk scores and means that Device Security will no longer monitor this vulnerability on these devices.Add a comment to describe the action taken.Go Back to the Asset Dashboard and verify that the vulnerability for that profile no longer appears in the Risk Score list.
