You expect your next gen firewall
to protect you against malicious files such as malware, but with new malware
being released regularly as well as variants on existing malware?
How can you firewall keep up?
Do you need a security specialist to examine every single file?
No, of course not.
On a Palo Alto firewall.
This is handled with a feature called Wildfire.
In this video, we're going to see what this feature does
Malware
files are often well known when a file is downloaded.
The firewall generates a signature to represent the file.
This is checked against the e-signature database for known malicious files.
The signatures are updated regularly as part of the applications and threats
subscription, which you should be downloading on a regular basis.
If the file is a match for malicious signature, the file is blocked.
That's grateful malware.
That's well known.
But what about files that don't exist in the signatures database?
What if this is a new file that we've never seen before?
This is where Wildfire comes in.
Wildfire is Palo Alto is a cloud based sandbox environment.
A copy of a new file is sent to Wildfire
where it's safely executed and its behavior is checked.
The file is then given a classification which could be malicious,
phishing, gray or benign.
If it is determined to be malicious, a new file
manager is generated and added to Palo Alto database.
As mentioned earlier,
you and everyone else can download updated signatures regularly.
In this way, you are protected against new threats that you find
as well as new threats that other people find.
In addition, this information is used by Palo
Alto security team to gather additional intelligence.
This enables them to create lists of IPS,
domains, and URLs that are known for malicious activity.
You have two options when it comes to using wildfire.
The basic wildfire service is free on registered Palo Alto firewalls.
This service can only send files to wildfire
files on Windows executable files
as long as you have a threat prevention subscription.
You will get signature updates from Palo Alto every 24 to 48 hours.
The full wildfire subscription enables you to send other file types
to wildfire as well as receiving rapid signature updates.
That means you can get signature updates every 5 minutes.
Additionally, you get access to the wildfire API
as well as the option for hosting your own private cloud.
Wildfire Sandbox.
If you have the wildfire subscription,
you'll probably find that the default global settings are pretty good.
If you're using the free service,
you'll probably want to tune the configuration in the settings.
We can set the location of the sandbox,
which can be the public cloud and optionally the private cloud.
We can also set the size limits of files that we upload to the sandbox,
which is kind of interesting.
Malware files are generally smaller than the defaults listed here.
Anything bigger is likely to be a legitimate file,
but you might be wondering, why don't we send all files to wildfire?
Well, some files are very big,
and sending them all to some internet location is quite impractical.
Also, the firewall reserves some resources for this process.
If the limits are set to large, the resources will be exceeded
and real threats may be missed.
In these session information settings,
we see a list of information that we're willing to share with Palo Alto.
This information is used to build a list of malicious
IPS URLs and domains.
If you're particularly concerned
with privacy, you might want to review some of these settings.
And of course,
you need to have a wildfire profile that you can attach to a security policy.
This is where we define the types of files to submit, for example, files.
We also select the direction of transfer, which can be upload, download, or both.
And finally, the analysis type.
This will typically be public cloud unless you have a wildfire appliance
on your network
to confirm this is working.
We head over to the Monitor tab
where we can see files that have been sent to wildfire.
Looking at the verdict column
we can see the category that was assigned to the file.
This can be malicious gray where benign or phishing.
The action column shows whether the file was allowed or blocked
and the severity column shows how much of a threat the file was.
So now it's up to you.
Go out and try the wildfire config that you have seen here.
I hope you've enjoyed this video and I hope to see you in the next one.