topic Re: Default Action for SQL Injection Attacks in Advanced Threat Prevention Discussions

Default Action for SQL Injection Attacks

djr — Thu, 18 Oct 2018 12:09:58 GMT

Following a sudden spike in SQLMap threats, I was looking at the default action for SQL injection threats and I noticed that it is is only an "alert" which seems odd for that kind of attack. Has anyone looked deeper into this and/or changed the action and is there a reason for this not being a reset/drop action?

Re: Default Action for SQL Injection Attacks

OtakarKlier — Fri, 19 Oct 2018 20:45:54 GMT

Hello,

While it is by deafult sert to alert, I found its best to block threats by Severity. As you can see by the picture, this Vulnerability Protection Profile, when added to a Policy, will reset the traffic so it cannot cause any damage:

I hope this makes sense.

Regards,

Re: Default Action for SQL Injection Attacks

djr — Mon, 22 Oct 2018 11:16:53 GMT

Hi,

We already reset Critical and high, but use the PAN default below that so the difference between your profile and ours is really just that you extend that down to medium.

I see you also use the default action for low and info which is probably for the same reason we do - some of the low and info threats are by default blocked which we found odd. The PAN severity classification seems a bit weird which is why I was asking if anyone knew a reason why SQL injection was only an alert by default - if the detection is robust I would expect this to be a block by default.

Re: Default Action for SQL Injection Attacks

OtakarKlier — Mon, 22 Oct 2018 17:04:07 GMT

Hello,

I would recommend setting the medium to also reset or block. There are going to be some exceptions, at least there are in my environemtn so I had to create special exception cases for them.

Regards,

Re: Default Action for SQL Injection Attacks

djr — Tue, 23 Oct 2018 09:47:50 GMT

OK thanks, I will look a bit closer at what other medium level threats we are seeing, with a view to doing that.

Many thanks

Re: Default Action for SQL Injection Attacks

Raido_Rattameister — Fri, 02 Nov 2018 21:47:03 GMT

Leaving medium to default allows so much bad stuff through.

I have even low severety set to reset-both with only 3 manual exeptions in there for traffic sourcinf from wan and handful more for internal traffic.

Re: Default Action for SQL Injection Attacks

djr — Mon, 05 Nov 2018 09:28:50 GMT

Thanks, I don't think I will go that far just yet, but have put medium to reset-both for spyware and vulnerabilities.