topic Re: Thoughts on a set of application rules? in General Topics

Thoughts on a set of application rules?

BobW — Thu, 09 Jul 2015 22:14:21 GMT

I was messing around in the interface today and had a thought as for rules and am curious what other might think.

I created a group of rules for a particular zone/AD User group. Something like this

Allow but do not log (DNS for example)

Allow these apps (Appgrp--custom application group)

Allow risk1 (custom app filter includes all "risk 1" apps)

Allow risk2 (custom app filter includes all "risk 2" apps)

Allow risk3 (custom app filter includes all "risk 3" apps)

Allow risk4 (custom app filter includes all "risk 4" apps)

Deny risk5 (custom app filter includes all "risk 5" apps)

Block all

My thinking is that I could monitor Risk 3,4,5 and add the appropriate apps to the custom app group "Appgrp" and eventully make levels 4 and 5 (possible risk 3) deny rules.

Any thoughts would be appreciated,

Bob

Re: Thoughts on a set of application rules?

bmorris1 — Tue, 14 Jul 2015 01:20:08 GMT

Hi BobW,

It is an interesting take on using the risk value. In my experience we tend to only be interested in the risk value when looking into reports and what applications we have running on our networks (like a big fat red block for bit-torrent in the new ACC).

I would advise in taking a look at the security policy fundamentals documents

Fundamentals Guide: Security Policies

and also keeping a keen eye on the application and threats release notes. With PanOS 7, a new feature has been implemented in which you can see what modifications a new version will have to your device.

Let us know how you get on.

Thanks,

Ben

Re: Thoughts on a set of application rules?

pulukas — Tue, 14 Jul 2015 12:16:57 GMT

The other consideration here is business risk for false positive blocks. Applications that are business critical my need to be treated with kid gloves on their action with threat profiles. Setting the action to alert rather than block to prevent fals positives from blocking critical workflows.

After which you need a regular procedure to review the alerts and insure all is well with the affected workstations.