topic Re: Best practice for blacklisting App-IDs in General Topics

Best practice for blacklisting App-IDs

jambulo — Fri, 22 Apr 2016 14:35:01 GMT

What is the best practice for blacklisting potentially harmful Application ID's(from "trust" to "untrust" over 80/443)?

I started blocking on specific App-ID's, but maintaining this blacklist per App-ID will be kind of cumbersome.

I'm thinking about using Application Filters to block based on Application subcategory. The only issue here is if I wanted to block say the "encrypted-tunnel", it will block common applications like "ssl".

Re: Best practice for blacklisting App-IDs

bmorris1 — Fri, 22 Apr 2016 14:53:44 GMT

Hi jambulo,

Ideally you would want to allow only the applications you want in your network, everything else will fall down to the default interzone rule and be denied. If you implement decryption then you'll have better visibility on the 443 SSL applications.

hope this helps,

Ben

Re: Best practice for blacklisting App-IDs

jambulo — Fri, 22 Apr 2016 17:47:37 GMT

When allowing your users out to the internet, are you specifying each App-ID that they can use? Or do you allow anything on 80/443, then block the known bad App-IDs?

Ideally, it would be nice to specify each App-ID allowed out to the internet, but that would be a management nightmare.

Re: Best practice for blacklisting App-IDs

Brandon_Wertz — Sun, 24 Apr 2016 03:29:34 GMT

Given that Palo can classify over 2400 applications it seems you'd be better off "Whitelsiting" applications versus trying to blacklist them.

Re: Best practice for blacklisting App-IDs

pulukas — Sun, 24 Apr 2016 11:40:16 GMT

I think you have a good grasp of the issues with both approaches.

The whitelist only that which is allowed does can be difficult to implement the first time. This is especially true on a large or diverse user base. Finding out all the allowed applications and getting them onto the white list can take time. And in the process impede productivity and generate anger at IT in the user base along with a lot of help desk tickets. But companies use this approach because it will give them the best protection and visibility in the long run. And once the white list is finalized there are fewer hours spent because the policies are well known by this point and only need to change with new application needs.

The blacklist approach gives you a quick start to stopping the higher risk behavior. But as you note this can also be a permanent work load basically never ends. You have to keep up to date and review the new applications even after you have done the first task of choosing amoung the thousands of apps which to block.

Basically every company has to choose the appoarch that will work best for their situation.