Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'

LucaMarchiori — Mon, 15 Jan 2018 16:16:58 GMT

Specifically for:

38407 (TLS Network Security Protocol Information Disclosure Vulnerability - ROBOT)

31127 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)

30276 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)

action is to 'alert' only. The last two vulns are severity 'critical'. Should we create exceptions and block these connections?

Re: Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'

BPry — Tue, 16 Jan 2018 13:28:04 GMT

@LucaMarchiori,

Most of the new alerts are set to 'alert' following introduction. While I can't speak for PA, I suspect this was due to past signatures causing issues in certain enviroments with the default action actually taking action on this traffic. You'll notice that most new signatures will be modified in the next one or two updates to a proper default action.

Personally I recommend that users completely override severity high and critical to something applicable to their enviroment; for example I simply reset all 'high' and 'critical' connections and have the syslog sent to my MineMeld server so that they can be blocked automatically unless they are included in my whitelist. If that isn't applicable to your enviroment, then I would highly suggest that you create exceptions and block all of the listed signatures.

topic Re: Spectre / Meltdown vulnerabilities - why are default actions set to 'alert' in General Topics

Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'

Re: Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'