topic Re: name that security profile in General Topics

name that security profile

jdprovine — Wed, 26 Sep 2018 16:48:28 GMT

I am looking for a more descriptive name for my security profile ? I have vulnerablity protection, anit-virus, anti-spyware and wildfire included on the profile that I have added to a majority of my rule. currently it is name All PE alert

Re: name that security profile

Mick_Ball — Wed, 26 Sep 2018 17:57:26 GMT

Hows about the “Brexit” profile...

looks and sounds impressive but deep down its actually causes more grief than its worth.....

Topical i know.......

let me know if i can be of any further assistance.

Re: name that security profile

BPry — Wed, 26 Sep 2018 18:47:28 GMT

@jdprovine,

WhateverOrg-Default-Profile - Applied to most security rules.

ICanSeeYou - Logging rule that litterally logs everything

HIPAA - Special profile built out for HIPAA Servers

Server - Special Profile built out for Datacenter Servers

Just a few examples. The name itself doesn't really matter as long as you, and anyone else that builds policies, actually know what it does. You could you ThouShallNotPass and it doesn't matter as long as everyone that needs to know what ThouShallNotPass is used for is in the loop.

Re: name that security profile

jdprovine — Wed, 26 Sep 2018 19:11:11 GMT

@BPry @Mick_Ball

Yea the name that it is currently set to is "Alert on PE files" doesn't make sense to me when you are doing antiviru, antispyware, vulnerablity and wildfire. I am trying to find what I believe is a better name, we have the free version of widlfire which only alerts on PE files and that is what that name makes me think, that it is only being used for wildfire

Re: name that security profile

jdprovine — Wed, 26 Sep 2018 19:13:04 GMT

@Mick_Ball

Is Brexit code for breaks it? If it is as always you crack me up

Re: name that security profile

BPry — Wed, 26 Sep 2018 19:26:04 GMT

@jdprovine,

More then likely it was only configured as a Wildfire policy group to begin with. Then as they moved to the PA in earnest they just kept adding additional profiles to that group. I'd revisit the name and just call it something that appears as "this is our default profile", however that actually takes shape as the name goes.

Re: name that security profile

jdprovine — Wed, 26 Sep 2018 19:30:00 GMT

@BPry

No actually the other way around it was called logall originally, I added wildfire later and then it was renamed last week to the name I mentioned which to me only addressed the wildfire portion of the profile not the other aspects. But i can't think of another name that would cover all and not be a huge name LOL. So I was hoping someone would have a good name idea for me LOL

So you agree with me that alert on PE files sounds like wildfire

Re: name that security profile

BPry — Wed, 26 Sep 2018 19:33:59 GMT

@jdprovine,

Ya, I wouldn't assume that this was your 'general' profile group. I would have actually assumed that this was a data filtering profile just looking at the name, not even a WildFire profile.

Re: name that security profile

jdprovine — Wed, 26 Sep 2018 19:37:22 GMT

@BPry

So are you saying that "alert on PE files" makes it sound like it is doing only PE files and not doing antivirus, anitspyware, vulnerablity and wildfire but only PE

Re: name that security profile

Mick_Ball — Wed, 26 Sep 2018 19:47:48 GMT

@jdprovine, no... sorry... nothing to do with breaks it... its a UK topical joke, probably wasted here....

laters....

Re: name that security profile

jdprovine — Wed, 26 Sep 2018 19:47:59 GMT

@BPry @Mick_Ball

What if I called it security profile? Or better yet anti_bad_stuff_profile

Re: name that security profile

jdprovine — Fri, 28 Sep 2018 19:30:54 GMT

@BPry @MickBall @reaper

Round two

So we have a group security profile, named Alert on PE files. The profiles associated with this group profile are Antivirus - set to block, Antispyware - set to block, Vulnerability protection, File blocking profile - set to Alert for PE Files and wildfire analysis profile. So the strategy was to name it for the only profile that was set to alert. Let me know if that makes sense and the best way to name it Here is a pic of the group profile config

Re: name that security profile

Remo — Sat, 29 Sep 2018 20:54:16 GMT

@jdprovine

What about the crypto version here 😛

SPG_BL-AV-AS_LO-VUL-FBPE_WFPE

SPG = Security Profile Group
BL-AV-AS = Block Antivirus and Antispyware
LO-VUL-FBPE = Log Only Vulnerabilities and File Blocking PE Files
WFPE = Wildfire Forwarding for PE files

But you probably should find a name (mentionned by @BPry) that somehow fits your environment and where you and the others that create policies know what it means.

Is this your profile group that you use for most of the policies or a profile for some specific servers/protocols/connections?

Re: name that security profile

jdprovine — Mon, 01 Oct 2018 12:34:15 GMT

@Remo

Yes this is the profile group that is used for a majority of our rules. I think the name is too narrow but at this point I can't think of a better one that covers all of what is going on in the group profile without it being too long