Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'

Reply
Highlighted
L3 Networker

Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'

Specifically for:

 

38407 (TLS Network Security Protocol Information Disclosure Vulnerability - ROBOT)

31127 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)

30276 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)

 

action is to 'alert' only.  The last two vulns are severity 'critical'.  Should we create exceptions and block these connections?

 

 

 

L7 Applicator

Re: Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'

@LucaMarchiori,

Most of the new alerts are set to 'alert' following introduction. While I can't speak for PA, I suspect this was due to past signatures causing issues in certain enviroments with the default action actually taking action on this traffic. You'll notice that most new signatures will be modified in the next one or two updates to a proper default action. 

 

Personally I recommend that users completely override severity high and critical to something applicable to their enviroment; for example I simply reset all 'high' and 'critical' connections and have the syslog sent to my MineMeld server so that they can be blocked automatically unless they are included in my whitelist. If that isn't applicable to your enviroment, then I would highly suggest that you create exceptions and block all of the listed signatures. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!