Spectre / Meltdown vulnerabilities - why are default actions set to 'alert'

[LucaMarchiori]

Specifically for:

38407 (TLS Network Security Protocol Information Disclosure Vulnerability - ROBOT)

31127 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)

30276 (Multiple CPUs Side-Channel Information Disclosure Vulnerability - Spectre - Meltdown)

action is to 'alert' only.  The last two vulns are severity 'critical'.  Should we create exceptions and block these connections?

[BPry · Accepted solution]

@LucaMarchiori,

Most of the new alerts are set to 'alert' following introduction. While I can't speak for PA, I suspect this was due to past signatures causing issues in certain enviroments with the default action actually taking action on this traffic. You'll notice that most new signatures will be modified in the next one or two updates to a proper default action. 

Personally I recommend that users completely override severity high and critical to something applicable to their enviroment; for example I simply reset all 'high' and 'critical' connections and have the syslog sent to my MineMeld server so that they can be blocked automatically unless they are included in my whitelist. If that isn't applicable to your enviroment, then I would highly suggest that you create exceptions and block all of the listed signatures.