Blocking a user in trusted zone from downloading files on the internet with macros

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Blocking a user in trusted zone from downloading files on the internet with macros

L2 Linker
Hey Guys,
So Follow me on this scenario if you would: User on their corp PC behind the trusted interface of the Palo goes to their personal web-based email, opens a bad email, and downloads a file with macros in it. How do I stop that, because the stateful function of the firewall will auto-permit the return traffic (in this case, the macro file) from the internet back through the untrust interface of the firewall and back to the user. That's a problem, obviously. Is there a way to set exceptions to the stateful function? For example: "All traffic sourced from the inside is auto-permitted back through the firewall UNLESS, it contains a macro?"
1 accepted solution

Accepted Solutions

L7 Applicator

"the stateful function of the firewall will auto-permit the return traffic" this is only true if you enable DSRI in the security policy, otherwise the firewall will inspect both c2s and s2c flows.

 

If the user checks their personal email, the traffic will be TLS encrypted, so you need to enable SSL decryption for the firewall to inspect the file download.

 

The file will be inspected by the Antivirus engine and if there is a match, the file will be blocked.

If it is not a match, it is useful to have a WildFire Analysis Profile in the policy as well, so that the file will be sent to WildFire for sandboxing. It may not block the file, but at the very least, you will receive a report in your WildFire Submission Logs indicating that a malicious file that wasn't blocked has been observed in transit to the user.

 

If the user runs Cortex XDR Endpoint protection, and a malicious verdict was made by WildFire before the user opens the file, then there is the likelihood that you may be able to stop execution with Cortex XDR Endpoint.

 

Otherwise, not allowing Macros to auto-run is always a good idea.

View solution in original post

1 REPLY 1

L7 Applicator

"the stateful function of the firewall will auto-permit the return traffic" this is only true if you enable DSRI in the security policy, otherwise the firewall will inspect both c2s and s2c flows.

 

If the user checks their personal email, the traffic will be TLS encrypted, so you need to enable SSL decryption for the firewall to inspect the file download.

 

The file will be inspected by the Antivirus engine and if there is a match, the file will be blocked.

If it is not a match, it is useful to have a WildFire Analysis Profile in the policy as well, so that the file will be sent to WildFire for sandboxing. It may not block the file, but at the very least, you will receive a report in your WildFire Submission Logs indicating that a malicious file that wasn't blocked has been observed in transit to the user.

 

If the user runs Cortex XDR Endpoint protection, and a malicious verdict was made by WildFire before the user opens the file, then there is the likelihood that you may be able to stop execution with Cortex XDR Endpoint.

 

Otherwise, not allowing Macros to auto-run is always a good idea.

  • 1 accepted solution
  • 2475 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!