Not entirely true (regarding the not the first hour)... the point of wildfire is not to protect but to detect 0days. This gives that in order to protect the client you will completely block downloads of exe (as example). But in case you want the client to download exe files (which might be bad) you now shrink the detection time of 1-4 weeks (compared to AV signatures downloaded to your PA device or for that matter any AV solution) down to less than 1 hour in case this bad file was detected elsewhere. And less than a few minutes in case this bad file was detected by your own equipment. I think at the same time its vital to get this difference when using wildfire that wildfire wont download, buffer, scan and then let the file through. The file will hit the client as without wildfire but now you will at least get a report that this file was bad. As a feature request one could ask for ICAP support. This way you could do the download, buffer, scan and then let through. The downside is that the mgmtplane will be involved even more with the problems that buffered scans gives you in terms of max file size to scan but also that the client will get a "loading..." page instead of the file itself until its fully scanned (or in terms of PA analyzed by sandbox) and that the buffered scan isnt possible for all protocols (on the other hand buffered scan can be applied for all filetypes compared to PA's streambased scan which only works for a few filetypes). So in short you should see the wildfire service as an improvement from the regular 1-4 weeks for detection down to max 1 hour (or even minutes if found by your own equipment). And if further security is needed you should consider to completely block clients from downloading stuff from the internet (like exe-files etc) or file a feature request of ICAP support (to cover the buffered scan stuff). Another drawback of current wildfire is that any signed executable wont be scanned. This, I have been told, will be fixed in upcoming versions so you can decide on your own which signatures you wish to trust. Specially when Realtek certs and Digicert certs are out in the wild to sign malware.
... View more
