About neg273

Best Practices URL Filtering Recommendations   Note: This post was updated on June 27, 2022 to reflect recent changes to Palo Alto Networks' URL Filtering feature.   Learn more about URL Filtering categories, including block recommended, Consider block or alert, and how they differ from default alert in this to-the-point blog post.    Best Practices: URL Filtering Category Recommendations   Our URL categories can be divided into three broad classes for consideration: Block Recommended – Categories consist of known threats, allow subversion of controls, or involve tools and methods used by known threats Consider Block or Alert – Categories should be considered with regard to each organization’s legal concerns and compliance policies Default Alert – Categories consisting of benign content In this best practice document, I will focus on the “Block Recommended” and “Consider Block or Alert” classes.  While the “Default Alert” content is considered benign, organizations should consider which content is appropriate for their audience.     Block Recommended   Known Threats Command and control, block: Malicious URL If you see C2 in your logs, it could be a strong indicator that an endpoint has been compromised and is attempting to reach out. It is recommended to further investigate the endpoint to check for compromise and potential lateral movement.   Malware, block:  Malicious URL Phishing, block:  Malicious URL Ransomware, block: Malicious URL   Subversion - allows subversion of controls Proxy avoidance and anonymizers, block: Proxy servers and other methods that bypass URL filtering or monitoring. If proxy avoidance is allowed, URL Filtering and other Palo Alto Networks related features will not have visibility into this encrypted traffic. Thus, we cannot block access to malicious URLs, downloads, etc.   Threat Adjacent – Involves tools and methods used by known threats Dynamic DNS, block: Websites that provide and/or utilize dynamic DNS services to associate domain names to dynamic IP addresses. Dynamic DNS is often used by attackers for command-and-control communication and other malicious purposes. Many malicious websites are resolved by DDNS; therefore, we recommend blocking this category. If there are specific DDNS websites that need to be accessed, we recommend specifically putting those in a custom category to allow access. Grayware, block: Websites that do not pose a direct security threat but do display obtrusive behavior. These could include websites that run unauthorized crypto-mining javascript on your browser (not persistent, quit the browser and issue goes away), hijackers that change the elements of the browser, such as the default landing page, default search engine, and installing an unauthorized extension. While these behaviors are generally easily reversed, it is not desirable, and we recommend this category to be blocked. Hacking, block: Websites relating to the illegal or questionable access to or the use of communications equipment/software. Development and distribution of programs, how-to advice and/or tips that may result in the compromise of networks and systems. This also includes websites that facilitate the bypass of licensing and digital rights systems. Generally, there is no reason to allow end-users to connect to these websites. For organizations that have threat research, SOCs, etc., you may choose to allow access to this category based on user functionality. At the same time, we recommend for those with access, that the action be set to “alert” for logging purposes.   Consider Block or Alert   Legal / Policy Adult, block: These websites may be inappropriate in the workplace, school, etc. Extremism, block: These websites promote terrorism, racism, facism, or other extremist views discriminating people or groups of different ethnic backgrounds, religions or other beliefs. Some content from extremism websites are highly graphic.   Abused drugs, block: These websites promote the abuse of both legal and illegal drugs, use and sale of drug related paraphernalia, manufacturing and/or selling of drugs.   Weapons, block: Sales, reviews, descriptions of or instructions regarding weapons and their use. These websites may not be appropriate in a professional or educational setting. Copyright infringement, block: Web pages and services that are dedicated to illegally offering videos, movies, or other media for download infringing copyrights of others. End-users accessing copyright material may expose the organization to copyright violations/penalties. Cryptocurrency, alert: Websites that promote crypto-currencies, crypto-mining websites (but not embedded crypto-miners), crypto-currency exchanges and vendors, and websites that manage crypto-currency wallets and ledgers. This category does not include traditional financial services websites that reference crypto-currencies, websites that explain and describe how crypto-currencies and block chains work, or websites that contain embedded crypto-currency miners (grayware). Peer to peer, block: Websites that provide access to or clients for peer-to-peer sharing of torrents, download programs, media files, or other software applications. This is primarily for those sites that provide bitTorrent download capabilities. Does not include shareware or freeware websites. Alcohol and tobacco, alert: Websites that pertain to the sale, manufacturing, or use of alcohol and/or tobacco products and related paraphernalia. The content of these websites may not be appropriate depending on the audience (i.e., K-12 would block this category.) Gambling, block: Lottery or gambling websites that facilitate the exchange of real and/or virtual money. Also related websites that provide information, tutorials, or advice regarding gambling, including betting odds and pools. Questionable, block: Websites containing tasteless humor, offensive content targeting specific demographics of individuals or groups of people, criminal activity, illegal activity, and get rich quick websites.   Unknown  Newly Registered Domains, block (default is alert): Domains that have been newly registered or had a change in ownership within the last 32-days. There is a strong correlation between newly registered domains and malicious URLs. Parked, block (default is allow): URLs that host limited content or click-through ads which may generate revenue for the host entity but generally do not contain content that is useful to the end user. Unknown, block (default is allow): Unknowns are URLs that URL Filtering has never visited to categorize the content of the page.  Recommendation is to block, but many customers are wary of workflow disruption. If a block is not possible, it is recommended to alert, set a much stricter threat prevention profile, and block downloads of dangerous files (PEs, powershells, etc.). Evidence has shown that many customers run into issues with unknowns by allowing end users to download items from these websites. Insufficient Content, block (default is allow): Websites and services that present test pages, no content, provide API access not intended for end-user display, or require authentication without displaying any other content suggesting a different categorization. Not-resolved, block (default is allow): This is a failure condition where a connection cannot be established between the firewall and the cloud. Not-resolved indicates that the website was not found in the local URL filtering cache, and the firewall was unable to connect to the cloud database to check the URL’s category. Consider failing-closed (block), rather than failing-open (alert).   Risk High Risk, alert:  Websites that were previously confirmed to be malicious but have displayed benign activity for at least 30 days. Websites hosted on bulletproof ISPs or using an IP from an ASN that has known malicious content. Websites sharing a domain with a known malicious website. All websites in the “Unknown” category will be high risk.   It is recommended to alert, enforce SSL decryption for increased visibility, set a much stricter threat prevention profile, and block downloads of dangerous files (PEs, PowerShell, etc.) from high risk sites. In addition, you may wish to increase logging for additional insight. Medium Risk, alert: Websites confirmed to be malicious but have displayed benign activity for at least 60 days. All websites in the “Online Storage and Backup” category will be medium risk by default.   It is recommended to alert, enforce SSL decryption for increased visibility, set a much stricter threat prevention profile, and block downloads of dangerous files (PEs, PowerShell, etc) from medium risk sites. In addition, you may wish to increase logging for added insight. Low Risk, alert: The low risk category includes websites that have a history of only benign activity and websites that have been found to be malicious in the past but that have displayed benign activity for at least 90 days.   ... View more

Edit:  Dec 10, 2019 @ 1:28PM PT - added test URLs for grayware and cryptocurrency Edit:  Jan 28, 2020 @ 2:45PM PT - added dates to begin publishing Cryptocurrency and grayware.   Beginning with content release version 8206, we added two new URL Filtering categories:  “Grayware” and “Cryptocurrency.”   ACTION:  Administrators should immediately set their grayware category to BLOCK due to the obtrusive behavior from these websites. Palo Alto Networks recommends that you also subscribe to this FAQ for updates as they become available.   Grayware How is Grayware defined? Palo Alto Networks defines Grayware as websites that do not pose a direct security threat but that display other obtrusive behavior and tempt the end user to grant remote access or perform other unauthorized actions. Grayware typically includes scams, adware, and other unwanted or unsolicited applications, such as embedded crypto miners or hijackers that change the elements of the browser (such as the default landing page, search engines, or installing an extension for tracking purposes).   What happens if I don’t change Grayware to BLOCK as the action? If you do not change the default action of the grayware category to block, your network will allow all attempted connections to grayware-related URLs to succeed and your users will have access to these websites.   Why is Grayware not set to block by default? The ability  to set the default action for the default profile to BLOCK is available only in PAN-OS 8.0.2 and later releases. Only customers running PAN-OS 8.0.2 or a later release will automatically have their default action set to BLOCK and only in the default profile. This functionality is not available in earlier releases of PAN-OS software.  NOTE:  for PAN-OS 8.0.2 and later releases, you should check to ensure that the action is properly updated to BLOCK within your default profile.   If you have multiple URL Filtering Security profiles, you need to update the default action to BLOCK for each of these profiles. This applies to all versions of PAN-OS software.   Cryptocurrency How is Cryptocurrency defined? Palo Alto Networks defines the Cryptocurrency category as websites that promote crypto currencies, crypto mining websites (but not embedded crypto miners), crypto currency exchanges and vendors, and websites that manage crypto currency wallets and ledgers. This category does not include traditional financial services websites that reference crypto currencies, websites that explain and describe how crypto currencies and block chains work, or websites that contain embedded crypto currency miners (grayware).   What is the recommended action for the Cryptocurrency category? By default, the Cryptocurrency action is set to “alert” only for the default profile. If you have multiple URL Filtering Security profiles, you need to update the default action to “alert” for each of these profiles if you want consistent alerting across all profiles.  This applies to all versions of PAN-OS software.   Please consult your legal and privacy teams if you choose to allow and decrypt this category to account for any Personally Identifiable Information (PII).   Implementation Schedule When will the Grayware and Cryptocurrency categories be available? The Grayware and Cryptocurrency categories will be visible on the administrator management console but we will not use these categories to classify web pages until January 2020. During this time, you are able to update your policy action for these new categories. After Palo Alto Networks begins to label existing and new URLs using these two new categories, all Grayware and Cryptocurrency URLs will be classified as such and your configured policy actions will be enforced on the firewall accordingly.     When will Palo Alto Networks start to use the Grayware and Cryptocurrency categories? The use of Grayware and Cryptocurrency categories is scheduled to begin in mid-January 2020. This blog will be updated when both categories are fully functional.   Starting February 3, 2020, Palo Alto Networks will start publishing URLs that are categorized as grayware and cryptocurrency.  Please ensure that your Security policy rules are configured properly for these two new categories.     What are the Palo Alto Networks test URLs for Grayware and Cryptocurrency? The test URL for grayware is: https://urlfiltering.paloaltonetworks.com/test-grayware The test URL for cryptocurrency is: https://urlfiltering.paloaltonetworks.com/test-cryptocurrency     ... View more

  Safe Search Best Practices I’d like to first level set on what Safe Search is and why this feature may be extremely useful for certain situations, in particular the education space (K-12).  Safe Search essentially filters out adult images, videos and content in search query returns.  This prevents end users within a school's network from accidentally or purposely searching for inappropriate adult content.    Safe Search functionality is search engine based.  Currently, the Palo Alto Networks NGFW supports Safe Search enforcement from google.com, yandex.com, yahoo.com, and bing.com search engines.   Transparent Experience It is always best to not change user behavior as people are creatures of habit.  Thus, you don’t want to ask your end users “to enable and use the Safe Search function.”  Being able to transparently enforce Safe Search without users having to do anything different is the ideal solution.    Another benefit of transparent Safe Search is that endpoints not issued by your organization will be forced to use Safe Search when on the organization’s network.  Again, this is transparent to the end user.    Our recommendation is to use Transparent Safe Search redirect for all users utilizing organization issued devices.  Transparent Safe Search will automatically enforce filtering of search query results with the strictest Safe Search filters.  This does not require user behavior change.  Users can still go to www.google.com, www.bing.com, www.yandex.com, or www.yahoo.com and search as they always have.  Their user experience does not change at all, just the query results, as they are devoid of adult or potentially harmful content from the respective search engines.   NOTE: As part of utilizing Transparent Safe Search redirect, the firewall requires that all search sessions be decrypted. Decrypting also provides the important additional benefits of alerts, reporting and generally additional visibility into user activities, content, threats, file types, etc.    Transparent Safe Search simply redirects the search from the standard search engine to its respective Safe Search engine for Safe Search results.  What in reality happens is this: User goes to google.com and searches for xyz The Palo Alto NGFW’s policy indicates that Safe Search is being enforced Normally with standard Safe Search enforcement the user would be directed to a block page indicating that the search was blocked due to policy. To continue, the user would need to enable Safe Search manually on their browser and search again.  This would most likely generate helpdesk calls for assistance. With Transparent Safe Search redirect enabled, the user is still redirected to the “block page.” But the block page has been modified and automatically re-searches the original “xyz” string in Safe Search mode.  This is all transparent to the user.  The results are then presented to the user in a standard search results format.   Alternative Solution An alternative solution to enforce Safe Search is via DNS.  This would leverage CNAME entries on the local DNS servers in conjunction with a security policy on the firewall to tightly control DNS traffic.     Safe Search enforcement via DNS would NOT require SSL decryption.  Some organizations see this as an advantage as they do not want to decrypt traffic.   As a best practice, we recommend decrypting at the very least suspicious URL categories.  Some of these categories include (but are not limited to): insufficient-content, online-storage-and-backup, etc. (please see our Best Practices Guide for additional information.)  Without SSL decryption for these suspect categories, users may accidently access malicious payloads.   Hybrid Solution As a best practice, we recommend that most traffic being traversed with organization issued devices be decrypted (sans Financial Services, Government, and Health and Medicine categories).  There are times however that users will bring their own devices in.  Because of a lack of control and access to these devices, they will receive SSL certificate warnings due to decryption required by Transparent Safe Search redirect.  Our suggestion would be to run a hybrid Safe Search setup.    For all organizational issued devices, utilize Transparent Safe Search redirect. For devices brought in by users, enforce the alternate solution, Safe Search via DNS.    FAQ Q: Are all search engines supported? A: No, currently only yahoo, google, yandex and bing search engines are supported. This is not limited to only .com, but also other TLDs for the respective search engines.  Such as google.es, bing.com.hk, etc.    Q: What if the end user already knows the adult content URL and enters the URL into their browser without a search result? A:  Because this bypasses any search engine query, Safe Search will not be able to do any type of search enforcement. However, because you have URL Filtering running on your Palo Alto Networks Firewall, you should block adult content via policy settings.  Transparent Safe Search allows you to enforce Safe Search to sanitize search results.  It does not provide access control to actual URLs.    Q: What about Safe Search for YouTube searches? A: Safe Search works for YouTube as well. However, Transparent Safe Search redirect is not currently supported.  You can use a hybrid method to enforce Safe Search to transparently redirect general search engine queries and DNS for YouTube searches.    Overall, Transparent Safe Search is recommended for organizations that have a requirement to block inappropriate content searches by their users.  The advantages of Transparent Safe Search are that users’ search experience does not change, while allowing the organization to enforce Safe Search policies to protect the organization and users from adult or potentially harmful content regardless if they are utilizing devices issued by the organization or have brought their own in.  Not having to alter user behavior is a great advantage for easing helpdesk loads and protecting everyone from harmful content.    References Links: https://live.paloaltonetworks.com/t5/Featured-Articles/Safe-Search-Enforcement-in-K-12/ta-p/176481   https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/url-filtering/safe-search-enforcement/transparently-enable-safe-search-for-users ... View more

Recently, our colleagues from Unit 42 published some research on Unauthorized Coin Mining in the Browser.  (It’s an interesting read, a bit technical, but I’d recommend taking a look at it.) Essentially, some web sites utilize scripts that can take over some of the processing power on the machines of web site visitors without their permission. These scripts are called cryptominers and the “borrowed” processing power is used to mine for cryptocurrencies. If a significant amount of a visitor’s CPU power is used, it could potentially slow their system down to a crawl.   Coinhive.com is a site that offers a javascript tool that web site owners can use for cryptomining. Our URL Filtering service deems this URL as benign within the Computer and Internet Info category, but we’ve heard from many customers who believe this URL to be malware and have requested the URL to be categorized as such.   The specific domain of coinhive.com itself is not malicious.  It is in fact providing information on how to mine for coins via browsers.  Therefore, it is simply providing information and tools.  We cannot categorize this as malware for this reason – it is not engaging in any malicious activity.  Could you consider what it does as “suspect” and “shady”?  Yes, you can.  But it is not delivering malware.  Also, there are legitimate reasons why someone would visit coinhive.com.  One is for research purposes, and we have seen multiple change requests coming in from various .edus requesting coinhive.com be marked as benign.    That said, there are subdomains of coinhive.com that we do categorize as malware because cryptominers are active on those URL’s. These include ws008., ws012., and ws016. to name a few. Palo Alto Networks protects against this with our URL Filtering service blocking those sites. We also provide a spyware signature (Threat ID: 11850) enabled through our Threat Prevention service.   So while we are not classifying coinhive.com as malware and blocking it, we are doing so with any subdomains where we are seeing dubious activity. We take a similar approach with some of the popular file sharing services available (DropBox, Box, Google Drive, etc). These services are commonly used to deliver malware through the files they store – however that malware comes from very specific URLs. We categorize those specific URLs as malware, but we do not categorize the domain itself as malware.    We hope this offers some good insight into our thinking here, thanks for reading!   ... View more

A new category has been added to URL Filtering. This new category will be “command-and-control” to further break out specifics from within the malware category. Functional use of the C2 category is scheduled to be released on Wednesday, October 25, 2017.   In the meantime, please check out the Command-and-Control (C2) FAQ, which will be updated when C2 becomes fully functional.   Please subscribe to that FAQ with the options on the page to be notified when it is updated. Let us know if you have more questions. We're always here to help and keep you informed. Thanks, Kelvin Kwan ... View more