About HITSSEC

Inzamam,   We do certificate based pre-logon authentication with Global protect.  We allow access to fileshares and Lync / Skype for Business in addition to Domain Controllers, DNS servers, SCCM and SCEP servers.  Not all of our users are allowed internal access but all would have internet access.  By allowing access to the infrastructure components during prelogon we have avoided as lot of user headaches.   Hope this helps,   Phil ... View more

Hello,   We use pre-logon and grant access to only domain login required resources.  Once the user logs in with their credentials they get full access.  In the hotel scenario pre-logon can't work so you log into your laptop and authenticate against cached credentials.  Once you have your internet connection GP will pass your credentials and you get your access.  If the user tells their computer to remember the wifi settings then subsequent connections will use pre-logon.     Hope this adds a bit of clarity.   Phil ... View more

bkluth,   As a best practice we put all IP addresses hosting an exploit kit (Angler, Rig or Nuclear)  on a dynamic blocklist we do this upon notification of the IPS log event.  Looking at all traffic going to the site that is hosting the exploit kit sometimes shows other users going there.  The Impact to them is not known as there is sometimes no IPS event, no files coming down and sometimes no other network behaviors.  Our rationale is that there is nothing good at that IP address.   Phil ... View more

Bkim;   I agree with rcole.  If the evasion technique creates an unknown application  then you should already have policies in place to deny unknown udp and tcp traffic. While a signature (if possible ) would work in this situation the more encompasing approach would be to block unknown apps as mentioned. If the traffic causes a url category of "unknown" to be generated then you should deal with that situation within yout URL filtering policy.  Signatures are great for specific or unique traffic patterns when other methods can't address the problem / situation. Glad you thinking out of the box.   Phil ... View more

Rcole,   Here is an expanded version of the NMap signature.  We noticed an additional web requests associated with the NMap tool and have included it in our signature. Below is what we have added as an "or condition" string:   Operator = pattern-match Context = http-req-uri-path Value = /\.git/HEAD   Thanks,   Phil ... View more

Viren,   To use custom signatures you need to tirgger on a defined traffic patten based on the contexts you have available for our use when creating a signature.  Since you want a honeypot trigger the challenge you would have is what traffic are you going to trigger on?  Might I suggest you create a security rule for you honeynet and use a logging profile that can alert you via txt message or email immediately upon being triggered.   Thought I would throw that out for your thoughts.   regards,   Phil  ... View more

The signature can have multiple sets of patterns.  Each set of patterns (max 16) can be "or" conditions.  The pattern string can be for specific purposes such as misuse of access to PHP related resources.   Does this add any clarity or am I missing something.   Phil  ... View more

Hello   To address the limit of 16 patterns you just need to add another signature as shown below:       Each signature can have 16 "or"  values.   I have signatures that have +50 string patterns Hope this helps.   Phil ... View more

Snake,   I don't think there is a majic bullet here but here are some ideas based on what we are doing.  Incorporate a high level identifier nmenonic at the start of the name.  This might be customer or physical location or a zone.  We then try to have a descriptive nmenonic for the server type or application.  Such as Exch2010 or mysqldb.  We often add the last octets of the IP address to the name.  This helps us know what it's IP address is just by looking at the object name.  This becomes helpful when you have larger numbers of Objects (eg. +5000).   Hope this gives you some ideas.   Phil ... View more

dyoung,   While your settings are correct and the AV version should be the same on both appliances occassionally we have seen the file transfer (AV updates) not being successfully pushed across to the peer.  Sometimes you may have to force a config synchonization or when you do your next commit it wil be pushed accross to the peer.   Hope this helps,   Phil   ... View more

Here are some screen snapshots. By default we have it set to alert but that is your choice. Hope this is helps. Phil ... View more

Sven, Would using the sinkhole feature within your Anti-spyware Profile help?   We have a situation where the user to DNS server communication does not traverse the firewall.  By using the sinkhole response on DNS signatures you can see who is going to the sinkhole IP address (because you define it and force the traffic to it to traverse the firewall ).  Certainly this is useful in helping you to look a bit more closely at specific source IP addresses on your network.  DNS sinkhole is one of those red flags to help you identify unusual or suspicious traffic. Hope this helps, Phil ... View more