File Security
Last updated
Last updated
In addition to the Contextual Machine-Learning based engine, CloudGuard WAF provides file security, aimed at preventing malicious files from being uploaded to the organization's servers.
The file security engine scans the HTTP traffic coming into the organization, analyzes any files uploaded, and consults Check Point's Threat Cloud regarding the file's reputation.
When defining a new Web Application or a new Web API asset to protect, file security is inactive by default. However - a security administrator may choose to activate the mode of the file security engine.
Once the asset edit window opens, select the Threat Prevention tab and scroll to the File Security sub-practice.
Setting the Mode to As Top Level means inheriting the primary mode of the practice.
Otherwise you can override it only for this specific sub-practice to Detect/Prevent/Disable.
The settings allow:
Configuring the severity threshold from which the engine will take an action, if the file was discovered to contain a potential security risk.
Changing the exact behavior upon detection of signature according to its confidence level (Prevent/Detect/Inactive, or, According to Practice when there is no unique behavior to the group of protections)
Selecting if to extract Archive files for analysis of the extracted content and the configuring:
Maximum limit to scan within an archive file
Exact behavior (Prevent/Detect/Inactive, or, According to Practice when there is no unique behavior to the group of protections) for the instance of detecting an archived file within another archived file.
Exact behavior (Prevent/Detect/Inactive, or, According to Practice when there is no unique behavior to the group of protections) for the instance of a failure in content extraction.
The following file types are considered archives in file security:
ZIP: .zip
RAR: .rar
TAR: .tar
7z: .7z
Tar Gzip:.tar.gz
Tgz:.tgz (shorthand for.tar.gz)
Gz:.gz (usually for single compressed files, not archives)
Bz2:.tar.bz2(or sometimes .bz2 if it's compressing a single file)
Limiting file size and selecting the exact behavior (Prevent/Detect/Inactive, or, According to Practice when there is no unique behavior to the group of protections) any files exceeding the configured size.
Selecting the exact behavior (Prevent/Detect/Inactive, or, According to Practice when there is no unique behavior to the group of protections) for the instance of un-named files, where the title name was not provided as part of the Content-disposition header (see RFC-1521).
Activating the Threat Emulation engine. The Threat Emulation engine uses an emulated run in a sandbox located in the Check Point , to prevent multi-stage attacks at the earliest stage. When selected, multiple known file types are scanned by the Threat Emulation engine - Word, Excel, PowerPoint, PDF and executable files.
Files that require more than a few seconds to be analyzed by the Threat Emulation engine, may be delivered to users before a final verdict is reached to provide better connectivity.
When making the first change to the default Web Application/API Best Practice's configuration such as making changes to the default configuration of the File Security engine settings, you will be prompted to change the name of the Practice to your own custom practice name
Click Enforce on the top banner of the Infinity Portal.
