Intrusion Prevention, Malware, and File Policies
This domain tests how FTD detects exploits and malicious files after traffic is allowed. You need to know where intrusion and file policies attach and how verdicts are reached.
Intrusion policy
- Intrusion policies contain Snort rules organized into rule sets. Variables such as HOME_NET and EXTERNAL_NET define protected and external address space.
- Base policies include Balanced Security and Connectivity, Security over Connectivity, Connectivity over Security, and Maximum Detection. They set the starting sensitivity and rule state.
- Rule actions include Alert and Drop. Drop actions block the offending packet or flow; Alert generates an event only.
- Thresholding limits how often a rule fires, reducing event floods. Intrusion policies attach to access control Allow rules.
File and malware policy
- A file policy contains file rules that match file types, direction, and application. Actions include Detect Files, Block Files, Malware Cloud Lookup, and Block Malware.
- Malware Cloud Lookup sends the file hash to the Cisco AMP cloud. A malicious verdict blocks the file and generates a malware event. An unknown verdict can trigger Spero analysis and, if configured, dynamic analysis.
- Dynamic analysis submits the file to Cisco Threat Grid. Local malware analysis on FTD examines PE files without sending them to the cloud.
- File policies attach to access control Allow rules and require the appropriate malware or threat license. Retrospective verdicts can later mark a previously unknown file as malicious.
Worked example
An access control rule allows HTTP and HTTPS and references a file policy. A user downloads a PDF. The file policy matches PDF, takes Malware Cloud Lookup, and computes the SHA-256. The AMP cloud returns malicious, so FTD blocks the download and logs a file event and a malware event. If the hash were unknown, Spero analysis would produce a local verdict, and dynamic analysis could submit the file to Threat Grid for behavioral analysis.
Traps that cost marks
- Attaching a file policy to a Block or Trust rule where files are never inspected.
- Forgetting that encrypted traffic needs SSL decryption before file inspection.
- Confusing file events with malware events; both may be generated for one download.
- Assuming every unknown file is automatically submitted to Threat Grid.
- Deploying an intrusion policy without a license that supports it.