Examining an Anti-Spyware profile

Overview

The Information Security Office (ISO) creates security profiles that individual departments can use in their own environments. To evaluate these profiles for local use, it is best to review the settings within the management console. The steps below outline how to examine Anti-Spyware profiles.

How to Access Anti-Spyware Profiles

1. Log into https://panorama.net.berkeley.edu using single sign-on.
2. Select the Objects tab from the top navigation bar.
3. Under the Security Profiles menu in the left pane, select Anti-Spyware.
   
4. Select the profile you wish to examine. For this example, we will look at ucbsec-RD_server (the recommended profile for servers containing Restricted Data).

Understanding Rule Logic

Opening the profile displays the rules. Like standard firewall rules, these are processed in order from top to bottom; items with higher criticality are placed at the top.

• Critical and High Severity: The rule simple-critical applies to any threat with a severity of "Critical." If malware behavior matches this, the firewall sends a reset-packet to both the client and server, ending the session and recording the packet for forensic analysis.
• Display Columns: If your view is missing specific columns, click the down arrow on any column header and select Columns to customize your view.
  
• Category-Based Rules: The Data Theft rule is different because it is based on a specific Category rather than severity. Even if a threat is rated "Low" severity, if it is categorized as "data-theft," the firewall will interrupt the traffic.
  

Handling Profile Exceptions

Exceptions allow you to override the default behavior for specific signatures. While ucbsec-RD_server normally has no exceptions, they can be created to change an action (e.g., setting a Critical issue to "Alert" only) or to apply a different rule to specific IP addresses.

Note: To see all available signatures that could be used for exceptions, click the Show all signatures checkbox in the lower-left corner of the window.

DNS Signatures and Sinkholing

The DNS Signatures tab includes External Dynamic Lists (EDLs) of malicious domains and configures the Sinkhole behavior. In this example, the list includes threat-malicious_FQDN, which ISO accumulates from trusted third parties.

When the firewall detects a DNS query for a malicious host on this list, it intercepts the request and provides a Sinkhole IP address. This prevents the victim machine from successfully connecting to the malicious domain. Currently, IPv4 requests are sent to a public Palo Alto sinkhole, while IPv6 requests are directed back to the host machine (loopback).

Click Cancel to exit these screens without making changes.

---

Additional Resources

For technical documentation, visit the vendor site: Anti-Spyware Profile Documentation.