Table of Contents
Overview
The Information Security Office (ISO) creates several security profiles that individual departments can use in their own environments. To evaluate these for local use, it is best to review the settings within the management console. In the Palo Alto environment, File Blocking prevents or alerts on file types deemed risky or abnormal from being transferred between systems.
Note: The default profiles used in all campus profile groups do not block files; they are used strictly to log files associated with potential attacks.
How to Access File Blocking Profiles
- Log into https://panorama.net.berkeley.edu using single sign-on.
- Select the Objects tab from the top navigation bar.
- Under the Security Profiles menu in the left pane, select File Blocking.
- Select the profile you wish to examine. For this example, we will look at
ucbsec-RD_server(the recommended profile for servers containing Restricted Data).
Understanding File Blocking Rules
Opening the profile displays the rules. Like standard firewall rules, these are processed in order from top to bottom. Items with higher criticality should always be placed at the top of the list.
- Block High Risk File Types: This rule applies to the specific files listed in the "File Types" column, regardless of the application (App-ID) or the direction of the transfer. These file types have a history of being used in malicious activity or data exfiltration.
- Block Encrypted File Upload: This rule is designed to prevent common exfiltration methods where data is collected, compressed, and encrypted before being sent to a remote system. This rule specifically blocks the upload of these encrypted files.
Important Limitations and Forensics
Encryption Limitation: Files will only be detected if the transfer mechanism is not encrypted. If a user is using SSL/TLS, SSH, or another encrypted protocol, the transfer will not be detected or stopped by this profile.
The final rule in the profile is typically used for forensics. it logs the transfer of any recognized file type not already covered by a previous rule, providing an audit trail for investigation.
To exit, click Cancel to return to the main Objects list.
Additional Resources
For technical documentation, visit the vendor site: File Blocking Profile Documentation.