Examining a Vulnerability Protection profile

A knowledge base article about Examining a Vulnerability Protection profile provided by the UC Berkeley IT Service Hub - Knowledge Portal

Table of Contents

Overview
How to Access Vulnerability Profiles
Understanding Rule Logic and Actions
Detecting Brute Force Attacks
Handling Rule Exceptions and IP Exemptions

Overview

The Information Security Office (ISO) creates a number of security profiles that individual departments can use in their own firewall environments. To understand the settings and evaluate them for local use, it is best to review the profiles within the management console. The steps below outline how to examine Vulnerability Protection profiles.

How to Access Vulnerability Protection Profiles

Log into https://panorama.net.berkeley.edu using single sign-on.
Select the Objects tab from the top navigation bar.
Under the Security Profiles menu in the left pane, select Vulnerability Protection.
Select the profile you wish to examine. For this example, we will look at ucbsec-RD_server (the recommended profile for servers containing Restricted Data).

Understanding Rule Logic and Actions

Opening the profile displays the rules. Like standard firewall rules, these are processed in order from top to bottom.

The rules list for the ucbsec-RD_server profile showing simple-server-critical and other rules.

Critical Server Exploits: The rule simple-server-critical applies to threats targeting a server with a "Critical" severity rating. If an attack is detected, the firewall sends a reset-packet to both the client and server, effectively ending the session.
Packet Capture: The firewall is also configured to record the specific packet that triggered the alert for forensic analysis.

Pro-Tip: If your display is missing the Category column, click the down arrow on any column header, select Columns, and check Category.

Menu showing how to add the Category column to the Panorama display.

Detecting Brute Force Attacks

This pattern continues through lower severity levels until the Detect Brute Force rule.

Screenshot of the Detect Brute Force rule with severity set to Any and Category set to brute-force.

For this rule, severity is set to Any. Because it is positioned below critical and high severity rules, it only triggers if those higher-priority rules do not match first. It applies specifically to the brute-force category. When detected, it generates an Alert and captures the packet without blocking the traffic.

Handling Rule Exceptions and IP Exemptions

Exceptions are used when the default action for a specific threat is not appropriate for your environment. The ucbsec-RD_server profile contains four standard exceptions.

The Exceptions tab showing specific vulnerability names and their overridden actions.

In this example, the Glibc getaddrinfo Buffer Overflow exception has a number "4" next to it. This indicates the number of specific IP addresses this exception applies to. If no number is present, it is a global exception for that profile.

Clicking the number opens a pop-up window listing the exempt IP addresses:

IP Address Exemptions window listing specific IPs for the Glibc exception.

Click Cancel to exit these screens without making changes.

Additional Resources

For more details, visit the vendor documentation: Vulnerability Protection Profile Documentation.