Create the Data Center Best Practice Vulnerability Protection Profile
Table of Contents
Create the Data Center Best Practice Vulnerability Protection Profile
Protect your data center from attacks such as buffer
overflows, illegal code execution, and other attempts to exploit
vulnerabilities.
Attach a Vulnerability Protection profile to all
security policy rules that allow traffic. The Vulnerability Protection
profile protects against buffer overflows, illegal code execution,
and other attempts to exploit client- and server-side vulnerabilities
to breach and move laterally through the data center network.
Clone the predefined strict Vulnerability Protection profile. To ensure availability for
business-critical applications, take safe transition steps as you move from your
current state to the best practice profile. For the best practice profile, for each rule
except simple-client-informational and
simple-server-informational, double-click the Rule
Name and change Packet Capture from
disable to single-packet to enable
packet capture (PCAP) for each rule so you can track down
the source of potential attacks. Don’t change the rest of the settings. Download content updates automatically and install them
as soon as possible so that the signature set is always up-to-date.
Don’t enable PCAP for informational activity because it generates
a relatively high volume of that traffic and it’s not particularly
useful compared to potential threats. Apply extended PCAP (as opposed
to single PCAP) to high-value traffic to which you apply the alert Action.
Apply PCAP using the same logic you use to decide what traffic to
log—take PCAPs of the traffic you log. Apply single PCAP to traffic
you block. The default number of packets that extended PCAP records
and sends to the management plane is five packets, which is the
recommended value. In most cases, capturing five packets provides
enough information to analyze the threat. If too much PCAP traffic
is sent to the management plane, then capturing more than five packets
may result in dropping PCAPs.
The reason to attach the best practice Vulnerability Protection
profile to all security policy rules that allow traffic is because
if you don’t have strict vulnerability protection, attackers can
leverage client- and server-side vulnerabilities to compromise the
data center. For example:
- Intra data center traffic—A strict Vulnerability Protection profile, along with the Antivirus profile, helps prevent attackers from using exploits to leverage vulnerabilities and spread malware and hacking tools laterally between servers inside the data center network.
- Traffic from the data center to the internet—Vulnerability protection helps prevent infected data center servers from compromising internet servers.
- Traffic from the internet to the data center—A strict Vulnerability Protection profile blocks attempts to compromise data center servers with server-side vulnerabilities. If a server is compromised, vulnerability protection helps prevent the infected server from serving exploits to clients, isolating the infection and protecting your partners and customers from watering hole attacks. Vulnerability protection also stops brute force attacks using the Block IP action. When brute force attack signatures trigger the action, the firewall blocks the attacker’s IP address for a configured period of time. If the brute force attack resumes after the time period expires, the signatures again trigger the blocking action. The brute force attack may continue, but it never succeeds.