Blocking Malware and Prohibited Files

Malicious software, or malware, can enter your organization’s network via multiple routes. To help you identify and mitigate the effects of malware, the ASA FirePOWER module’s file control and advanced malware protection components can detect, track, store, analyze, and optionally block the transmission of malware and other types of files in network traffic.

You configure the system to perform malware protection and file control as part of your overall access control configuration. File policies that you create and associate with access control rules handle network traffic that matches the rules.

Table 35-1 License and Appliance Requirements for Intrusion and File Inspection

Feature
Description
Add this license...

intrusion prevention

detect and optionally block intrusions and exploits

Protection

file control

detect and optionally block the transmission of file types

Protection

advanced malware protection (AMP)

detect, track, and optionally block the transmission of malware

Malware

For more information, see:

Understanding Malware Protection and File Control

License: Protection, Malware, or Any

Using the advanced malware protection feature, you can configure the ASA FirePOWER module to detect, track, analyze, and optionally block malware files being transmitted on your network.

The system can detect and optionally block malware in many types of files, including PDFs, Microsoft Office documents, and others. ASA FirePOWER modules monitor specific application protocol-based network traffic for transmissions of those file types. When the ASA FirePOWER module detects an eligible file, the ASA FirePOWER module then performs a malware cloud lookup using the file’s SHA-256 hash value. Based on these results, the Cisco cloud returns a file disposition to the ASA FirePOWER module.

If a file has a disposition in the cloud that you know to be incorrect, you can add the file’s SHA-256 value to a file list:

If the system detects a file’s SHA-256 value on a file list, it takes the appropriate action without performing a malware lookup or checking the file disposition. Note that you must configure a rule in the file policy with either a Malware Cloud Lookup or Block Malware action and a matching file type to calculate a file’s SHA value. You can enable use of the clean list or custom detection list on a per-file-policy basis.

To inspect or block files, you must enable a Protection license on the ASA FirePOWER module. To add files to a file list, you must also enable a Malware license.

Understanding File Dispositions

The system determines file dispositions based on the disposition returned by the Cisco cloud. A file can have one of the following file dispositions returned by the Cisco cloud, as a result of addition to a file list, or due to threat score:


Tip If you see several Unavailable malware events in quick succession, check your cloud connection and port configuration. For more information, see Security, Internet Access, and Communication Ports.


Based on the file disposition, the ASA FirePOWER module either blocks the file or blocks its upload or download. To improve performance, if the system already knows the disposition for a file based on its SHA-256 value, your appliance uses the cached disposition rather than querying the Cisco cloud.

Note that file dispositions can change. For example, the cloud can determine that a file that was previously thought to be clean is now identified as malware, or the reverse—that a malware-identified file is actually clean. When the disposition changes for a file for which you performed a malware lookup in the last week, the cloud notifies the ASA FirePOWER module so the system can take appropriate action the next time it detects that file being transmitted. A changed file disposition is called a retrospective disposition.

File dispositions returned from a malware cloud lookup have a time-to-live (TTL) value. After a file disposition has been held for the duration specified in the TTL value without update, the system purges the cached information. Dispositions have the following TTL values:

If a malware cloud lookup against the cache identifies a cached disposition that timed out, the system performs a fresh lookup to determine a file disposition.

Understanding File Control

If your organization wants to block not only the transmission of malware files, but all files of a specific type (regardless of whether the files contain malware), the file control feature allows you to cast a wider net. As with malware protection, the ASA FirePOWER module monitors network traffic for transmissions of specific file types, then either blocks or allows the file.

File control is supported for all file types where the system can detect malware, plus many additional file types. These file types are grouped into basic categories, including multimedia (swf, mp3), executables (exe, torrent), and PDFs. Note that file control, unlike malware protection, does not require queries of the Cisco cloud.

Configuring Malware Protection and File Control

License: Protection or Malware

You configure malware protection and file control as part of your overall access control configuration by associating file policies with access control rules. This association ensures that before the system passes a file in traffic that matches an access control rule’s conditions, it first inspects the file.

A file policy, like its parent access control policy, contains rules that determine how the system handles files that match the conditions of each rule. You can configure separate file rules to take different actions for different file types, application protocols, or directions of transfer.

When a file matches a rule, the rule can:

  • allow or block files based on simple file type matching
  • block files based on malware file disposition

In addition, the file policy can automatically treat a file as if it is clean or malware based on entries in the clean list or custom detection list

As a simple example, you could implement a file policy that blocks your users from downloading executable files. For detailed information on file policies and associating them with access control rules, see Understanding and Creating File Policies.

Logging Events Based on Malware Protection and File Control

License: Protection or Malware

The ASA FirePOWER module logs records of the system’s file inspection and handling file events, and malware events:

  • File events represent files that the system detected, and optionally blocked, in network traffic.
  • Malware events represent malware files detected, and optionally blocked, in network traffic by the system.
  • Retrospective malware events represent files whose malware file dispositions have changed.

When the system generates a malware event based on detection or blocking of malware in network traffic, it also generates a file event, because to detect malware in a file the system must first detect the file itself.

Understanding and Creating File Policies

License: Protection or Malware

The policy has two access control rules, both of which use the Allow action and are associated with file policies. The policy’s default action is also to allow traffic, but without file policy inspection. In this scenario, traffic is handled as follows:

A file policy, like its parent access control policy, contains rules that determine how the system handles files that match the conditions of each rule. You can configure separate file rules to take different actions for different file types, application protocols, or directions of transfer.

Once a file matches a rule, the rule can:

In addition, the file policy can automatically treat a file as if it is clean or malware based on entries in the clean list or custom detection list

You can associate a single file policy with an access control rule whose action is Allow, Interactive Block, or Interactive Block with reset. The system then uses that file policy to inspect network traffic that meets the conditions of the access control rule. By associating different file policies with different access control rules, you have granular control over how you identify and block files transmitted on your network. Note, however, that you cannot use a file policy to inspect traffic handled by the access control default action. For detailed information, see Inspecting Allowed Traffic For Intrusions and Malware.

File Rules

Table 35-2 File Rule Components

File Rule Component
Description

application protocol

The system can detect and inspect files transmitted via FTP, HTTP, SMTP, IMAP, POP3, and NetBIOS-ssn (SMB). To improve performance, you can restrict file detection to only one of those application protocols on a per-file rule basis.

direction of transfer

You can inspect incoming FTP, HTTP, IMAP, POP3, and NetBIOS-ssn (SMB) traffic for downloaded files; you can inspect outgoing FTP, HTTP, SMTP, and NetBIOS-ssn (SMB) traffic for uploaded files.

file categories and types

The system can detect various types of files. These file types are grouped into basic categories, including multimedia (swf, mp3), executables (exe, torrent), and PDFs. You can configure file rules that detect individual file types, or on entire categories of file types.

For example, you could block all multimedia files, or just ShockWave Flash (swf) files. Or, you could configure the system to alert you when a user downloads a BitTorrent (torrent) file.


Caution Frequently triggered file rules can affect system performance. For example, detecting multimedia files in HTTP traffic (YouTube, for example, transmits significant Flash content) could generate an overwhelming number of events.

file rule action

A file rule’s action determines how the system handles traffic that matches the conditions of the rule.

Note File rules are evaluated in rule-action, not numerical, order. For more information, see the next section, File Rule Actions and Evaluation Order.

File Rule Actions and Evaluation Order

Each file rule has an associated action that determines how the system handles traffic that matches the conditions of the rule. You can set separate rules within a file policy to take different actions for different file types, application protocols, or directions of transfer. The rule actions are as follows, in rule-action order:

For each file rule action, you can configure options to reset the connection when a file transfer is blocked. The following table details the options available to each file action.

 

Table 35-3 File Rule Actions

Action
Resets Connection?

Block Files

yes (recommended)

Block Malware

yes (recommended)

Detect Files

no

Malware Cloud Lookup

no

File and Malware Detection, Capture, and Blocking Notes and Limitations

Note the following details and limitations on file and malware detection, capture, and blocking behavior:

File Rule Evaluation Example

Table 35-4 File Rule Evaluation Order Example

App. Protocol
Direction
Action
Action Options
Result

SMTP

Upload

Block Files

Reset Connection

Blocks users from emailing PDF files and resets the connection.

FTP

Download

Block Malware

Reset Connection

Blocks the download of malware PDF files via file transfer, and resets the connection.

POP3

IMAP

Download

Malware Cloud Lookup

none

Inspects PDF files received via email for malware.

Any

Any

Detect Files

none

Detects and logs, but allows the traffic, when users view PDF files on the web (that is, via HTTP).

) to designate conflicting file rules.

Note that you cannot perform malware analysis on all file types detected by the system. After you select values from the Application Protocol, Direction of Transfer, and Action drop-down lists, the system constrains the list of file types.

Logging File Events, Malware Events and Alerts

When you associate a file policy with an access control rule, the system automatically enables file and malware event logging for matching traffic. When the system inspects a file, it can generate the following types of events:

When a file policy generates a file or malware event, or captures a file, the system automatically logs the end of the associated connection, regardless of the logging configuration of the invoking access control rule.


Note File events generated by inspecting NetBIOS-ssn (SMB) traffic do not immediately generate connection events because the client and server establish a persistent connection. The system generates connection events after the client or server ends the session.


For each of these connection events:

File Monitor for Detect Files and Malware Cloud Lookup file rules and for files on the clean list

File Block for Block Files or Block Malware file rules

File Custom Detection if the system encountered a file on the custom detection list

File Resume Allow where file transmission was originally blocked by a Block Files or Block Malware file rule. After a new access control policy was applied that allowed the file, the HTTP session automatically resumed.

File Resume Block where file transmission was originally allowed by a Detect Files or Malware Cloud Lookup file rule. After a new access control policy was applied that blocked the file, the HTTP session automatically stopped.

As with any kind of event generated by the ASA FirePOWER module, you can view file and malware events. You can also use malware events to alert you via SNMP or syslog.

Internet Access

The system uses port 443 to perform malware cloud lookups for network-based AMP. You must open that port outbound on the ASA FirePOWER module.

Managing File Policies

You create, edit, delete, and compare file policies on the File Policies page (Policies > Files), which displays a list of existing file policies along with their last-modified dates.

) for a file policy displays a dialog box that tells you which access control policies use the file policy, then redirects you to the Access Control Policy page. This is because you cannot apply a file policy independently, as a file policy is considered part of its parent access control policies. To use a new file policy, or to apply changes made to an existing file policy, you must apply or reapply the parent access control policies.

Note that you cannot delete a file policy used in a saved or applied access control policy.

For more information on managing file policies, see the following sections:

Creating a File Policy

License: Protection or Malware

After you create a file policy and populate it with rules, you can use it in an access control policy.


To create a file policy:


Step 1 Select Configuration > ASA FirePOWER Configuration > Policies > Files.

The File Policies page appears.

Step 2 Click New File Policy.

The New File Policy dialog box appears.

For a new policy, the module interface indicates that the policy is not in use. If you are editing an in-use file policy, the module interface tells you how many access control policies use the file policy. In either case, you can click the text to jump to the Access Control Policies page; see Getting Started with Access Control Policies.

Step 3 Enter a Name and optional Description for your new policy, then click Save.

The File Policy Rules tab appears.

Step 4 Add one or more rules to the file policy.

File rules give you granular control over which file types you want to log, block, or scan for malware. For information on adding file rules, see Working with File Rules.

Step 5 Configure the advanced options. See Configuring Advanced File Policy General Options for more information.

Step 6 Click Store ASA FirePOWER Changes.

To use your new policy, you must add the file policy to an access control rule, then apply the access control policy. If you are editing an existing file policy, you must reapply any access control policies that use the file policy.


 

Working with File Rules

License: Protection or Malware

To be effective, a file policy must contain one or more rules. You create, edit, and delete rules on the File Policy Rules page, which appears when you create a new file policy or edit an existing policy. The page lists all the rules in the policy, along with each rule’s basic characteristics.

The page also notifies you of how many access control policies use this file policy. You can click the notification to display a list of the parent policies and, optionally, continue to the Access Control Policies page.

To create a file rule:


Step 1 Select Configuration > ASA FirePOWER Configuration > Policies > Files.

The File Policies page appears.

Step 2 You have the following options:

Step 3 On the File Policy Rules page that appears, click Add File Rule.

The Add File Rule dialog box appears.

Step 4 Select an Application Protocol from the drop-down list.

Any, the default, detects files in HTTP, SMTP, IMAP, POP3, FTP, and NetBIOS-ssn (SMB) traffic.

Step 5 Select a Direction of Transfer from the drop-down list.

You can inspect the following types of incoming traffic for downloaded files:

You can inspect the following types of outgoing traffic for uploaded files:

Use Any to detect files over multiple application protocols, regardless of whether users are sending or receiving.

Step 6 Select a file rule Action. See the File Rule Actions table for more information.

When you select either Block Files or Block Malware, Reset Connection is enabled by default. To not reset the connection where a blocked file transfer occurs, clear the Reset Connection check box.


Note Cisco recommends that you leave Reset Connection enabled to prevent blocked application sessions from remaining open until the TCP connection resets.


For detailed information on file rule actions, see File Rule Actions and Evaluation Order.

Step 7 Select one or more File Types. Use the Shift and Ctrl keys to select multiple file types. You can filter the list of file types in the following ways:

The file types that you can use in a file rule vary depending on your selections for Application Protocol, Direction of Transfer, and Action.

For example, selecting Download as the Direction of Transfer removes GIF, PNG, JPEG, TIFF, and ICO from the Graphics category to prevent an excess of file events.

Step 8 Add the selected file types to the Selected Files Categories and Types list:

Step 9 Click Store ASA FirePOWER Changes.

The file rule is added to the policy. If you are editing an existing file policy, you must reapply any access control policies that use the file policy for your changes to take effect.


 

Configuring Advanced File Policy General Options

License: Malware

In a file policy, you can set the following advanced options in the General section.

 

Table 35-5 Advanced File Policy General Options

Field
Description
Default Value

Enable Custom Detection List

Select this to block files on the custom detection list when detected.

enabled

Enable Clean List

Select this to allow files on the clean list when detected.

enabled

To configure advanced file policy general options:


Step 1 Select Configuration > ASA FirePOWER Configuration > Policies > Files.

The File Policies page appears.

) next to the policy you want to edit.

The File Policy Rule page appears.

Step 3 Select the Advanced tab.

The Advanced tab appears.

Step 4 Modify the options as described in the Advanced File Policy General Options table.

Step 5 Click Store ASA FirePOWER Changes.

You must reapply any access control policies that use the file policy you edited.


 

Comparing Two File Policies

License: Protection

To review policy changes for compliance with your organization’s standards or to optimize system performance, you can examine the differences between any two file policies, or two revisions of the same policy.

The file policy comparison view displays two file policies or revisions in a side-by-side format, with the time of last modification and the last user to modify displayed next to each policy name. Differences between the two policies are highlighted:

, which is a PDF version of the comparison view.

To compare two file policies:


Step 1 Select Configuration > ASA FirePOWER Configuration > Policies > Files.

The File Policies page appears.

Step 2 Click Compare Policies.

The Select Comparison dialog box appears.

Step 3 From the Compare Against drop-down list, select the type of comparison you want to make:

The dialog box refreshes, displaying your comparison options.

Step 4 Depending on the comparison type you selected, you have the following choices:

Step 5 Click OK.

The comparison view appears.

Step 6 Optionally, click Comparison Report to generate a file policy comparison report. You are prompted to save the report to your computer.