Fortigate Security 6.0 Study guide

Fortigate Security 6.0 Study guide

1. Antivirus Basics

   • antivirus scanning modes
     • flow-based inspection mode-full scan mode
       • uses the full antivirus database
         • normal/exntend/extreme
       • optimized performance compare to proxy scan
       • Fortigate buffers the whole file, but transmits to the client simultaneously
         • ips engine checks for the rule match
         • when the last packet arrives, the AV engine starts the scan.
           • engine does not necessarily scan in order and it must extract the payload to discover the viral payloads, regardless of surrounding protocol details.
           • files bigger than buffer size are not scanned-can enable logging of these files
           • packet are not delayed by scan-except last packet
         • lower perceived latency-data loads faster.
       • if a virus is detected, the last packet is dropped an the connection is reset. If an identical request is made, the block replacement page is inserted immediately
       • antivirus profile is operating in flow-based inspection mode, two options are available:
         • full scan mode
           • if performance is priority
             • if security is your priority, proxy mode inspection.
         • quick scan mode
         • consumes more CPU cycles.
         • caches a copy of the packet on the locally on the fortigate and forwards the packet to the end client the same time.
         • blocking
           • when it may have already forwarded packets to the client, it resets the connection
           • if the antivirus is detected at the start of the stream
   • what is Antivirus and how does It work?
     • Antivirus is a database of virus signatures that is used to identify malicius code
     • virus names <vector>/<pattern>
     • to detect a virus, the antivirus engine must macth file with pattern <signature>
     • each vendor uses different detection engines and signatures, such as
       • MD5
       • CRC
       • combinations of file attributes
       • binary values in some areas
       • encryption keys
       • parts of code
   • Antivirus scanning techniques
     • 1. antivirus scan
       • detects and elimnates malware in real time
         • stops threats from spreading
       • preserves the client reputation of your public IP
     • 2. grayware scan
       • uses grayware signatures
       • detects and blocks unsolicited programs
     • 3. Heuristics scan
       • looks for virus-like code
       • counts virus-like atrributes
       • if greater than a threshold , file is suspicious
       • false positives possible
       • detect zero-day viruses
         • Zero-day viruses
           • have no existing associated signature.
   • sandboxing
     • Fortisandbox detects zero-day attack with high certainly
       • fortigate uploads files to FortiSandbox cloud or FortiSandbox Appliance
       • activate a Forticloud account to use Fortisandbox cloud
       • Uploaded files are executed in an isolated environment (Vms))
       • FortiSandbox examines the effects of the software to detect new malware
     • you can configure Fortigate to receive a signature database from FortiSandbox Cloud or FortiSandbox Appliance to supplement the FortiGuard database
     • administrators must configure the antivirus profile to send files to FortiSandbox for inspection
       • you can send all files, or only files deemed suspicious to FortiSandbox (CLI only)
       • characteristics that are used to determine if a file is suspicious are updated by Fortiguard, based on the current threat climate
   • Antivirus Signature Database
     • requires a subscription to Fortiguard Antivirus
     • the antivirus scanning engine relies on the antivirus signature database.
     • the botnet IPs and Botnet Domains Subscription is part of a Fortiguard Antivirus license
     • Fortiguard antivirus databases
       • normal
       • extended
       • extreme
     • choosing an antivirus signature database (CLI only)
     • Quick scan-only available in flow inspection mode with quick scan option enabled
       • FortiOS automatically uses a compact signature database if quick scan is applied
   • Fortiguard Protection Services
     • Virus outbreak Prevention
       • additional layer of protection that keeps your network safefrom newly emerging malware
       • quick virus outbreaks can infect a network before signatures can be developed to stop them
       • outbreak protection stops these virus outbreaks until signatures become available in Fortiguard
     • content Disarm and Reconstruction
       • CDR removes exploitable content and replaces it with content that's known to be safe.

2. quick scan mode packet flow

   • uses the ips engine and embedded compact antivirus database.
     • IPS engine examines
       • the network traffic
         • for
           • viruses
           • worms
           • trojans
           • malware
       • without the need to buffer the file that is being checked
         • better performance
           • but the detection rate is lower
   • faster, less memory usage
     • because the file is not cached, but lower catching rate
   • cannot send files to Fortisanbox for inspection
   • cannot use advanced heuristics and mobile malware package
   • is only available in flow inspection mode.
   • Fortisandbox and mobile malware protection, are not appicable.
     • note, you must enable
       • SSL/SSH deep-inspection to scan encrypted traffic.

3. proxy mode inspection

   • uses full antivirus database
     • normal
     • extended
     • extreme
   • buffers the whole file
     • antivirus engine starts scanning after the end of the file is detected.
       • files bigger than buffer size are not scanned-can configure to pass or block.
     • provides granularity over performance
   • weighted towards being more thorough and easily configurable.
   • displays block message inmmediately if virus is detected.

4. configuring antivirus profiles

   • default inspection mode is flow
   • mode
     • flow
     • proxy
       • same options
         • Treat Windows Executables in Email Attachment as Viruses
           • by default
         • Send Files to FortiSandbox Cloud for Inspection
           • same behavior will be blocked if the Use FortiSandbox Database option is enabled.
         • Use Virus Outbreak Prevention Database
           • FortiGuard virus outbreak prevention is an additional layer of protection that keeps your network safe from newly emerging malware
   • enabling botnet protection
     • botnet database
       • now part of the antivirus contract
       • should be used with the antivirus profile to maximize the protection of internal endpoints
     • applied to external interfaces
     • administrators can set the action to block or Monitor
   • antivirus block page
     • contains
       • file name
       • virus name
       • web site host and URL
       • source and destination IP
       • use name and group ( if authentication is enables )
       • link to Fortiguard encyclopedia.
     • mode
       • proxy
         • the block replacement page is displayed immediately when a virus is detected.
       • flow
         • if a virus is detected at the start of the stream, the block replacement page is displayed at the first attempt
         • If a virus is detected after a few packets have been transmitted, the block replacement page is not displayed
           • FortiGate caches the URL and can display the replacement page immediately, on the second attempt
     • If deep inspection is enabled, all HTTPS-based applications also display the block replacement message.
   • Advanced Threat Protection Statistics
     • widget
       • provides real-time statistics related to antivirus scans
       • show statistics for
         • virus scan
         • FortiSandbox
   • antivirus logs
     • log details on the Forward Traffic
   • best practices
     • perform antivirus scan on all internet traffic.
     • use deep-inspection instead of certificate-based inspection, to ensure that full content inspection is performed
     • use fortisanbox Cloud or a Fortisandbox Appliance to enable sandboxing
     • do not increase the maixmum file size to be scanned, unless it is required.
       • viruses usualy travel in small files
       • more scanning means more memory utilization
     • enable Fortiguard push updates to ensure Fortigate receives antivirus updates as soon as they are available
     • Fortigate has a stable connection to fortiguard servers
     • enable logging of oversized files
     • ensure that firewall policies with antivirus applied have security events logging enabled
     • use fortiview to monitor threats to your network
     • hardware acceleration for antivirus scanning
       • Fortigate processors CP8 or CP9 support offloading of flow-based pattern matching
       • flow-based pattern databases are compiled and downloaded to the content processors from the IPS engine and IPS database
       • proxy inspection mode
         • proxy.based antivirus scanning cannot be offloaded for acceleration.
     • TSHOOT
       • Fortigate Update Issues ? make sure that
         • Fortigate has a stable connection to the internet.
         • fortigate is able to resolve DNS
         • TCP port 443 is open.
         • force fortigate to check for new antivirus upadtes
         • verifiy that the Fortiguard antivirus license is valid

5. configure protocol options

   • more granular control
   • alows configuration
     • protocol port mappings
     • common options
     • web and email options
   • proxy-based VDOMs and flow-based VDOMs
   • large files
     • by default, FortiOS allows file that are too big for the buffer size
       • files that are bigger than oversize limit are bypassed from scanning.
       • default value is 10, maximum value is hardware dependent
       • enable oversize-log to see if your FortiGate is scanning large files frequently
         • then adjust the value
     • detection rate and file size
       • most malware is small
       • very large files requires more RAM to scan completely
       • often, scanning only small files is an acceptable risk.
         • default: 10 MB threshold for oversize
         • maximum size varies model.
   • compressed files
     • When compressed files go through scanning, the compression acts like encryption: the signatures won't match
       • FortiGate must first identify the compression algorithm
         • Some archive can be identified using only the header
           • If the archive is protected with a password, FortiGate can’t decompress it
             • therefore, can’t scan it.
     • if an attacker is trying to circumvent your scans by putting a ZIP file inside the ZIP file–FortiGate will try to undo all layers of compression
       • By default, FortiGate will attempt to decompress and scan up to 12 layers deep
         • maximum number supported by your unit (usually 100).
           • increasing the size will increase memory usage
   • applying the antivirus profile
     • apply the antivirus profile and protocol options on the Firewall policy, to scan traffic.
     • ensure that deep-inspection is selected for the SSL/SSH Inspection setting.
       • It is required to scan encrypted protocols.