MEGA PRIVACY FIREWALL EXCEPTION ARCHIVE

The action should be narrow to the specific problem to not broaden the attack surface too much. The reaction then depends on the cause of the problem.

MEGA PRIVACY FIREWALL EXCEPTION ARCHIVE

It might also be caused by the file being actually malicious, for example when explicitly transferring an archive with malware inside. The problem might be caused by a false positive of the antivirus.In general you should identity the actual problem first and then find a way to fix it or work around it without introducing additional risk. It depends on the cause of the problem and on the capability of the various systems involved (i.e. These are all questions with different impacts on your business function, and the likelihood and impact of the exemption causing a problem.

Can you scan the exempted file using a local anti-virus?.

Can you add a temporary exception or do exceptions need to be permanent?.

Can you whitelist the file and confirm that the file is the approved file from the source? (checksums, signatures, etc.).

How often? Can you mitigate by manually extracting the file and distribute it yourself to those who need it?.

You are worried that an infected file might slip through. You have an anti-virus on the firewall that is impacting critical business function every once in a while.

What can be done to minimize those risks?īut as a part of all that, you need to look at the operational impact of doing X at all.

What other risks get introduced by doing X?.

How much does X cost (in money, effort, etc.)?.

What could happen if you did not do mitigation X?.

Then you start brainstorming the effects of mitigations:

Each scenario and context for risk is different, which is why there is no one way, or best practice, to look at the problem. Mitigations lower the Impact and/or the Likelihood. Risk is typically a relationship between Impact and Likelihood, lessened by Mitigations. There is no best practice, it's entirely based on a risk assessment. While I'm interested in security, I have very little practical experience with it. I'd love any insight on the issue itself, or how the question could be improved. Is there a widely accepted best practice for deciding whether to add an exception to the firewall versus instead fixing the file or program? If you do end up adding an exception, what are some ways to minimize the possibility that that exception can be exploited? It seems like any exception you add is exposing your network to any vulnerability on the remote network. Rather than adding the remote IP address as an exception in our firewall's malicious file scanner, I wanted to see if there are general best practices for handling firewall exceptions. After some investigating, I learned that this is a program that is necessary to one of the core functions of our company and needs to be downloaded periodically. The scanner alerted about a malicious file that was downloaded to one of our machines. My company has a firewall set up which, among other things, scans incoming files for malware.

Mega privacy firewall exception