Integration · Topic 1 of 8
Malware Defense and File Policies
Learn how Malware Defense uses file policies, cloud lookup, dispositions, dynamic analysis and retrospective events to detect and block malware.
- 5 min
- A file policy is attached to an Allow rule on the Inspection tab.
- File rules match protocol, direction and file type.
- Block Malware blocks files with a malware disposition, and Malware Cloud Lookup only logs.
What it is
Malware Defense lets Secure Firewall detect, track and block malicious files as they cross the network.
It is configured with a file policy in the Secure Firewall Management Center (FMC). The file policy is attached to an access control rule that allows traffic. The firewall then looks at the files in that traffic.
Malware Defense needs a licence, and it needs a connection from the FMC to the Cisco cloud so that file verdicts can be looked up.
How it works
A file policy has rules, and each rule decides what to do with a type of file.
File rules
A file rule matches on the application protocol, the direction and the file type. Protocols include web, mail and file transfer.
Direction can be upload, download or both. File types are grouped in categories, such as office documents, archives and executables.
Each rule has an action.
| Action | What it does |
|---|---|
| Detect Files | Logs the file and lets it through |
| Block Files | Blocks the file type without a malware check |
| Malware Cloud Lookup | Looks up the verdict and logs it, but lets the file through |
| Block Malware | Looks up the verdict and blocks the file if it is malware |
The two malware actions can also store the file, and they can send some files for deeper analysis. A rule can reset the connection when it blocks.
Dispositions
The cloud returns a disposition for a file, which is based on its hash.
| Disposition | Meaning |
|---|---|
| Malware | The file is known to be malicious |
| Clean | The file is known to be good |
| Unknown | The cloud has no verdict yet |
| Custom Detection | The file is on your own block list |
| Unavailable | The lookup could not be completed |
A file that is unknown may be sent for analysis, and the verdict can change later. When that happens, the FMC records a retrospective event, so you learn that a file you let through is now known to be bad.
Analysis options
Several kinds of analysis help with unknown files.
- Spero analysis looks at the structure of executable files and sends a small summary to the cloud.
- Dynamic analysis sends the file to a sandbox, where it is run and watched. The sandbox is Cisco Secure Malware Analytics, which was called Threat Grid.
- Local malware analysis checks files on the device against a local engine.
Dynamic analysis takes time. Unknown files can pass during that time, which is why retrospective events are useful.
Custom lists and settings
You can create a custom detection list of file hashes to block, and a clean list of files to allow. These are enabled in the advanced settings of the file policy.
Other settings control the first time analysis of a file and the maximum file sizes. Large files may be skipped, so check the limits for your design.
Putting it in place
Build the file policy, add rules, and attach it on the Inspection tab of an access control rule with the Allow action. Make sure the cloud connection is working, then deploy. If the rule logs the connection, file and malware events will appear in the FMC.
Checking the result
The FMC shows file events and malware events under the Analysis menu. A malware event shows the file name, the hash, the disposition and the action. If a file was blocked, the action shows it.
What to remember for the exam
Eight facts cover the usual questions.
- A file policy is attached to an Allow rule on the Inspection tab.
- File rules match protocol, direction and file type.
- Block Malware blocks files with a malware disposition, and Malware Cloud Lookup only logs.
- Dispositions are malware, clean, unknown, custom detection and unavailable.
- Unknown files can be sent for dynamic analysis in a sandbox.
- Retrospective events report a verdict that changed after the file passed.
- A custom detection list blocks hashes you choose, and a clean list allows them.
- The FMC needs a cloud connection and a licence for these features.
If a question needs the firewall to block files that the cloud calls malware, choose Block Malware, not Malware Cloud Lookup.
Common mistakes
These four mistakes are common with Malware Defense.
Using Malware Cloud Lookup and expecting a block. That action only records the verdict.
Attaching the file policy to a Trust or Block rule. Those rules do not take a file policy, so use a rule that allows the traffic.
Assuming an unknown file is safe. The verdict can change, and a retrospective event shows when.
Forgetting the cloud connection. Without it, lookups return unavailable.
Trusted traffic is not inspected for files. Check that a Trust rule is not hiding traffic you meant to scan.
Check yourself
Work through these three questions.
Which file rule action blocks files that the cloud says are malware?
Block Malware, because Malware Cloud Lookup only logs the verdict and lets the file through.
What is a retrospective event?
It is an event that reports that the verdict for a file changed after the file was already allowed through.
Where is a file policy attached?
On the Inspection tab of an access control rule that has the Allow action.
Topic 1 of 8 in Integration
Test yourself on Integration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.