Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
ED
Advisor

Deactivate category threat year in IPS

Hi,

In IPS profile you can deactivate protections based on the category threat year. 

Here is an example of a protection:

Tags:

Vendor: 

Microsoft

Product: 

Office

Threat Year: 

2010

Protection Type: 

Vulnerability

Protocol: 

HTTP

Threat Description:

RTF provides a format for text and graphics interchange that can be used with different operating systems. A buffer overflow vulnerability has been identified in the way Microsoft Office parses Rich Text Format (RTF) files. The vulnerability is due to an error in Microsoft Office that fails to properly parse specially crafted RTF formatted data. A remote attacker could trigger this flaw by convincing a victim to open a malicious RTF file. Successful exploitation of this issue may corrupt system memory, allowing execution of arbitrary code on a vulnerable system.

Released 09/11/2010 and then last updated on 29/09/2016. If you had set that protections from threat year 2010 to be deactivated in your IPS profile thinking that something so old should be fixed/patched and it should be safe to deactivate. Assuming you did that in 2015 and then it got updated in 2016. Is this generally a bad idea to deactivate based on threat year? Would you in 2019 deactivate IPS protections with a threat year from 2010? I am also curious about what categories people in this community choose to deactivate in theirs IPS profile. If you can share your thoughts and experience with that I would appreciate that. Lets assume that resources on your firewall is not a dilemma and that you only use 1 IPS profile. 

5 Replies
Marco_Valenti
Advisor

I guess if you can' t update your ystem for 9 year ips won't save you anyway

0 Kudos
ED
Advisor

If we take the example above again which was released in 2010 and then 6 years later updated again at Check Point threatcloud for some reason. You decided in 2015 to deactivate protections which was 5 years back in time including this protection. In meantime you had not applied a Microsoft fix for this and this was an attack which made you vulnerable. It's just scenarios like these, can you comment on that? What are yours tips for deactivating categories in IPS profiles?

0 Kudos
Marco_Valenti
Advisor

This will intend that you have not made a microsoft update  in 5 year if I understand correctly , signature protection are based on very specific flaw of the software maybe check point improved that protection.You can always decide to take the risk and not update your software for more than 5 year , it is a possibility too.

Deactivating ips protecion should fit to your environment so you can decide to remove some server protection for software that are not in use into your organization , you should be able to do that for your client too.

Bottom line in my opinion as I said before if you don' t manage software update for more than 5 year or more don' t believe ips will save you but those are my two cents

0 Kudos
ED
Advisor

Marco, I see what I wrote above was not what I meant and can be misunderstood. I meant that you had previously applied Microsoft updates (until 2015) but not the updates after you decided to deactivate these protections (after 2015). And then CP comes with a protections for this in 2016 which makes it inactive. This is just hypothetical speaking imagining an example. 

0 Kudos
PhoneBoy
Admin
Admin

Unless it has a high/critical performance impact, or it's an SMB platform, you're probably not buying much by deactivating older IPS protections.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events