The PA-4000 Series can add visibility and control into your network for webmail applications to stop incoming threats and limit uploaded data.

Transcription

1 Controlling Webmail Tech Note Overview Webmail interfaces are widespread and available from search providers (Yahoo, Google), software vendors (Microsoft s Hotmail), social networking sites (Myspace, Facebook), Internet Service Providers (Comcast, Cox), enterprise mail systems (Outlook Web Access for Exchange) and universities. Almost any organization with mail service offers a web interface to its users for convenient access. Checking your is no longer defined by how the messages are transmitted, but by the nature of the application. With communications, anyone can attempt to send anyone else a message, opening the door to phishing and malware attacks. Often, blended attacks use an a vector to trick users into visiting a website where a phishing or malware executable is located. Even if an gateway device is on your network to stop spam, phishing, and malware attacks, it won t have any effect on webmail. The PA-4000 Series can add visibility and control into your network for webmail applications to stop incoming threats and limit uploaded data. This Tech Note reviews the requirements and steps necessary to gain control over webmail on your network. The steps involved are: Setup SSL Decryptions Setup allowed outbound applications Monitor Webmail Apply Security Profiles to Webmail Block Webmail SSL Interception is not required, but is recommended for the widest range of visibility and control. Controlling Webmail Tech Note rev00c Palo Alto Networks

2 Requirements PA-4000 Series installed and running PA-4000 Series SSL Certificates trusted by desktops 1 URL filtering option (for SSL Decryption) Selective SSL Decryption No traffic is decrypted by default. Setup SSL decryption to decrypt URL filtering categories likely to hold webmail applications. To gain visibility into SSL traffic, open up the PA-4000 Series web interface and do the following: In the Policies Tab, select the SSL Decryption option from the left hand menu Add in a rule from Trust to Untrust (or other applicable zones) Chose either 1) the minimal categories for webmail or 2) all categories except unknown and infrastructure to decrypt: For the minimum, add the following categories to the rule 2 : chat,computingand-internet, downloads, games,infrastructure, peer-to-peer, personals-anddating, proxies-and-translators, search-engines, web-based- . For a wider scope, add 2 rules. Chose the category unknown and infrastructure for no-decrypt, then decrypt everything else. 1 See the Palo Alto Network Tech Note on SSL Decryption Certificates for more information 2 See the Palo Alto Networks Tech Note on SSL Decryption for more information on selecting SSL Decryption Categories Controlling Webmail Tech Note rev00c Palo Alto Networks

3 Commit your new policy Security Rulebase If the Security Rulebase does not have a rule allowing traffic outbound, add in a rule for applications allowed at this time. Monitoring by App-ID View the amount of webmail on your network two different ways: by App-ID or by URL categorization. To view reports for previous day s traffic by Application, in the Monitor Tab of the web interface to the PA-4000 Series, under Reports, select Applications from the left hand side menu. Webmail is an Application category. The Applications report lists webmail applications individually. The current list of webmail applications includes: aim-mail fastmail gmail hotmail myspac outlook-web 3 yahoo-mail yousendit Select a webmail applications from the report to view the application profile, as in the graphic on the next page. 3 Outlook Web Access (OWA) is listed under the App-ID Category of due to its business nature Controlling Webmail Tech Note rev00c Palo Alto Networks

4 If you have a specific webmail application in mind to view logs for, visit the Traffic log interface, also under the Monitor Tab, which is found beneath Logs. The Traffic log has a filter interface where you can specify individual Applications and other parameters. Controlling Webmail Tech Note rev00c Palo Alto Networks

5 Monitoring by web-based- Category To view reports based on individual URLs, visit the Reports section of the Monitor Tab for the URL Categories, URL Users, and URL Behavior reports. Below is a snapshot of the URL Categories report. Applying Profiles Traffic allowed on the network can be checked for threats and stopped if detected. For any rules allowing access to untrusted networks, consider applying the Anti-Virus, Vulnerability, Anti- Spyware, URL Filtering and File-Blocking profiles. To enable virus-scanning, create a new Antivirus Profile. Default values are recommended, except the Application SMTP should be changed to alert. To scan traffic for known vulnerabilities, select the default Vulnerability Protection Profile. To stop spyware, select the default Anti- Spyware Profile. To block unwanted categories, create a new URL Filtering Profile and change those categories from allow to block. To control file uploads and downloads by file type, create a File Blocking Profile. To control webmail attachments, use this profile. Controlling Webmail Tech Note rev00c Palo Alto Networks

6 Blocking Webmail Install a policy to block unwanted webmail from your network. To block any webmail applications, add a rule to the top of your Security policy and proceed to: Edit the Application section of the rule and add in category:webmail and/or outlookweb Under Action for the rule, select Deny Commit the Rule If you have the optional URL Filtering option, block by the category web-based- . Locate the existing security rule allowing web browsing and proceed to: Edit the Profile section of the rule (all the way to the right of the rule row) Select your previously created URL Filtering profile (or create a new one if it doesn t yet exist) Scroll to the bottom of the URL list and change the option for web-based- from allow to block Select OK from the URL profile; select OK for the Profile window Commit your new configuration If a new URL Filtering profile was created, a new icon in the Profile column appears in the rule. Verify the correct operations of the rules by monitoring the Traffic logs and the Application and URL reports under the Monitor tab. Controlling Webmail Tech Note rev00c Palo Alto Networks

7 Whitelisting Webmail It may be necessary to allow access to select webmail instances, while blocking all other webmail sites. If certain webmail instances are allowed while some applications are not, make sure the Security rulebase is setup to first allow named traffic, followed by a deny rule for everything else. To do this, make sure App-ID and the URL Filtering list allow the traffic in the first rule. This rule will list out allowed applications, whitelisted URL Filtering websites, and the allowed URL Filtering Profile. The second rule should deny for all other traffic. This last deny rule happens implicitly - it may not be necessary, depending on other parts of the rulebase. Comment Application Action Profile Allowed Applications and URLs Allowed Apps Allow (optional URL Filtering Profile with blocked URL Filtering categories & whitelisted servers) (optional/implicit Deny all other traffic) any Deny (none necessary) If any websites need to be added to the URL filtering whitelist, enter the server names in the URL Filtering profile. Edit the whitelist in the URL filtering profile by adding the hostname of the allowed site as in the example below. Recap: SSL Decryption With URL filtering option: Comment Destination Address Category Action Whitelist for no decrypt Minimal categories to inspect (optional/ implicit nodecrypt (list of IP addresses for servers) any any chat,computing-and-internet, downloads, games,infrastructure, peer-to-peer, personalsand-dating, proxies-and-translators, searchengines, web-based- no-decrypt decrypt any any no-decrypt Controlling Webmail Tech Note rev00c Palo Alto Networks

8 Recap: Controlling Applications Option 1: Blocking (no whitelisting) Comment Application Action Profile Denied Applications Denied Apps Deny (none required) Allowed Applications any Allow optional URL Filtering Profile with blocked URL Filtering categories; Antivirus, Vulnerability Protection, Anti-Spyware, File Blocking Profiles Option 2: Blocking with whitelisting option Comment Application Action Profile Allowed Applications and URLs (optional/implicit Deny all other traffic) Allowed Apps Allow any Deny (none necessary) In general, more specific rules always go before more general rules. optional URL Filtering Profile with blocked URL Filtering categories and/or whitelisted sites; Antivirus, Vulnerability Protection, Anti- Spyware, File Blocking Profiles Advanced Policies This document reviewed the minimal number of categories to SSL decrypt for best visibility and control over webmail traffic. This is a baseline to being inspecting webmail and SSL traffic. After implementing this policy on your network and reviewing the logs and reports, you are free to implement more aggressive SSL decryption and Security Profiles. Adding New Webmail Applications If webmail application are not identified by your PA-4000 Series, you are invited to submit the application to our Application Resource Center on the Palo Alto Networks website, located at 1/15/08 Controlling Webmail Tech Note rev00c Palo Alto Networks