Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

Palo Alto, and probably others firewalls will offer it, has a feature to do malware analysis in a separate (cloud-based) process that does not impact stream processing. What I would like which risks could be related with this approach. Some problems that I thought:

  • Privacy: Which kind of data is sent to the cloud based anti-malware solution? There is any kind of risk associated or any kind of way to guarantee that has no information leak?

  • If somebody/group DDoS the cloud provider. Does it affect my firewall anyhow?

  • If its a targeted attack and the cloud detect the attack. As it isn't streamed, can be that it will be too late when it detects the attack?

share|improve this question
1  
These questions might be better for a rep of Palo Alto to answer. – Lucas Kauffman Jan 23 '12 at 6:21
@BillFrank may be able to provide useful info? – Rory Alsop♦ Jan 23 '12 at 9:01
@LucasKauffman I can edit and remove the firewall name. I think it will be a common pattern in next generation firewalls – VP. Jan 23 '12 at 12:13
Cloud based malware analysis would likely mean different things to different vendors. A real time transfer such as HTTP would either need a local malware analysis engine or to pass traffic when the cloud was unreachable. Typically this is either a execution sandbox or reputation service, or both and would depend on the implementation. – Bernie White Jan 26 '12 at 20:52
@Bernie White, that's why there is a practical example in my question. To Palo Alto FW it means something, and to their implementation I would like to know how they address those topics. To remove the FW name and add the term "Cloud based malware analysis" would be to generic – VP. Jan 27 '12 at 0:15

1 Answer

up vote 1 down vote

All Firewall/ IPS vendors have a license option to use their "Intelligence Network". It has been evolving slowly across the security vendors over past 5 years. The intelligence or cloud network is collection of their devices across the customer base. These devices all report up to the vendor "cloud" or intelligence center. Once they collect and score they are sent back out to the network of those people that have subcribed to the network for reputation updates.

That being said - you would not be effected at your Firewall / IPS layer if you are subscribing to the network. If the service go down, you loose update subscription. The attack you are talking about could be shutdown by the intelligence service, since they control the pivot point in the connection of all the devices down stream, including DDOS.

share|improve this answer
can you give me a reference for: All Firewall/ IPS vendors have a license option to use their "Intelligence Network"? – VP. Mar 3 '12 at 16:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.