Best practices for firewall exceptions

Question

My company has a firewall set up which, among other things, scans incoming files for malware. The scanner alerted about a malicious file that was downloaded to one of our machines. After some investigating, I learned that this is a program that is necessary to one of the core functions of our company and needs to be downloaded periodically. Rather than adding the remote IP address as an exception in our firewall's malicious file scanner, I wanted to see if there are general best practices for handling firewall exceptions. It seems like any exception you add is exposing your network to any vulnerability on the remote network.

Is there a widely accepted best practice for deciding whether to add an exception to the firewall versus instead fixing the file or program? If you do end up adding an exception, what are some ways to minimize the possibility that that exception can be exploited?

I'd love any insight on the issue itself, or how the question could be improved. While I'm interested in security, I have very little practical experience with it.

Answer 1

There is no best practice, it's entirely based on a risk assessment. Risk is typically a relationship between Impact and Likelihood, lessened by Mitigations. Mitigations lower the Impact and/or the Likelihood. Each scenario and context for risk is different, which is why there is no one way, or best practice, to look at the problem.

Then you start brainstorming the effects of mitigations:

• What could happen if you did not do mitigation X?
• How much does X cost (in money, effort, etc.)?
• What other risks get introduced by doing X?
• What can be done to minimize those risks?
• ... repeat ...

But as a part of all that, you need to look at the operational impact of doing X at all.

You have an anti-virus on the firewall that is impacting critical business function every once in a while. You are worried that an infected file might slip through.

• How often? Can you mitigate by manually extracting the file and distribute it yourself to those who need it?
• Can you whitelist the file and confirm that the file is the approved file from the source? (checksums, signatures, etc.)
• Can you add a temporary exception or do exceptions need to be permanent?
• Can you scan the exempted file using a local anti-virus?

These are all questions with different impacts on your business function, and the likelihood and impact of the exemption causing a problem.

Answer 2

It depends on the cause of the problem and on the capability of the various systems involved (i.e. firewall, antivirus ...). In general you should identity the actual problem first and then find a way to fix it or work around it without introducing additional risk.

• The problem might be caused by a false positive of the antivirus. It might also be caused by the file being actually malicious, for example when explicitly transferring an archive with malware inside. Or something else.
• The reaction then depends on the cause of the problem. The action should be narrow to the specific problem to not broaden the attack surface too much. If you have control over the knowingly malicious file you can fix it that it is no longer seen as a problem, for example by encrypting it. If it was a false positive better contact your AV vendor. If only a selected user or application needs to download the file you might add an exception for this specific client, if your firewall allows such things. If it is a fixed binary you might add an exception exactly for this, if the firewall allows this.