1

We have Fortigate 100D that has antivirus profiles enabled like SMPT, POP3 and IMAP.
How one could make sure that the antivirus is working as expected ?

For instance it seems that Fortigate has already signature for "Locky" malware but one of our PC was infected.

So what are best appraoch to test inhouse firewall effectiveness ?

1 Answer 1

4

Testing if the detection is configured properly can be done by using the EICAR test virus. This virus is harmless by itself but every malware detection should be able to detect it even if it has no current signatures.

Of course this will only tell you if the firewall is properly setup at all. It gives you no information about the effectiveness of the protection, i.e. how good it protects against existing malware and how fast it will catch up with new malware. No firewall is able to offer you full protection no matter what they claim because they need to catch up with new strains of malware too. To find out how fast the vendor reacts to new attacks you can not believe marketing claims but you have to ask others who've used the products or independent researchers.

Apart from that the analysis in such firewalls (UTM, NGFW...) can often be easily bypassed. Small modifications of the traffic are usually enough to make such firewalls blind. In case of web traffic you can verify marketing claims by using my HTTP evader test site with you browser (see these details for how it works). And while I don't have a similar automated analysis tool for SMTP, POP, IMAP etc yet I've did similar research for mails which also shows easy ways for bypassing analysis.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .