We have a requirement to handle PDF's by external entities & these PDF's go to our internal network. The internal network from this view-point isn't obviously totally isolated.
We thought to use the VirusTotal API after initial research & get these docs scanned before having them go towards the internal network. Virus total is a service and we will end up sending our documents to an external org i.e. VirusTotal & that's something the stakeholders do not approve of.
Things we are looking for as a medium scale company requirement:
- At this point we cannot afford an enterprise solution. We have tried opensource solutions; however these solutions fail at detecting malware which is crafted & isn't always reliable.
- A set of instruction to have a middle-man solution where-by the docs need not be sent to an external org & at the same time, the solution should be able to detect threats efficiently.
How do we handle the threat as threat surface is the requirement functionality & as tested by our malware team that many PDF's could be having embedded malware which if executed can open up a back connection to unknown hosts? IPtables, firewalls etc are fine .. but if it however doesn't connects to any system & instead does malicious activities such as delete sys files, etc .. that would be another problem.
Edit 1: As per comments, one raised questions were, where did the PDF get channelized from. It's evident from the OP itself that the link is TCP/IP connection via an upload functionality which is then taken to an internal server (pseduo-internal, as it has one external opening access).