Sonicwall NSv Remediation Guide for Fingerprint - Network Security Check

Configuration guideline for Sonicwall NSv Next Generation Firewall - Mitigate Instant Security Check Tests

High Level Test Overview - Matching Features

High Level View of Licensing and Required Features for Mitigation:

1. Browser Security - Local Browser Configuration - https://support.google.com/chrome/answer/95472?co=GENIE.Platform%3DDesktop&hl=en

2. Network Access Protection - NGFW

   1. Block access to adult website - Web Filtering

   2. Block websites in embargoed countries - Geo IP

   3. Block access to anonymizing websites - Web Filtering

   4. Cross-Site Scripting Scanning Attempt via http, get - IPS

   5. Cross-Site Scripting Scanning Attempt via https, get - IPS

   6. JS Cryptojacking via http, get - IPS

   7. JS Cryptojacking via https, get - IPS

   8. SQL Injection in GET request via http - IPS

   9. SQL Injection in GET request via https - IPS

3. Data Encryption - Local Browser Configuration and HTTPS Inspection

   1. Certificate Validation

   2. Broken Cryptography

   3. Domain Security Policies

   4. SSL inspection

4. Online Privacy - Local Browser Configuration - Do Not track Option -https://support.google.com/chrome/answer/114836?co=GENIE.Platform%3DDesktop&hl=en

5. Malware Protection - NGTP

   1. Download EICAR file via http - Anti Virus

   2. Download EICAR file via https - Anti Virus + SSLi

   3. Download EICAR text file via http - Ant iVirus

   4. Download EICAR text file via https - Anti Virus + SSLi

   5. Download EICAR text file inside zip via http - Anti Virus

   6. Download EICAR text file inside zip via https - Anti Virus + SSLi

   7. Download EICAR file zipped 2 times via http - Anti Virus

   8. Download EICAR file zipped 2 times via https - Anti Virus + SSLi

   9. Download EICAR file zipped 5 times via http - Anti Virus

   10. Download EICAR file zipped 5 times via https - Anti Virus + SSLi

   11. Download EICAR file zipped with '123456' password via http - Anti Virus

   12. Download EICAR file zipped with '123456' password via https - Anti Virus + SSLi

   13. Download EICAR file zipped with 'password' password via http - Anti Virus

   14. Download EICAR file zipped with 'password' password via https - Anti Virus + SSLi

6. Data Protection - DLP

   1. SSN codes leak via https - DLP +SSLi

   2. SSN codes leak via http - DLP

   3. Local Country SSN code leak via https - DLP +SSLi

   4. Local Country SSN code leak via http - DLP

   5. Credit card numbers leak via https - DLP +SSLi

   6. Credit card numbers leak via http - DLP

   7. Source code (C) leak via https - DLP +SSLi

   8. Source code (C) leak via http - DLP

   9. SSH private key leak via https - DLP +SSLi

   10. SSH private key leak via http - DLP

Configuration for Sonicwall NSv

Set-up a basic installation following the documentation here.

Make sure to activate the features below and check that you have the correct licensing as follows:

Gateway Anti-malware/Intrusion Prevention/App Control

Content Filtering Service

Capture Advanced Threat Protection

In order to have the checks for HTTPS websites we would need to first configure HTTPS Inspection

References:

https://www.sonicwall.com/support/knowledge-base/how-to-decrypt-https-traffic-using-dpi-ssl/170505885674291/

1. Login to your Sonicwall Management GUI

2. Navigate to Policy| Deep Packet Inspection| On the Client SSL page, check Enable SSL Client Inspection. Once DPI-SSL Client Inspection is enabled, SonicWall will seamlessly and transparently decrypt all SSL traffic passing through it. You will be able to apply Security Services on the clear-text portion of the SSL encrypted payload passing through it.

3. Before enabling SSL Client Inspection to make sure you have imported the client DPI-SSL Certificate on all the protected computers otherwise the network may be impacted as all HTTPS websites will start showing a Certificate Error.

Make sure to export the CA certificate by clicking the Download Link. You can also import a certificate from your own CA but this needs to have the ability to create other certificates and sign them. Import the downloaded certificate into either “AD” Trusted Root or each local host Trusted Root certificate store.

For Chrome/Mozilla the procedure is a bit different and will be discussed in a dedicated article.

Once HTTPS Inspection is active you can check any HTTPS Site’s certificate when passing the Security Gateway. It should look like it was signed by the CA of the Sonicwall NSv Firewall.

 On the firewall go to Policy | Deep Packet Inspection | SSL Client Deployment | Certificate page, click on the (download) link to download the Default SonicWall DPI-SSL Certificate Authority (CA) Certificate.

Make sure to have Decryption policy enabled in order to inspect HTTPS traffic. This could be configured for specific source subnets or hosts as needed.

In the case of Sonicwall NSv the Decryption tab is in Device > Settings > Decryption (DPI-SSL).

Here you need to enable SSL Client Inspection in the General tab and export the Inspection Certificate from the Certificate tab.

Adding a Decryption rule:

Mitigation for Specific Tests

Network Access Protection - NGFW

Create a specific policy with all protections enabled

Navigate to Policy > Rules and Policies > Security Policy

Add a Rule to allow outbound DNS.

Add a Rule to Drop QUIC Protocol. QUIC needs to be defined as a Service object with UDP/443. You would need to define the QUIC Port/Service as it does not exist by default.

Note: DISCARD would silently drop the packet while DENY would show a captive portal with the message that the traffic was dropped. Please choose DISCARD

Add a Rule to Filter Outbound traffic with all Protections enabled. Make sure to attach a Security Profile to the rule

It should look like this:

Check the Match Operation is OR and select App Category Group and Web Category.

Attach a Web Category to this rule by browsing to the APP/URL/Custom Match Tab. Add a new Web Category group. Make sure to add Adult/Mature Content, Malware, Pornography and Hacking/Proxy Avoidance Systems

Attach an App Category Group to this rule. Add a new App Category Group. Select High Risk Apps, MINERS, Severe Risk Apps and VPN categories:

Final rule should look like this:

Click on Add to apply the rules.

Block Websites in embargoed countries - Geo IP

Add an additional Discard rule on Top of the previous rules.

Select User & countries and create a new Country group. Attach desired countries to be blocked (i.e Democratic People’s Republic of Korea and Iran.

Block Cross-Site Scripting Scanning Attempt, SQL Injection and other Intrusion Attempts - IPS

Make sure that the Security Profile assigned to the block rule has IPS Enabled.

References: https://www.sonicwall.com/support/knowledge-base/how-ips-intrusion-prevention-services-works/170504979028241/

Block Malware Downloads - Anti Virus

Make sure that the Security Profile assigned to the block rule has Anti Virus Enabled, and especially Enable detection of EICAR Test Virus.

References: https://www.sonicwall.com/support/knowledge-base/how-to-enable-gateway-anti-virus-anti-spyware-and-intrusion-prevention-mechanisms/170504349078273/

Certificate Validation and Broken Cryptography - SSLi

SSL Client Inspection protections need to be enabled especially from Policy > Rules and Policies >Settings > Decryption (DPI-SSL)

Always authenticate server for decrypted connections and Always authenticate server before applying exclusion policy to mitigate situations where the upstream certificate is either insecure or untrusted

Domain Security Policies - mitigated

Online Privacy

Data Leak Protection

Sonicwall NSv only supports full DLP features in correlation with Advanced Licenses for Sonicwall Cloud App Security

References:

https://www.sonicwall.com/support/technical-documentation/docs/cas-administration_guide_box/Content/Policies/policies-adding-dlp.htm/

https://www.sonicwall.com/products/cloud-security/cloud-app-security/

The NSv or NSG version do support file based restrictions:

https://www.sonicwall.com/support/knowledge-base/how-to-block-http-downloads-or-uploads-of-specific-file-extensions-using-app-rules/170503921808804/

Results after configuration is according to this guide: