Security Profiles

What are Security Profiles?
Security Profiles provide Layer 7 threat inspection on traffic that is already allowed by the firewall policy.

They help detect and block:
• Malware
• Vulnerabilities
• Spyware
• Malicious URLs
• Suspicious files
• Data exfiltration

Security Profiles are attached to Security Policies.

#Types of Security Profiles in Palo Alto Firewall
1️⃣ Antivirus Profile
Detects and blocks viruses, trojans, worms, and malware in traffic.
Example:
The user downloads a file from the internet.
Firewall scans the file using threat signatures.
Use Cases: Want to Prevent malware download
• Scan HTTP, FTP, SMTP, POP3 traffic

2️⃣ Anti-Spyware Profile
Detects command-and-control (C2) communication from infected machines.
Example: An infected laptop tries to communicate with a malicious botnet server.
Firewall blocks the connection.
Use Cases: Want to detects infected hosts
• Prevent data exfiltration

3️⃣ Vulnerability Protection Profile
Protects servers from known application exploits.
Example: Attacker attempts SQL injection on a web server.
Firewall blocks the attack before reaching the server.
Use Cases: Want to Protect web servers
• Block exploit attempts

4️⃣ URL Filtering Profile
Controls which websites users can access.
Example:
Allow: ✔ business websites
✔ education sites
Block: ❌ gambling
❌ phishing
❌ malware sites

5️⃣ File Blocking Profile
Controls file uploads and downloads.
Example:
Block: ❌ .exe files from internet
Allow: ✔ pdf files
Use Case: Prevent users from downloading malware executables.

6️⃣ WildFire Analysis
Unknown files are sent to Palo Alto WildFire cloud sandbox.
If malware is detected:
✔ Signature is created
✔ Protection applied globally
This provides zero-day threat protection.

⚙️ How Security Profiles Work (Traffic Flow)
Client → Firewall Policy → Security Profiles → Destination Server

Example Flow:
User downloads a file
1️⃣ Security policy allows traffic
2️⃣ Antivirus scans the file
3️⃣ URL filtering checks website reputation
4️⃣ WildFire analyzes unknown files
5️⃣ Firewall allows or blocks traffic

🧩 Example Scenario
Company users access the internet.
Policy configuration:
Source Zone: Trust
Destination Zone: Untrust
Application: web-browsing
Action: Allow
Attached Security Profiles:
✔ Antivirus
✔ Anti-Spyware
✔ Vulnerability Protection
✔ URL Filtering
✔ File Blocking
✔ WildFire