Malware Cloud lookup privacy concern

[mo shea]

Hello,

Does the Firesight Manager send actual files to the malware lookup cloud for sand box scanning or only hashes. One of our management team raised a concern of sensitive files being sent to the cloud, perhaps if the cloud is hacked then such files can be leaked. Can someone elaborate on the cloud lookup process

All help is appreciated

Regards,

Moe Shea

[Karsten Iwen]

You can have it both ways. First a hash is sent to the cloud. And if you configure it that way, the file can be sent to the cloud for inspection.

There is also the option to do a private cloud install for inspection. But that's quite expensive and not the way it's really designed to work.

[mo shea]

Thanks Karsten for the reply,

Could you tell me where to make this selection, i.e. only send the hash and not the file, because in the action drop down menu I have the following selection,

=========

Detect Files

Block Files

Malware Cloud Lookup

Block Malware

=========

Regards,

Moe Shea

[Karsten Iwen]

It's enabled directly below your mentioned options: "Dynamic Analysis".

[mo shea]

Thanks Karsten for the feedback,

To reconfirm, if I select the Dynamic Analysis then the files will be submitted, otherwise no files will be submitted hence no fear of files being leaked, only hashes and exe (with Spero selected), right?

[Karsten Iwen]

Nearly correct. Also if it's disabled in the File policy, an Admin could send a file manually to dynamic analysis. But for sure, that won't happen without manual action.