WSA - File analysis for Microsoft Documents with Macros

[Paul Cardelli]

I was wondering if WSA has any file analysis capabilities beyond anti-malware detection. Something we could setup a simple filter for similar to a content filter in an ESA appliance. We have had a number of malicious files getting through the WSA, and have been a bit worried with the influx of Ransomeware and other Trojans taking advantage of Macros in word documents.

I understand there would be some limitations on the size of the document, but this could potentially catch items that normal virus scanning would miss regardless of the extension.

[Ken Stieers]

In Web Security Manager/Access Polices, you can filter specific file types, but nothing like the control we have with a WSA.

[Paul Cardelli]

Yeah I think you understand what I'm talking about. I have AMP on my ESA, but not on the WSA yet. I can see the value of adding it, but I think it would still not give me the ability to filter files like we can on the ESA as people are already in the process of downloading them.

[Handy Putra]

Recommend to contact your Cisco Rep and query for AMP (Advanced Malware Protection) that does File Reputation Filtering and File Analysis if you have not have that feature already in WSA scanning engine.

[Paul Cardelli]

I'll have to demo this feature out on the WSA, I like it on the ESA. I don't think this will give us the same power we have even without AMP to analysis file attachments through the ESA that I would expect when downloading files through the WSA. Not knocking the AMP, as it still serves a purpose.