Virus and Malware scanning: Caveats and Known Considerations

Edit online

Secure Proxy supports virus and malware scanning at the file/request level, that is, the entirety of the file/request will be scanned. Secure Proxy also supports Preview Scanning feature which when enabled allows a small amount of data, from the beginning of file/request to be sent, to the ICAP server. If there is no malware detected, ICAP Server requests Secure Proxy to send rest of the data for virus and malware scanning.

The following section defines implementation on scenarios, caveats, and known considerations related to ICAP anti virus and malware scanning in Secure Proxy.

Caveats
  • Secure Proxy does not write data to a disk in the DMZ and storing large files/requests in memory before they are scanned could create an out of memory issue. To mitigate this, Secure Proxy will limit the size of files/requests to scan with the new parameter, Maximum allowed file/request size, which defaults to 1 MB.
  • Waiting for complete files/requests to be received and scanned could also introduce additional lag into transmissions which might have performance implications. To mitigate this, system timeout values may need to be increased.
  • All the data buffers associated with a file/request transmission will be streamed and sent to the ICAP server. These data buffers will be combined as a scanning unit at the ICAP server.
  • When ICAP virus scanning is enabled over SFTP protocol and a virus is detected during the scanning operation, it is reported in the audit and log file and the file transmission is immediately aborted.
    • In addition, when ICAP is enabled on an Adapter, and if the total number active ICAP sessions in Secure Proxy (across multiple SFTP, CD, and HTTP Adapters) exceeds the Maximum allowed ICAP sessions value in the ICAP Configuration, the file is sent to the backend without scanning.
    • When a file is sent to the backend server without scanning, a default extension, .unscanned, is added to the file name for SFTP and HTTP protocol adapters. This extension value can be customized with a value defined under Rename Unscanned Files tab.
    • However, if ICAP Server could not be connected, or there occurs a failure during the scan, the session would fail or the file is sent to the backend with .unscanned or the custom extension appended to the file name. Secure Proxy can be configured to handle the ICAP Server connection failure behavior. Select radio button next to Session Fails or Send file/request unscanned to backend for the In case of ICAP Server connection failures field in ICAP Configuration.
  • When ICAP virus scanning is enabled over Connect:Direct protocol and a virus is detected during the scanning operation, it is reported in the audit and log file and the file transmission is immediately aborted. For ICAP anti virus or malware scanning implementation scenarios over Connect:Direct protocol and how it is handled via Secure Proxy, see the table given below.

    • In addition, when ICAP is enabled on an Adapter, and if the total number active ICAP sessions in Secure Proxy (across multiple SFTP, CD and HTTP Adapters) exceeds the Maximum allowed ICAP sessions value in the ICAP Configuration, then depending upon the ICAP configuration definition, either the session fails and a zero-length file is issued to the destination Connect:Direct server with message ID SSP0003I placed inside the FMH or the file is copied to the destination Connect:Direct server without an Anti Virus scan with a message ID SSP0002I placed inside the FMH and the file name does not change.

    • However, if the ICAP Server could not be connected, or there occurs a failure during the scan, either the session fails and a zero-length file is issued to the destination Connect:Direct server with message ID SSP0003I placed inside the FMH or the file is copied to the destination Connect:Direct server without an Anti Virus scan with a message ID SSP0002I placed inside the FMH. To specify options for handling ICAP Server connection failures, select ICAP Configuration - Advanced > In case of ICAP Server connection failures> Session Fails or Send file/request unscanned to backend.

    • If file size is greater than the Maximum allowed file/request size then a zero length file is issued to the backend server with a message ID SSP0005I placed inside the FMH.

    • If compression is on for a Connect:Direct file transfer, the ICAP AV scanning is skipped and file is sent to backend without scan with a message ID SSPS004I.
  • When ICAP virus scanning is enabled over HTTP protocol and a virus is detected during the scanning operation, it is reported in the audit and log file and the file/request transmission is immediately aborted.
    • In addition, when ICAP is enabled on an Adapter, and if the total number of active ICAP sessions in Secure Proxy (across multiple SFTP, CD and HTTP Adapters) exceeds the Maximum allowed ICAP sessions value in the ICAP Configuration, the file/request is sent to the backend without scanning.
    • When a file is sent to the backend server without scanning, a default extension, .unscanned is added to the file name for HTTP protocol adapter. This extension value can be customized with a value defined under Rename Unscanned Files tab.
    • When an HTTP request is sent to backend server without scanning, a default HTTP header "SCAN_SKIPPED = true" is added in the HTTP request before sending this request to the backend server. This header name and value can be customized using the two properties defined under Properties tab. Those properties are "icap.http.unscanned.header.key" and "icap.http.unscanned.header.value".
    • However, if ICAP Server could not be connected, or a failure occurs during the scan, the session would fail or the file/request is sent to the backend without scanning. If it's a file upload request then file name is also modified with .unscanned or the custom extension appended to the file name and an additional header "SCAN_SKIPPED =true" is added to the request before sending it to the backend server. Secure Proxy can be configured to handle the ICAP Server connection failure behavior by selecting Session Fails or Send file/request unscanned to backend for In case of ICAP Server connection failures field in ICAP configuration.

    • If file size is greater than the Maximum allowed file/request size or the file is sent in multiple parts then, file is sent to the backend without scanning. A default HTTP header "SCAN_SKIPPED = true" is added in the HTTP request before sending this request to the backend server. This header name and value can be customized using the two properties defined under Properties tab. Those properties are "icap.http.unscanned.header.key" and "icap.http.unscanned.header.value". In this case File is not renamed with default extension of ".unscanned".

    Note: SSP supports ICAP over HTTP protocol just for MFG2.0 and it does not support the legacy myfilegateway.
  • Secure Proxy buffers data up to the maximum size amount of data that is received from the client and sends it to the ICAP Server for Anti-virus scanning. ICAP Server does not return the data after virus scan. After the scan, Secure Proxy sends the cached data to the backend Server. This increases memory requirements on Secure Proxy Engine host, based on the expected concurrent sessions.
  • Increase the heap memory allocated to Java for Secure Proxy Engine, depending on the usage. Increase MAXHEAP size to sum total of number file sizes being transferred concurrently. Assuming maximum file size for scanning is 1MB and you have two SFTP adapters, each with max sessions set at 100, you need to increase the MAXHEAP parameter by 200 MB. To modify the MAXHEAP parameter see, Modify heap size.

Known Considerations

  • All supported ICAP server are enabled for and support a secure connection. This is required for privacy, confidentiality, and integrity.

  • In case of a failed scan, Secure Proxy terminates the session when a malware/virus is detected and is reported by the ICAP Server/AV Scanner.
  • No support for Data Loss Prevention (DLP) on the files that are downloaded in the current release.
  • Checkpoint restart is not recommended when using ICAP scanning with the Connect:Direct protocol. Under most circumstances, a copy that is interrupted will restart from the beginning.

    When ICAP anti-virus scanning is enabled for Connect:Direct Proxy Adapter, checkpoint enabling functionality is not found to be very useful. The entire file is cached at Secure Proxy and no data is sent to SNode until anti-virus scanning is complete. Therefore, any interruption and restart during a transfer will most likely start from the beginning.

The following table describes ICAP anti virus or malware scanning implementation scenarios over SFTP, HTTP, and Connect:Direct protocols and how it is handled via Secure Proxy.

Table 1. ICAP Anti-Virus scan via Secure Proxy: implementation scenarios and their handling
Scenario Action
SFTP Protocol
An ICAP server connection error/response timeout occurs or an ICAP server returns an error Options available:
  • Fail the session with error
  • File is sent to the standard backend server without scan and .unscanned or custom extension string appended at the end of the file name
File exceed the maximum file size limit specified in the Secure Proxy CM GUI (ICAP configuration) File is sent to the standard outbound node with .unscanned or custom extension string appended at the end of the file name.
File fails anti-virus scanning that is, a malware/virus is detected An audit log event is generated. The file is not sent to the backend server and the session is terminated.
The file name extension is outside the selected extensions for anti-virus scanning The file is sent to the backend server bypassing sending to the ICAP server and an audit log is generated.
Connect:Direct Protocol
An ICAP server connection using Connect:Direct protocol error/response timeout occurs or an ICAP server returns an error Options available:

  • Fail the session with error

    In this case, a zero-length file is issued to the destination Connect:Direct server. The file name does not change. Message ID SSP0003I will be placed inside the FMH.

  • The file is copied to the destination Connect:Direct server without an Anti Virus scan. The file name does not change. Message ID SSP0002I will be placed inside the FMH.
File fails anti-virus scanning that is, a malware/virus is detected An audit log event is generated. The file is not sent to the backend server and the session is terminated. A zero-length file is issued on the destination Connect:Direct server. The file name is not change. Message ID SSPS001I is placed inside the FMH.
File exceed the maximum file size limit specified in the Secure Proxy CM GUI (ICAP configuration) Unscanned file is sent to the standard outbound node. The file is copied to the destination Connect:Direct server without an Anti Virus scan. The file name does not be change. Message ID SSP0005I is placed inside the FMH.
The file name extension is outside the selected extensions for anti-virus scanning The file is sent to the backend server bypassing sending to the ICAP server unscanned. Note that .unscanned string is not appended at the end of the file name.
HTTP Protocol
An ICAP server connection error/ response timeout occurs or an ICAP server returns an error
Options available:
  • Fail the session with error
  • Request is sent to the standard backend server without scan and "SCAN_SKIPPED = true" or a custom header is added to the request. In case it is a file upload request, then file name appended with .unscanned or custom extension string appended at the end of the file name.
Request exceed the maximum file/ request size limit specified in the Secure Proxy CM GUI (ICAP configuration) Request is sent to the standard outbound node and "SCAN_SKIPPED = true" header is added to the request.
Note: File renaming is not done in this scenario.
Request fails anti-virus scanning that is, a malware/virus is detected An audit log event is generated. The file/request is not sent to the backend server and the session is terminated.
File is sent in multiple parts by MFG2.0 to SSP Unscanned file is sent to outbound node and "SCAN_SKIPPED = true" header is added to the request.
Note: File renaming is not done in this scenario.