Trend Micro InterScan M Series, Administrator'S Manual

Page: 316 / 480

Trend Micro™ InterScan™ Gateway Security Appliance M-Series Administrator’s Guide
14
-
14
Best Practices
Handling Compressed Files
Compressed files provide a number of special security concerns. In short, compressed
files can be password-protected or encrypted, they can harbor so-called "zip-of-death"
threats, and they can contain within them numerous layers of compression.
To balance security and performance, Trend Micro recommends that you read the
following before choosing compressed file settings:
Block compressed files if...
Decompressed file count exceeds:
Set the number of files within a compressed archive at which InterScan Gateway
Security Appliance should stop extracting.
For example, have InterScan Gateway Security Appliance abandon the extraction
after 1,000 files.
Whenever the limit is reached, the original archive, and any decompressed files, is
deleted. In addition to benefiting overall scan efficiency, setting an upper limit for
decompression can prevent "zip of death" attacks designed to crash vulnerable virus
scanning programs.
Size of a decompressed file exceeds:
Set the maximum size that files being extracted from a compressed archive are
allowed to reach.
Once the limit is reached, the original archive, and any decompressed files, is
deleted. As with
Number of files , setting an upper size limit for decompression can
help prevent the “zip of death” attack.
Number of layers of compression exceeds:
Set the maximum number of layers (compressed file within a compressed file) you
want InterScan Gateway Security Appliance to scan down through. The system maxi-
mum is 20.