Filtering based on file type
When filtering files, it is often useful to filter based on the file type. When malware finds a file type that allows them access to a system, the filename will change but the file type will remain the same. Even for preventing applications that are not malware but simply undesirable, filtering based on file type is often the easiest method.
Simply matching the file type, .zip for example, may not be as accurate a method as using the built-in patterns. If users see that .zip attachments are blocked, they may simply rename the file so the filters will allow it through. Checking against patterns can help prevent this bypassing.
There are two possible methods available to filter based on file type. If the file type is one of the built-in patterns, you can use them - for example blocking PalmOS files on your network since Palm devices are not supported. Otherwise, you can simply use wildcards to match the file type.
The following example will filter all batch files (.bat).
To filter files based on file type using file name pattern - web-based manager
1. Go to Security Profiles > Data Leak Prevention > File Filter.
2. Select Create New and name the list blockedFileTypes.
3. Select Create New to add files to the list.
4. Select File name pattern for Filter Type.
5. Enter *.bat for Pattern.
6. Select an Action of Block.
7. Select Enable and OK.
8. At the file filter list, select OK.
The file filter is now available to be used in an MMS profile, and will block all .bat files that MMS profile matches.
To filter files based on file type using file type - web-based manager
1. Go to Security Profiles > Data Leak Prevention > File Filter.
2. Select Create New and name the list blockedFileTypes.
3. Select Create New to add files to the list.
4. Select File Type for Filter Type.
5. Select Batch File (bat) for File Type.
6. Select an Action of Block.
7. Select Enable and OK.
8. At the file filter list, select OK.
The file filter is now available to be used in an MMS profile, and will block all batch files (that use .bat file extension) that the MMS profile matches.