Best Practices for Configuring Security Policies

The tables in Default Global Policy Feed Configuration Recommendation list the default actions and precedence for the Feeds and Threat Insight rules in the Default Global Policy offered by Infoblox as of May 2024. The default actions and precedence described apply only to new accounts created on or after August 31, 2023. Accounts created and configured prior to August 31, 2023 will not be affected by the new default actions and/or precedence described. In the case of prior existing accounts, the actions and precedence in effect at the time of custom list creation will not be altered. 

Ensure that you understand the ramification of overriding the default action for any threat Feeds and Threat Insight rules before doing so.

Policy and Feeds Configuration Recommendations

Configure the Custom List, and then set up additional feeds and filters in two sections: Block and Allow. Feeds are prioritized above filter rules in each section, and block rules should be established before allowing rules. The high confidence feeds should be placed above the other feeds in each Block and Allow section, then the medium confidence feeds should be placed below them. Lastly, the low confidence feeds should be placed below the medium confidence feeds.

• When configuring feed precedence order, the default Allow and default Block go on the top section. Depending on your subscription level, each Feed and Threat Insight policy in the Default Global Policy comes with a default action. Please remember to prioritize feeds configured with a Block action (Block - No Redirect, Block - Default Redirect, and/or Block - Redirect - <custom redirect name>) by placing them in positions of higher precedence in your policy compared to feeds configured with an Allow action (Allow - With Log, Allow - No Log, and/or Allow - Local Resolution). Within each of the Block and Allow section, place the high confidence feeds first, followed by medium confidence feeds and finally, the low confidences feed. Placing Blocked feeds higher in policy precedence order than Allowed feeds ensures that none of malicious domains are not allowed inadvertently, allowing security policy to perform as intended.

• Given that IP addresses can be reused over a period of time, blocking IP addresses is riskier than blocking domains or hostnames. So, to avoid false positives, for those external or third-party IP-based feeds like DHS_AIS_IP that are added to policy through voluntary addition (other than what’s provided by default), Infoblox recommends only an Allow-With Log policy action and not a Block policy action.

• Make sure that Geolocation option is enabled in Security Policy to ensure that the ECS supported domains should get DNS response accordingly from the authoritative nameservers. For more information, see Best Practices for Data Connector. 

• Make sure that the precedence order assigned to the Security Policies is properly configured.