Introduction

Despite an airtight rule base, stateful inspection, and a well thought-out SmartDefense implementation, your network still remains susceptible to viruses. Users may inadvertently contract a virus through e-mail or over the Web. Once infected, a user s workstation, sitting behind your firewall, grants the virus access to the entire network segment, allowing it to spread unobstructed throughout your network. In addition, you may be inclined to block your users from accessing certain URLs, and CVP allows for this based on a variety of factors.

To combat the threat of virus infection, Check Point Firewall-1 provides content-level filtering via the Content Vectoring Protocol (CVP). CVP allows you to utilize any OPSEC-certified product to perform such tasks as virus scanning, e-mail content screening, and URL filtering via the Uniform Filtering Protocol (UFP). For a complete list of vendors that are part of the OPSEC alliance, see www.opsec.com. These vendors also develop tools that can be used through CVP to enhance the ability of your firewall to combat content-related threats.

In this chapter, we cover several methods of implementing content-level inspection, specifically scanning e-mail for viruses. We also touch on some other CVP/UFP-based OPSEC products and detail any traps and pitfalls you may encounter.

Using CVP for Virus Scanning E-Mail

Although any thorough security policy should include virus protection at the desktop level, it makes sense to consider scanning incoming e-mail for viruses to prevent malicious code from even reaching the PC. The combination of these two levels of virus scanning further reduces...