Articles in this section

Defining Policy by File Type

Jo Gore
  • Updated
Follow

Defining Policy by File Type

Votiro's Secure File Gateway - Define Policy by File Type

When defining a policy by file type, you can perform the following actions:

nBlock the file under all conditions. You can edit the default notification about the blocked file.
nSanitize the file using default sanitization settings. You can modify the default behavior by setting options when they are provided (for example, as in the image above). You can also edit the default block reason text.
nAllow the file under all conditions.
nAdd one or more exceptions to any of the previous three settings. For more information, see Defining Exceptions.

After you save the settings for the file type, the display updates to show the action symbol in the Default Action column and the number of exceptions in the Exceptions column.

The following table describes the sanitization options that are available for each file type:

File Type

Description

Sanitization Options

PDF

Specifies how to sanitize PDF files.

Note

For managing the compression level when processing flat streams in PDF files see Compression Levels.

By default, these files are sanitized.

nFlatten file: Flattens PDF documents, preserving reading and editing capabilities. Default is unchecked.

Note 

If you have selected Flatten File, other options are unavailable.

nRemove multimedia: Specifies whether multimedia such as embedded video, audio, 3D annotations, and rich media annotations must be removed. Default is checked.
nClean embedded fonts: Specifies whether embedded fonts must be sanitized. Default is checked.
nRemove Remote Access: Specifies whether communications to an external server must be disabled. Default is checked.
nBlock files with suspicious links: Performs a check of all HTTP:// and HTTPS:// links. If a link is found to be suspicious, the file is blocked.

When this option is selected, for every file Disarmer blocks, a block-file containing the reason it was blocked is issued. You can edit the default block reason. Default is unchecked.

Note 

When Blocked files with suspicious links is selected ensure the machine.xml configuration file has CloudVotiroSettings enabled.

nJavaScript handling: Determines how JavaScript, if found in the PDF file, is handled.
tDon't do anything.
tRemove only suspicious scripts.
tRemove all scripts (this is the default).
tBlock documents containing suspicious scripts.

Image

Specifies how to handle image files.

By default, these files are sanitized.

nRasterize vector images: Converts vector images to raster images. Default is unchecked.
nAdd micro-changes: Adds security noise to images during sanitization. Default is checked.

Note 

Increasing the noise level might enlarge the sanitized files, particularly in the case of png files. Unselecting noise level (off) usually preserves an image file size.

nRemove metadata: Removes EXIF metadata from JPEG and TIFF images. Default is unchecked.
nMax compression for lossless formats: Compresses lossless image formats (PNG, BMP, and RAW) by 100%. Default is checked.
nCompression level: The sanitized image is compressed to preserve a reasonable image file size. You select one of five compression levels (from 0% to 100%) that trade off file size with image quality – the larger the file, the higher the image quality. Default is 25%.

CAD

Specifies how to handle DWG, DWS, DWT, DXF, JWW, SFC, and P21 files that were created using CAD software. The files are re-generated, preserving layers and structure.

By default, these files are sanitized.

nRemove VBA macro: Removes embedded VBA macros. Default value is checked.

Ichitaro

Specifies how to handle Ichitaro documents and their embedded objects.

The supported Ichitaro document versions are:

nFor JTD files: Ichitaro Pro 3/Pro 2/Pro/Government 8/Government 7/Government 6/2017-2004/13-8
nFor JTDC files: Ichitaro Pro 3/Pro 2/Pro/Government 8/Government 7/Government 6/2017-2004/13-11.

Note

nIchitaro sanitization requires that Votiro Disarmer be installed on Japanese locale Windows server. Applying Ichitaro sanitization policy action on non-Japanese locale system will result in unexpected behavior.
nIchitaro sanitization cannot be performed on the same server where JUST Office or Ichitaro is installed. Applying Ichitaro sanitization PolicyAction on the same Windows instance where JUST Office or Ichitaro is installed will result in unexpected behavior.

By default, these files are sanitized.

nRemove Macros: Default is checked.
nPreserve original Ichitaro OLE objects: Preserves OLE controls and OLE sheets. Default is checked.

 

 

Hancom

Specifies how to handle Hancom Office files.

Note 

Hancom .HWP 3.0 files are not supported.

By default, these files are sanitized.

nRemove Macros: Default is checked.
nRemove scripts: Default is checked.

Binary

Specifies how to handle binary files.

The Sanitze option is not relevant to managing binary files. You either block binary files or allow them.

nAllow: A binary file will not be sanitized. Select Send binary files to Fortinet sandbox to send binary files to Fortinet's sandbox. If this option is not selected, the original version will reach the destination folder.

Note 

Processing by the sandbox might affect performance.

Archive

Specifies how to handle archives.

By default, these files are sanitized.

Block zip bomb: Detects and blocks zip files with abnormal compression ratio. These might pose a denial of service threat, consuming system resources such as CPU or disk. Any zip files with compression ratio higher than 99.8% will be considered a zip bomb and be blocked. Default is checked.

RTF

Specifies how to handle RTF files.

By default, these files are sanitized. There are no sanitization options.

Email

Specifies how to handle email files. Sanitization is on EML files and their attachments.

Note

Each attached file is processed recursively by running all policy rules on it.

By default, these files are sanitized.

nBlock files with suspicious links: Performs a check of all links in the form HTTP:// and HTTPS:// in the body and attachments of an email. If any link is found to be suspicious, the email body or attachment is blocked. Default is unchecked.

Note 

If you have checked Blocked files with suspicious links, ensure the machine.xml configuration file has CloudVotiroSettings enabled.

nConvert HTML body to text: Converts EML files with HTML body into text body emails. For more information, see Converting HTML to Text Emails.

Default is unchecked.

nAdd footer: Adds a footer. Default is checked. Accept the default footer for HTML-based emails and/or text-based emails or edit it.

Microsoft Office

Specifies how to handle Microsoft Office files.

Sanitization applies to Microsoft Office files and their embedded objects.

Note

Each attached file is processed recursively by running all policy rules on it.

By default, these files are sanitized.

nBlock files with suspicious links: Performs a check of all links in the form HTTP:// and HTTPS:// in Microsoft Word files. If any is found to be suspicious, the file is blocked. Default is unchecked.

Note 

If you have checked Blocked files with suspicious links, ensure the machine.xml configuration file has CloudVotiroSettings enabled. This option is available for DOC/DOCX file types only.

nMacro handling.

In the list, choose one of the following:

tDon't do anything
tRemove only suspicious macros: Remove all macros only if any suspicious code is found.
tRemove all macros: Remove all macros from the document.
This is the default option.
tBlock documents containing suspicious macros: Block the entire document if suspicious code is found in the macro.

Note

Excel files with "4.0 macro" (also known as "sheet macro") are automatically blocked. It is common practice to use VBA macros. Excel files with VBA macros are checked for suspicious code (see options above).

nRemove metadata: Removes metadata, such as Author, Company, LastSavedBy, and so on. Default is unchecked.
nRemove printer settings: Removes the printerSettings1.bin (printer settings) embedded in a .xlsx file. Default is checked.
nRemove OLE: Removes OLE controls including attachments.

Default is unchecked. Changing this setting is not recommended and might affect the sanitized files.

nExternal program action handling:

Removes either:

tObjects that have potentially malicious links for example, OLE links and DDE, in all Office files (except Visio files).

From the list, select one of the following:

lNone
lRemove or Block document: Block the entire file if an OLE link is found in an Office file. The default is Remove.

OR

tExternal actions in PowerPoint files.

 

From the list, select one of the following:

lNone
lRemove: Remove all external actions. This is the default.
lBlock document: Block the entire file if an external action is found.

Text

Specifies how to handle text files.

By default, these files are sanitized.

Block CSV with threat formula: Blocks CSV files that contain formula injections. Default is checked.

Other files

Specifies how to handle unsupported files.

By default, these files are blocked.

There are no sanitization options.

Compression Levels

You can determine the level of compression required when processing flat streams, such as content streams and PNG images. You can set a value between 0 (minimum compression) and 9 (maximum compression), this will impact the size of the file output. The default value is 6.

Note

Compression Level is defined as a Special Case in the Defining Policy by Case section, see Defining Policy Based on Special Cases.

Related articles

Comments

0 comments

Please sign in to leave a comment.