Protect mode

Overview

When regenerating a file, content management policies allow control of various content types such as executable code, interactive form content and metadata. These file elements are known to be common attack vectors, hidden data risks and data disclosure risks when encountered within a file. A content management policy will define how the Glasswall Embedded Engine should handle applicable structures.

Content management policies can be updated on a file by file basis, but must be set prior to processing a file. Where policies are not provided, the Glasswall default settings are applied, and all configurable content is sanitised by default.

Content management policies differ across supported file types. See Content Management.

Protect process

Input files are read in and the manufacturer's specification is used to validate each byte as it is processed. This allows all the data structures (content items) within the file to be syntactically validated. If the data structures pass syntax validation, they are subjected to further semantic checks. Those data structures that have passed both syntactic and semantic validation are then written out to a new version of the input file that is regenerated on a data structure by data structure basis.

If a data structure does not pass validation, an attempt is made to repair the structure in accordance with the manufacturer's specification (remediation) before it is written to the regenerated file. If this cannot be done, an issue is reported, as the file cannot be safely regenerated.

Whilst the input file is being read in, the content management policies are used to determine whether content items (e.g. macros or embedded files) are permitted in the regenerated file. If these items are not permitted, they are not written to the regenerated file and the item is marked as a SanitisationItem in analysis reports. The result is a clean and compliant file which is visually identical to the original.

Protected files

Regenerated files are fully compliant with the manufacturer's specification and, depending on the content management policies applied, may have had a number of content items removed from the file.

Note: If all applicable content management policies were applied with a sanitise setting and any regenerated files were subsequently reprocessed; there should be no issue, remedy or sanitisation items present.