View STIG - Palo Alto Networks ALG Security Technical Implementation Guide V3R2

b

The Palo Alto Networks security platform, if used to provide intermediary services for remote access communications traffic (TLS or SSL decryption), must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.

AC-17 - Medium - CCI-000067 - V-228832 - SV-228832r557387_rule

RMF Control

AC-17

Severity

Medium

CCI

CCI-000067

Version

PANW-AG-000015

Vuln IDs

V-228832
V-62547

Rule IDs

SV-228832r557387_rule
SV-77037

Automated monitoring of remote access traffic allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by inspecting connection activities of remote access capabilities. Remote access methods include both unencrypted and encrypted traffic (e.g., web portals, web content filter, TLS, and webmail). With inbound TLS inspection, the traffic must be inspected prior to being allowed on the enclave's web servers hosting TLS or HTTPS applications. With outbound traffic inspection, traffic must be inspected prior to being forwarded to destinations outside of the enclave, such as external email traffic. This requirement does not mandate the decryption and inspection of SSL/TLS; it requires that if this is performed in the device, the decrypted traffic be inspected and conform to security policies. If SSL/TLS traffic is decrypted in the device, it must be inspected. The Palo Alto Networks security platform can be configured to decrypt and inspect SSL/TLS connections going through the device. With SSL Decryption, SSL-encrypted traffic is decrypted and App-ID and the Antivirus, Vulnerability, Anti-Spyware, URL Filtering, and File-Blocking Profiles can be applied to decrypted traffic before being re-encrypted and being forwarded. This is not limited to SSL encrypted HTTP traffic (HTTPS); other protocols "wrapped" in SSL/TLS can be decrypted and inspected. Decryption is policy-based and can be used to decrypt, inspect, and control both inbound and outbound SSL and SSH connections. Decryption policies allow the administrator to specify traffic for decryption according to destination, source, or URL category and in order to block or restrict the specified traffic according to security settings.

Checks: C-31067r513791_chk

If the Palo Alto Networks security platform does not serve as an intermediary for remote access traffic (e.g., web content filter, TLS, and webmail), this is not applicable. Go to Policies >> Decryption; note each configured decryption policy. Go to Policies >> Security View the configured security policies. If there is a decryption policy that does not have a corresponding security policy, this is a finding. The matching policy may not be obvious and it may be necessary for the Administrator to identify the corresponding security policy.

Fix: F-31044r513792_fix

Note: These instructions assume that certificates have already been loaded on the device. Multiple decryption policies can be configured; these instructions explain the steps involved but do not provide specific details since the exact local policies are not known. The Administrator must tailor the configuration to match the site-specific requirements. Go to Policies >> Decryption Select "Add". In the "Decryption Policy Rule" window, complete the required fields. In the "Name" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" or "Source User" fields. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" or "Destination User" fields. In the "URL Category" tab, select which categories will be decrypted. Select "Any" to decrypt all traffic. This is used for web traffic. In the "Option" tab, select "Decrypt" as the Action. Select the decryption profile. In the Type field, there are three options; Select "SSL Forward Proxy to decrypt and inspect SSL/TLS traffic from internal users to outside networks". Select "SSH Proxy to decrypt inbound and outbound SSH connections passing through the device". Select "SSL Inbound Inspection to decrypt and inspect incoming SSL traffic". Note: This decryption mode can only work if you have control on the internal server certificate to import the Key Pair on Palo Alto Networks Device. Decrypted traffic is blocked and restricted according to the policies configured on the firewall. For each Decryption Policy, there must be a Security Policy in order to inspect and filter the decrypted traffic. Multiple security policies can be configured; these instructions explain the steps involved but do not provide specific details since the exact local policies are not known. Go to Policies >> Security Select "Add". In the "Security Policy Rule" window, complete the required fields. In the "Name" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. In the "User" tab, complete the "Source User" and "HIP Profile" fields. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. In the "Applications" tab, either select the "Any" check box or add the specific applications. Configured filters and groups can be selected. In the "Actions" tab, select the desired resulting action (allow or deny). If logging of matches on the rule is required, select the "Log forwarding" profile, and select "Log at Session End". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.

AC-17 - Medium - CCI-000068 - V-228833 - SV-228833r557387_rule

RMF Control

AC-17

Severity

Medium

CCI

CCI-000068

Version

PANW-AG-000016

Vuln IDs

V-228833
V-62549

Rule IDs

SV-228833r557387_rule
SV-77039

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Encryption provides a means to secure the remote connection so as to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of the mechanism is selected based on the security categorization of the information. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections.

Checks: C-31068r513794_chk

If the Palo Alto Networks security platform does not serve as an intermediary for remote access traffic (e.g., web content filter, TLS, and webmail), this is not applicable. Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "show fips-mode" or the command show fips-cc (for more recent releases). If fips-mode or fips-cc is set to "off", this is a finding.

Fix: F-31045r513795_fix

To configure the Palo Alto Networks security platform to operate in FIPS mode: Power off the device by unplugging it from the electrical outlet. Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device. The serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit. A USB to serial adapter will be necessary if the computer does not have a serial port. During the boot sequence, this message will appear: "Autoboot to default partition in 5 seconds". Enter "maint" to boot to "maint" partition. Enter "maint" to enter maintenance mode. Press "Enter", and the "Maintenance Recovery tool" menu will appear. Select "Set FIPS Mode" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode. Note: This will remove all installed licenses and disable the serial port.

b

The Palo Alto Networks security platform that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.

AC-17 - Medium - CCI-000068 - V-228834 - SV-228834r557387_rule

RMF Control

AC-17

Severity

Medium

CCI

CCI-000068

Version

PANW-AG-000017

Vuln IDs

V-228834
V-62551

Rule IDs

SV-228834r557387_rule
SV-77041

Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder. Private key data associated with software certificates is required to be generated and protected in at least a FIPS 140-2 Level 1 validated cryptographic module.

Checks: C-31069r513797_chk

Use the command line interface to determine if the device is operating in FIPS mode. If fips-mode or fips-cc is set to "off", this is a finding.

Fix: F-31046r513798_fix

To configure the Palo Alto Networks security platform to operate in FIPS mode: Power off the device by unplugging it from the electrical outlet. Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device. The serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit. A USB to serial adapter will be necessary if the computer does not have a serial port. During the boot sequence, this message will appear: "Autoboot to default partition in 5 seconds". Enter "maint" to boot to "maint" partition. Enter "maint" to enter maintenance mode. Press "Enter", and the "Maintenance Recovery tool" menu will appear. Select "Set FIPS Mode" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode. Note: This will remove all installed licenses and disable the serial port.

b

The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.

AC-17 - Medium - CCI-001453 - V-228835 - SV-228835r557387_rule

RMF Control

AC-17

Severity

Medium

CCI

CCI-001453

Version

PANW-AG-000020

Vuln IDs

V-228835
V-62553

Rule IDs

SV-228835r557387_rule
SV-77043

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).

Checks: C-31070r513800_chk

If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable. Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "show fips-mode" or the command show fips-cc (for more recent releases).

Fix: F-31047r513801_fix

If the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, it must use NIST FIPS-validated cryptography. Power off the device by unplugging it from the electrical outlet. Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device. The serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit. A USB to serial adapter will be necessary if the computer does not have a serial port. During the boot sequence, this message will appear: "Autoboot to default partition in 5 seconds". Enter "maint" to boot to "maint" partition. Enter "maint" to enter maintenance mode. Press "Enter", and the "Maintenance Recovery tool" menu will appear. Select "Set FIPS Mode" (or select fips-cc for more recent versions) from the menu; once the device has finished rebooting, it will be in FIPS mode. Note: This will remove all installed licenses and disable the serial port.

a

The Palo Alto Networks security platform must log violations of security policies.

AU-3 - Low - CCI-000133 - V-228836 - SV-228836r557387_rule

RMF Control

AU-3

Severity

Low

CCI

CCI-000133

Version

PANW-AG-000024

Vuln IDs

V-228836
V-62555

Rule IDs

SV-228836r557387_rule
SV-77045

Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event. In addition to logging where sources of events such as IP addresses, processes, and node or device names, it is important to log the name or identifier of each specific policy or rule that is violated. In the Palo Alto Networks security platform, traffic logs record information about each traffic flow, and threat logs record the threats or problems with the network traffic, such as virus or spyware detection. Note that the antivirus, anti-spyware, and vulnerability protection profiles associated with each rule determine which threats are logged (locally or remotely).

Checks: C-31071r513803_chk

Go to Policies >> Security View the configured security policies. For any Security Policy where the "Action" column shows "deny", view the "Options" column; if there are no icons in the column, this is a finding. Note: The "Action" column and the "Option" column are usually near the right edge; it may be necessary to use the slide to view them.

Fix: F-31048r513804_fix

Go to Policies >> Security Select "Add" to create a new security policy or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. In the "Actions" tab, select "Log At Session End". This generates a traffic log entry for the end of a session and logs drop and deny entries. Note: Traffic and Security Logs are required to be forwarded to syslog servers. In the "Log Forwarding" field, select a configured log forwarding profile. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must only enable User-ID on trusted zones.

CM-7 - Medium - CCI-000381 - V-228837 - SV-228837r557387_rule

RMF Control

CM-7

Severity

Medium

CCI

CCI-000381

Version

PANW-AG-000035

Vuln IDs

V-228837
V-62557

Rule IDs

SV-228837r557387_rule
SV-77047

User-ID can use Windows Management Instrumentation (WMI) probing as a method of mapping users to IP addresses. If this is used, the User-ID Agent will send a probe to each learned IP address in its list to verify that the same user is still logged in. The results of the probe will be used to update the record on the agent and then be passed on to the firewall. WMI probing is a Microsoft feature that collects user information from Windows hosts and contains a username and encrypted password hash of a Domain Administrator account. If User-ID and WMI probing are enabled on an external untrusted zone (such as the Internet), probes could be sent outside the protected network, resulting in an information disclosure of the User-ID Agent service account name, domain name, and encrypted password hash. This information has the potential to be cracked and exploited by an attacker to gain unauthorized access to protected resources. For this important reason, User-ID should never be enabled on an untrusted zone.

Checks: C-31072r513806_chk

To verify that Windows Management Instrumentation (WMI) probing is unchecked for all untrusted zones: Go to Network >> Zones, view each zone. If the Zone is untrusted and if the UserID Enabled column is checked, this is a finding. Go to Network >> Network Profiles >> Interface Mgmt View the configured Interface Management Profiles. Note which Interface Management Profiles have the "User-ID" field enabled (checked). Go Network >> Interfaces Each interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel. Each type can have an Interface Management Profile applied to it. View each interface that is in an untrusted security zone; if each one has no Interface Management Profile applied, this is not a finding. If each interface in an untrusted security zone has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled; if it does, this is a finding.

Fix: F-31049r513807_fix

To deny User-ID on untrusted zones: Go to Network >> Zones, select the name of the zone. If the Zone is untrusted, In the Zone window, deselect (uncheck) the Enable User Identification check box. Select "OK". Go to Network >> Network Profiles >> Interface Mgmt Select "Add" to create a new profile or select the name of a profile to edit it. In the "Interface Management Profile" window, deselect the "User-ID" check box if it is selected. Select "OK". Note: This action precludes that particular Interface Management Profile from supporting User-ID. An interface does not need an Interface Management Profile to operate; only to be managed on that interface. Go Network >> Interfaces Each interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel. Each type can have an Interface Management Profile applied to it. View each interface that is in an untrusted security zone; if it has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled.

b

The Palo Alto Networks security platform must disable WMI probing if it is not used.

CM-7 - Medium - CCI-000381 - V-228838 - SV-228838r557387_rule

RMF Control

CM-7

Severity

Medium

CCI

CCI-000381

Version

PANW-AG-000036

Vuln IDs

V-228838
V-62559

Rule IDs

SV-228838r557387_rule
SV-77049

User-ID can use Windows Management Instrumentation (WMI) probing as a method of mapping users to IP addresses. If this is used, the User-ID Agent will send a probe to each learned IP address in its list to verify that the same user is still logged in. The results of the probe will be used to update the record on the agent and then be passed on to the firewall. WMI probing is a Microsoft feature that collects user information from Windows hosts, and contains a username and encrypted password hash of a Domain Administrator account. WMI probing on external/untrusted zones can result in the User-ID agent sending WMI probes to external/untrusted hosts. An attacker can capture these probes and obtain the username, domain name and encrypted password hash associated with the User-ID account. If WMI probing is not used as a method of user to IP address mapping, it must be disabled.

Checks: C-31073r513809_chk

Ask the Administrator if User-ID uses WMI Probing; if it does, this is not a finding. Go to Device >> User Identification On the "User Mapping" tab, in the "Palo Alto Networks User ID Agent" pane, view the "Enable Probing" check box. If it is selected, this is a finding.

Fix: F-31050r513810_fix

To disable WMI probing if it is not used: Go to Device >> User Identification On the "User Mapping" tab, in the "Palo Alto Networks User ID Agent" pane, view the "Enable Probing" check box. If it is selected, select the "Edit" icon in the upper-right corner of the pane. In the "Palo Alto Networks User ID Agent Setup" window, in the "Client Probing" tab, deselect the "Enable Probing" check box.

b

The Palo Alto Networks security platform must not enable the DNS proxy.

CM-7 - Medium - CCI-000381 - V-228839 - SV-228839r557387_rule

RMF Control

CM-7

Severity

Medium

CCI

CCI-000381

Version

PANW-AG-000037

Vuln IDs

V-228839
V-62561

Rule IDs

SV-228839r557387_rule
SV-77051

The Palo Alto Networks security platform can act as a DNS proxy and send the DNS queries on behalf of the clients. DNS queries that arrive on an interface IP address can be directed to different DNS servers based on full or partial domain names. However, unrelated or unneeded proxy services increase the attack vector surface and add excessive complexity to securing the device.

Checks: C-31074r513812_chk

To check if DNS Proxy is configured: Go to Network >> DNS Proxy If there are entries in the pane, this is a finding.

Fix: F-31051r513813_fix

Do not configure and enable the DNS Proxy capability. Go to Network >> DNS Proxy If there are no entries in the pane, then this capability has not been enabled.

b

The Palo Alto Networks security platform must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

CM-7 - Medium - CCI-000382 - V-228840 - SV-228840r557387_rule

RMF Control

CM-7

Severity

Medium

CCI

CCI-000382

Version

PANW-AG-000038

Vuln IDs

V-228840
V-62563

Rule IDs

SV-228840r557387_rule
SV-77053

In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. The DoD continually assesses the ports, protocols, and services that can be used for network communications. Some ports, protocols, or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. It is the responsibility of the enclave owner to have the applications the enclave uses registered in the PPSM database. The Palo Alto Networks security platform must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. If the device is in a Deny-by-Default posture and what is allowed through the filter is IAW DoD Instruction 8551, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to PPS being blocked are satisfied. Since the enclave or system may support custom applications, it may be necessary to configure a Custom Application. This requires detailed analysis of the application traffic and requires validation testing before deployment.

Checks: C-31075r513815_chk

Review the list of authorized applications, endpoints, services, and protocols that has been added to the PPSM database. Go to Policies >> Security Review each of the configured security policies in turn. If any of the policies allows traffic that is prohibited by the PPSM CAL, this is a finding.

Fix: F-31052r513816_fix

To configure a security policy: Go to Policies >> Security Select "Add". In the "Security Policy Rule" window, complete the required fields. In the "General" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. In the "User" tab, select "Any" or complete the "Source User" field; this is completed if the policy performs the defined actions based on an individual user or group of users. If using GlobalProtect with Host Information Profile (HIP) enabled, select the "HIP Profiles" check box, and add the HIP Object or HIP Profile. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. In the "Applications" tab, select the authorized applications. In the "Service/URL Category" tab, select application-default. To add a service, select the "Service" check box, select "Add", and select a listed service or add a new service or service group. In the "Actions" tab, select either "Deny" or "Allow" (as required) as the resulting action. Select the required Log Setting and Profile Settings as necessary. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

IA-5 - Medium - CCI-000185 - V-228841 - SV-228841r557387_rule

RMF Control

IA-5

Severity

Medium

CCI

CCI-000185

Version

PANW-AG-000044

Vuln IDs

V-228841
V-62565

Rule IDs

SV-228841r557387_rule
SV-77055

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses. The Palo Alto Networks security platform can be configured to use Open Certificate Status Protocol (OCSP) and/or certificate revocation lists (CRLs) to verify the revocation status of certificates and the device itself can be configured as an OCSP responder.

Checks: C-31076r513818_chk

If the Palo Alto Networks security platform does not provide intermediary services for TLS or application protocols that use TLS (e.g., HTTPS), this is not applicable. Go to Device >> Certificate Management >> OCSP Responder If no OCSP Responder is configured, this is a finding. Go to Device >> Setup >> Management In the "Management Interface Settings" pane, if "HTTP OCSP" is not listed under "Services", this is a finding.

Fix: F-31053r513819_fix

To configure the Palo Alto Networks security platform to use an OCSP responder: Go to Device >> Certificate Management >> OCSP Responder Select "Add". In the "OCSP Responder" window, enter the host name or IP address of the OCSP responder. Note: If the firewall itself is configured as an OCSP responder, the host name must resolve to an IP address in the interface that the firewall uses for OCSP services. To enable OCSP communication on the firewall: Go to Device >> Setup >> Management In the "Management Interface Settings" pane, select the "Edit" icon. In the "Management Interface Settings" box, under "Services" check HTTP OCSP to enable it. Select "OK" Optionally, to configure the device itself as an OCSP responder, add an Interface Management Profile to the interface used for OCSP services. Go to Network >> Network Profiles >> Interface Management Select "Add" to create a new profile or click the name of an existing profile. In the "Interface Management Profiles" window, under "Permitted Services", check HTTP OCSP. Select "OK". Go to Network >> Interfaces Select the name of the interface that the firewall will use for OCSP services. Note: When the device itself as an OCSP responder, the OCSP Host Name must resolve to an IP address in this interface. In the "Interface" window, under Other Info, in the "Management Profile" field, select the configured Management Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must protect against the use of internal systems for launching denial-of-service (DoS) attacks against external networks or endpoints.

SC-5 - Medium - CCI-001094 - V-228842 - SV-228842r1028359_rule

RMF Control

SC-5

Severity

Medium

CCI

CCI-001094

Version

PANW-AG-000047

Vuln IDs

V-228842
V-62567

Rule IDs

SV-228842r1028359_rule
SV-77057

DoS attacks from DOD sources risk the reputation of the organization. Thus, it is important to protect against the DOD system being used to launch an attack on external systems. Although Zone Protections are applied on the ingress interface, at a minimum, DOD requires a zero-trust approach. These attacks may use legitimate internal or rogue endpoints from inside the enclave. These attacks can be simple "floods" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks. It is important to set the Flood Protection parameters that are suitable for the enclave or system. The Administrator should characterize the traffic regularly (perform a traffic baseline) and tune these parameters based on that information.

Checks: C-31077r1018648_chk

Ask the Administrator if the device is using a Zone-Based Protection policy or a DoS Protection policy to protect against DoS attacks originating from the enclave. If it is using a DoS Protection policy, perform the following: Navigate to Objects >> Security Profiles >> DoS Protection. If there are no DoS Protection Profiles configured, this is a finding. There may be more than one configured DoS Protection Profile; ask the Administrator which DoS Protection Profile is intended to protect outside networks from internally-originated DoS attacks. If there is no such DoS Protection Profiles, this is a finding. If it is using a Zone-Based Protection policy, perform the following: Navigate to Network >> Network Profiles >> Zone Protection. If there are no Zone Protection Profiles configured, this is a finding. There may be more than one configured Zone Protection Profile; ask the Administrator which Zone Protection Profile is intended to protect outside networks from internally-originated DoS attacks. If there is no such Zone Protection Profile, this is a finding. Navigate to Network >> Zones. If the "Zone Protection Profile" column for the internal zone or the DMZ is blank, this is a finding. If it lists an incorrect Zone Protection Profile, this is also a finding.

Fix: F-31054r997587_fix

Configure either a Zone-Based Protection policy or a DoS Protection policy to protect against DoS attacks originating from the enclave. To configure a DoS Protection policy, perform the following: Navigate to Objects >> Security Profiles >> DoS Protection. Select "Add" to create a new profile. In the "DoS Protection Profile" window, complete the required fields. For the "Type", select "Classified". In the "Flood Protection" tab, "SYN Flood" sub-tab, select the "SYN Flood" check box and select either "Random Early Drop" (preferred in this case) or "SYN Cookie"; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. In the "Flood Protection" tab, "UDP Flood" sub-tab, select the "UDP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. In the "Flood Protection" tab, "ICMP Flood" sub-tab, select the "ICMP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. In the "Flood Protection" tab, "ICMPv6 Flood" sub-tab, select the "ICMPv6 Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. In the "Flood Protection" tab, "Other IP Flood" sub-tab, select the "Other IP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. In the "Resources Protection" tab, leave the "Maximum Concurrent Sessions" check box unselected. Select "OK". Navigate to Policies >> DoS Protection. Select "Add" to create a new policy. In the "DoS Rule" window, complete the required fields. In the "General" tab, complete the "Name" and "Description" fields. In the "Source" tab, for "Zone", select the "Internal" zone, for "Source Address", select "Any". In the "Destination" tab, "Zone", select "External" zone, for "Destination Address", select "Any". In the "Option/Protection" tab: For "Service", select "Any". For "Action", select "Protect". Select the "Classified" check box. In the "Profile" field, select the configured DoS Protection profile for outbound traffic. In the "Address" field, select source-ip-only. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears. To configure a Zone-Based Protection policy, perform the following: Navigate to Network >> Network Profiles >> Zone Protection Select "Add". In the "Zone Protection Profile" window, complete the required fields. In the "General" tab, complete the "Name" and "Description" fields. In the "Flood Protection" tab, select the "SYN" check box, in the "Action" field, select either "Random Early Drop" (preferred in this case) or "SYN Cookie"; complete the "Alert", "Activate", and "Maximum" fields. In the "Flood Protection" tab, select the "ICMP" check box; complete the "Alert", "Activate", and "Maximum" fields. In the "Flood Protection" tab, select the "ICMPv6" check box; complete the "Alert", "Activate", and "Maximum" fields. In the "Flood Protection" tab, select the "Other IP" check box; complete the "Alert", "Activate", and "Maximum" fields. In the "Flood Protection" tab, select the "UDP" check box; complete the "Alert", "Activate", and "Maximum" fields. For each of the "Alert", "Activate", and "Maximum" fields, the appropriate values depend on the expected traffic of the system. In the "Reconnaissance Protection" tab, select the "TCP Port Scan", "Host Sweep", and "UDP Port Scan" rows. In the "Action" field, select "Block". The "Interval" and "Threshold" values can either remain as the default values or they can be changed based on the specific traffic conditions of the network (preferred). In the "Packet Based Attack Protection" tab: "TCP/IP Drop" sub-tab, select the "Spoofed IP address", and "Mismatched overlapping TCP segment" check boxes. In the "IP Option Drop" section, select the "Strict Source Routing", "Loose Source Routing", "Timestamp", "Unknown", and "Malformed" check boxes. The "Record Route", "Security", and "Stream ID" check boxes can remain unchecked. For the "Reject Non-SYN TCP" field, select "yes". For the "Asymmetric Path" field, select "bypass". "ICMP Drop" sub-tab, select the "ICMP Ping ID 0", "ICMP Fragment", "ICMP Large Packet(>1024)" check boxes. The "Discard ICMP embedded with error message", "Suppress ICMP TTL Expired Error", and "Suppress ICMP Frag Needed" boxes can remain unchecked. Since this requirement is specifically to prevent internal systems from launching DoS attacks against other networks or endpoints, select the following from the "ICMP Drop" sub-tab: "ICMP Ping ID 0", "ICMP Fragment", "ICMP Large Packet(>1024)", "Suppress ICMP TTL Expired Error", "Suppress ICMP Frag Needed". "IPv6 Drop" sub-tab, select the "Type 0 Routing Header", "IPv4 compatible address", "Anycast source address", "Needless fragment header", "MTU in ICMPv6 'Packet Too Big' less than 1280 bytes", "Hop-by-Hop extension", "Routing extension", "Destination extension", "Invalid IPv6 options in extension header", and "Non-zero reserved field" check boxes. "ICMPv6" sub-tab, select the "ICMPv6 destination unreachable", "ICMPv6 packet too big", "ICMPv6 time exceeded", "ICMPv6 parameter problem", and "ICMPv6 redirect" check boxes. Select "OK". Apply the Zone Protection Profile to any zone that includes egress interfaces to external networks: Navigate to Network >> Zones. Select the zone to be configured. In the "Zone" window, in the "Zone Protection Profile" window, select the configured Zone Protection Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must block phone home traffic.

SC-5 - Medium - CCI-001094 - V-228843 - SV-228843r997591_rule

RMF Control

SC-5

Severity

Medium

CCI

CCI-001094

Version

PANW-AG-000049

Vuln IDs

V-228843
V-62569

Rule IDs

SV-228843r997591_rule
SV-77059

A variety of Distributed Denial of Service (DDoS) attacks and other attacks use "botnets" as an attack vector. A botnet is a collection of software agents (referred to as "bot"), residing on compromised computers. Attacks are orchestrated by a "bot herder" to command these agents to launch attacks. Part of the command and control communication between the controller and the bots is a message sent from a bot that informs the controller that it is operating. This is referred to as a "phone home" message. On the Palo Alto Networks security platform, a security policy can include an Anti-spyware Profile for “phone home” detection (detection of traffic from installed spyware). The device has two pre-configured Anti-spyware Profiles; Default and Strict. The Default Anti-spyware Profile sends an alert for detected phone-home traffic for all severity levels except the low and informational severity threat levels, while the Strict Anti-spyware Profile blocks phone-home traffic for the critical, high, and medium severity threat levels. Phone home traffic must either be blocked or intercepted by the DNS Sinkholing feature. Therefore, a custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. Note that there are specific implementation requirements for DNS Sinkholing to operate properly; refer to the Palo Alto Networks documentation for details.

Checks: C-31078r997589_chk

Ask the Administrator which Anti-Spyware profile is used: Go to Objects >> Security Profiles >> Anti-Spyware. Select the Anti-Spyware Profile. In the "Anti-Spyware Profile" window, in the "DNS Signatures" tab, in the Action on "DNS queries" field, if either "block" or "sinkhole" is not selected, this is a finding. Ask the Administrator which Security Policy Rule allows traffic from client hosts in the trust zone to the untrust zone: Go to Policies >> Security. Select the identified policy rule. View the "Security Policy Rule" window. Select the "Actions" tab. In the "Profile Setting" section, in the "Anti-Spyware" field, if there is no Anti-Spyware Profile or the Anti-Spyware Profile is not the correct one, this is a finding.

Fix: F-31055r997590_fix

Go to Objects >> Security Profiles >> Anti-Spyware. Select the name of a configured Anti-Spyware Profile or select "Add" to create a new one. In the "Anti-Spyware Profile" window, in the "DNS Signatures" tab, in the Action on "DNS queries" field, select "block" or "sinkhole". If "sinkhole" is selected, complete the "Sinkhole IPv4" and "Sinkhole IPv6" fields. Note: If DNS Sinkholing is used, the device and network must be configured to support it. If this is a new Anti-Spyware Profile, complete the required fields in all tabs. Select "OK". Use the Anti-Spyware Profile in a Security Policy; Edit the Security Policy Rule that allows traffic from client hosts in the trust zone to the untrust zone to include the sinkhole zone as a destination and attach the Anti-spyware Profile. Select or configure a rule that allows traffic from the client host zone to the untrust zone. Go to Policies >> Security. Select the appropriate existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Anti-Spyware" field, select the configured Anti-Spyware Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.

SC-5 - Medium - CCI-001094 - V-228844 - SV-228844r557387_rule

RMF Control

SC-5

Severity

Medium

CCI

CCI-001094

Version

PANW-AG-000050

Vuln IDs

V-228844
V-62571

Rule IDs

SV-228844r557387_rule
SV-77061

A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, who then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. Enclaves must enforce egress filtering. In egress filtering, packets leaving the enclave are discarded if the source IP address is not part of the IP address network(s), also known as prefixes, which are assigned to the enclave. A more specific form of egress filtering is to allow only those hosts and protocols that have been identified and authorized to exit the enclave. All traffic leaving the enclave, regardless of the destination, must be filtered by the premise router's egress filter to verify that the source IP address belongs to the enclave. Configure a security policy that allows only traffic originating from the IP address prefixes assigned to the enclave to exit the enclave. The implicit deny cross zone traffic rule will then be used, in part, to deny illegitimate source address traffic originating from an internal zone to go to another zone.

Checks: C-31079r513827_chk

Verify an anti-spoofing policy is configured for each outgoing zone that drops any traffic when the source IP does not match the list of allowed IP ranges for each outgoing zone. Navigate to the “Zone Protection Profile” configuration screen Select the “Packet-Based Attack Protection” tab Select the “IP Drop” tab If the “Spoofed IP Address” box is not checked for each outgoing zone, this is a finding.

Fix: F-31056r513828_fix

Create an anti-spoofing policy for each outgoing zone that drops any traffic when the source IP does not match the list of allowed IP ranges for each outgoing zone. Navigate to the “Zone Protection Profile” configuration screen. Select the “Packet- Based Attack Protection” tab. Select the “IP Drop” tab. Check the “Spoofed IP Address” box.

b

The Palo Alto Networks security platform must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

SC-7 - Medium - CCI-001109 - V-228845 - SV-228845r557387_rule

RMF Control

SC-7

Severity

Medium

CCI

CCI-001109

Version

PANW-AG-000051

Vuln IDs

V-228845
V-62573

Rule IDs

SV-228845r557387_rule
SV-77063

A deny-all, permit-by-exception network communications traffic policy ensures that only those connections that are essential and approved are allowed. As a managed boundary interface between networks, the Palo Alto Networks security platform must block all inbound and outbound network traffic unless a policy filter is installed to explicitly allow it. The allow policy filters must comply with the site's security policy. A deny-all, permit–by-exception network communications traffic policy ensures that only those connections that are essential and approved are allowed. By default, there are two security policies on the Palo Alto Networks firewall: Allow traffic within the same zone (intra-zone) Deny traffic from one zone to another zone (inter-zone). No policy that circumvents the inter-zone policy is allowed. Traffic through the device is permitted by policies developed to allow only that specific traffic that the system or enclave requires.

Checks: C-31080r513830_chk

Go to Policies >> Security Review each of the configured security policies in turn. Select each policy in turn; in the "Security Policy Rule" window, if the "Source Address" has "Any" selected, the "Destination Address" has "Any" selected, the "Application" has "Any" selected, and the "Action" Setting is "Allow", this is a finding. If any Security Policy is too broad (allowing all traffic either inbound or outbound), this is also a finding.

Fix: F-31057r513831_fix

Do not configure any policies or rules that violate a deny-all, permit-by-exception policy. Configure policies that allow traffic through the device based only on the mission and system requirements.

b

The Palo Alto Networks security platform must terminate communications sessions after 15 minutes of inactivity.

SC-10 - Medium - CCI-001133 - V-228846 - SV-228846r971530_rule

RMF Control

SC-10

Severity

Medium

CCI

CCI-001133

Version

PANW-AG-000052

Vuln IDs

V-228846
V-62575

Rule IDs

SV-228846r971530_rule
SV-77065

Idle sessions can accumulate, leading to an exhaustion of memory in network elements processing traffic flows. Note that the 15 minute period is a maximum value; Administrators can choose shorter timeout values to account for system- or network-specific requirements. On a Palo Alto Networks security platform, a session is defined by two uni-directional flows, each uniquely identified by a 6-tuple key: source-address, destination-address, source-port, destination-port, protocol, and security-zone. Besides the six attributes that identify a session, each session has few more notable identifiers: end hosts - the source IP and destination IP which will be marked as client(source IP) and server(destination IP) and flow direction - each session is bi-directional and is identified by a two uni-directional flows, the first flow is client-to-server(c2s) and the returning flow is server-to-client(s2c). Sessions between endpoints are kept active by either normal traffic or by keepalive messages (also sometimes referred to as heartbeat messages). On the Palo Alto Networks security platform, the session timeout period is the time (seconds) required for the application to time out due to inactivity. Session timeouts are configured globally and on a per-application basis. When configured, timeouts for an application override the global TCP or UDP session timeouts.

Checks: C-31081r513833_chk

To check global values: Go to Device >> Setup >> Session In the "Session Timeouts" pane, if the TCP field has a value of greater than "900", this is a finding. Obtain the list of authorized applications for the system or network. To check application-specific values: Go to Objects >> Applications Select, in turn, each authorized application. In the "Application" window, in the "Options" pane, view the "TCP" and "UDP Timeout" fields, if the value is greater than "900", this is a finding. Many applications will not have one of these two fields.

Fix: F-31058r513834_fix

To configure the global values: Go to Device >> Setup >> Session In the "Session Timeouts" pane, select the "Edit" icon (the gear symbol in the upper-right corner of the pane). In the "TCP" field, enter "900". Select "OK". To configure application-specific values: Go to Objects >> Applications Select an application name to view additional details about the application. To search for a specific application, enter the "application name" or "description" in the "Search" field. In the "Application" window, in the "Options" pane, in the "TCP Timeout" field, select "Customize". In the Application specific window, in the "TCP" and "UDP Timeout" fields, enter "900" if the existing value is greater than "900". Many applications will not have one of these two fields. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.

- Medium - CCI-004965 - V-228847 - SV-228847r1018772_rule

RMF Control

Severity

Medium

CCI

CCI-004965

Version

PANW-AG-000060

Vuln IDs

V-228847
V-62577

Rule IDs

SV-228847r1018772_rule
SV-77067

In order to minimize any potential negative impact to the organization caused by malicious code, malicious code must be identified and eradicated. Malicious code includes viruses, worms, Trojan horses, and Spyware.

Checks: C-31082r997592_chk

Check if the device is using the most current protection mechanisms and signature definitions. If the device has authorized connectivity to the Palo Alto site, the automated process can be used. Go to Device >> Dynamic Updates. View the list of updates, and note the date of the most recent one. Select "Check Now" at the bottom of the page; if new updates appear, this is a finding. If the device does not have connectivity to the Palo Alto site, a manual process must be used. Log on to the Palo Alto Support site (registration required). Select the “Dynamic Updates” hyperlink. Check for the most current update (the version and release date of each update is listed). Go to Device >> Dynamic Updates. View the list of updates and note the date of the most recent one. If the device does not have the most current updates installed, this is a finding.

Fix: F-31059r997593_fix

If the device has authorized connectivity to the Palo Alto site, automatic updates can be used. To schedule automatic updates: Go to Device >> Dynamic Updates. Select the text to the right of Schedule. In the "Applications and Threat Updates Schedule" Window; complete the required information. In the "Recurrence" field, select the desired frequency. If the update frequency is Weekly, select which day of the week. In the "Time" field, enter the time at which you want the device to check for updates. For the Action, select "Download and Install". Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears. To retrieve the latest signatures: Go to Device >> Dynamic Updates. Select "Check Now" at the bottom of the page. If the device does not have authorized connectivity to the Palo Alto site, a manual process must be used. If manual updates are used, an administrator must obtain updates from the Palo Alto Networks website and upload them from a workstation or server to the device. Go to Device >> Dynamic Updates. Select "Upload" (at the bottom of the pane). In the Select "Package Type" for the "Upload" window in the "Package Type" field, select "anti-virus". Browse to and select the appropriate file. Select "OK". Select "Install From File" (at the bottom of the pane). In the "Select Package Type for Installation" window, select "antivirus". Select "OK". In the "Install Application and Threats From File" window, select the previously uploaded file. Select "OK".

b

The Palo Alto Networks security platform must drop malicious code upon detection.

SI-3 - Medium - CCI-001243 - V-228848 - SV-228848r559740_rule

RMF Control

SI-3

Severity

Medium

CCI

CCI-001243

Version

PANW-AG-000062

Vuln IDs

V-228848
V-62579

Rule IDs

SV-228848r559740_rule
SV-77069

Malicious code is designed to compromise information systems; therefore, it must be prevented from being transferred to uninfected hosts. The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while dropping for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.

Checks: C-31083r573745_chk

Go to Objects >> Security Profiles >> Antivirus If there are no Antivirus Profiles configured other than the default, this is a finding. View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB) if the "Action" is anything other than “drop” or "reset-both", this is a finding. Go to Policies >> Security. Review each of the configured security policies in turn. For any Security Policy that allows traffic between Zones (interzone), view the "Profile" column. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix: F-31060r573746_fix

To create an Antivirus Profile: Go to Objects >> Security Profiles >> Antivirus. Select "Add". In the "Antivirus Profile" window, complete the required fields. Complete the "Name" and "Description" fields. In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols) set the "Action" to “drop” or "reset-both". Select "OK". Use the Antivirus Profile in a Security Policy: Go to Policies >> Security. Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection.

SI-3 - Medium - CCI-001243 - V-228849 - SV-228849r559739_rule

RMF Control

SI-3

Severity

Medium

CCI

CCI-001243

Version

PANW-AG-000063

Vuln IDs

V-228849
V-62581

Rule IDs

SV-228849r559739_rule
SV-77071

Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of this code on the network. This requirement is limited to ALGs web content filters and packet inspection firewalls that perform malicious code detection as part of their functionality. The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while dropping traffic for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used. Inspection is done through stream-based analysis, which means files are not cached or stored in their entirety on the firewall, but analyzed in real-time as they pass through the firewall. Therefore, any detected virus will automatically be deleted when detected.

Checks: C-31084r513842_chk

Go to Objects >> Security Profiles >> Antivirus If there are no Antivirus Profiles configured other than the default, this is a finding. View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB), if the "Action" is anything other than “drop” or "reset-both", this is a finding. Go to Policies >> Security Review each of the configured security policies in turn. For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix: F-31061r573747_fix

To create an Antivirus Profile: Go to Objects >> Security Profiles >> Antivirus Select "Add". In the "Antivirus Profile" window, complete the required fields. Complete the "Name" and "Description" fields. In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols) set the "Action" to “drop” or "reset-both". This will drop the data stream and create a log record. Select "OK". Use the Profile in a Security Policy: Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.

SI-3 - Medium - CCI-001243 - V-228850 - SV-228850r557387_rule

RMF Control

SI-3

Severity

Medium

CCI

CCI-001243

Version

PANW-AG-000064

Vuln IDs

V-228850
V-62645

Rule IDs

SV-228850r557387_rule
SV-77135

Without an alert, security personnel may be unaware of an impending failure of the audit capability; then the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded. The device must generate an immediate (within seconds) alert that notifies designated personnel of the incident. Since sending a message to an unattended log or console does not meet this requirement, the threat logs must be sent to an attended console or to e-mail. When the Palo Alto Networks security platform blocks malicious code, it also generates a record in the threat log. This message has a medium severity.

Checks: C-31085r513845_chk

The following is an example of how to check if the device is sending messages to e-mail; this is one option that meets the requirement. If sending messages to an SNMP server or Syslog servers is used, follow the vendor guidance on how to verify that function: Go to Device >> Server Profiles >> Email If there is no Email Server Profile configured, this is a finding. Go to Objects >> Log forwarding If there is no Email Forwarding Profile configured, this is a finding. Go to Policies >> Security View the Security Policy that is used to detect malicious code (the "Profile" column does displays the "Antivirus Profile" symbol) in the "Options" column. If the Email Forwarding Profile is not used, this is a finding.

Fix: F-31062r513846_fix

The following is an example of how to configure the device to send messages to e-mail; this is one option that meets the requirement. If sending messages to an SNMP server or Syslog servers is used, follow the vendor guidance on how to configure that function. To create an email server profile: Go to Device >> Server Profiles >> Email Select "Add". In the Email Server Profile, enter the name of the profile. Select "Add". In the "Servers" tab, enter the required information. In the "Name" field, enter the name of the Email server. In the "Email Display Name" field, enter the name shown in the "From" field of the email. In the "From" field, enter the "From email address". In the "To" field, enter the email address of the recipient. In the "Additional Recipient" field, enter the email address of another recipient. You can only add one additional recipient. To add multiple recipients, add the email address of a distribution list. In the "Gateway" field, enter the IP address or host name of the Simple Mail Transport Protocol (SMTP) server used to send the email. Select the "OK" button. After you create the Server Profiles that define where to send your logs, you must enable log forwarding. Threat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels you want to forward and then adding it to the security policies for which you want to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection). Configure the log-forwarding profile to select the logs to be forwarded to Email server. Go to Objects >> Log forwarding The "Log Forwarding Profile" window appears. Note: It has five columns. In the "Name" Field, enter the name of the Log Forwarding Profile. In the "Threat Settings" Section in the "Email" column, select the Email server profile for forwarding threat logs to the configured server(s). Select the "OK" button. When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile. For Threat Logs, use the log forwarding profile in the security rules. Go to Policies >> Security Rule. Select the rule for which the log forwarding needs to be applied, which in this case is the Security Policy that is used to detect malicious code (the "Profile" column does display the Antivirus Profile symbol). Apply the log forwarding profile to the rule. In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding" field, select the log forwarding profile from drop-down list. Note: The Log Forwarding field can only have one profile. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must automatically update malicious code protection mechanisms.

- Medium - CCI-004964 - V-228851 - SV-228851r1018773_rule

RMF Control

Severity

Medium

CCI

CCI-004964

Version

PANW-AG-000065

Vuln IDs

V-228851
V-62583

Rule IDs

SV-228851r1018773_rule
SV-77073

Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).

Checks: C-31086r997595_chk

Go to Device >> Dynamic Updates. If no entries for Applications and Threats are present, this is a finding. If the Applications and Threats entry states Download Only, this is a finding. This can be downgraded if a manual process is used. If a manual process is used, compare the Applications and Threats database for the most recent version. Go to Dashboard >> General Information, if the application, threat, and URL filtering definition versions are not the most current ones listed on the vendor support site, this is a finding.

Fix: F-31063r997596_fix

Go to Device >> Dynamic Updates; select "Check Now" at the bottom of the page to retrieve the latest signatures. To schedule automatic signature updates. Note: The steps provided below do not account for local change management policies. Go to Device >> Dynamic Updates; select the text to the right of Schedule. In the "Applications and Threat Updates Schedule" window; complete the required information. In the "Recurrence" field, select Daily. In the "Time" field, enter the time at which you want the device to check for updates. For the Action, select "Download and Install". Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears. If using Dynamic Updates is not possible due to mission requirements, implement a manual process.

b

The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code.

SC-18 - Medium - CCI-001695 - V-228852 - SV-228852r559734_rule

RMF Control

SC-18

Severity

Medium

CCI

CCI-001695

Version

PANW-AG-000073

Vuln IDs

V-228852
V-62585

Rule IDs

SV-228852r559734_rule
SV-77075

Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient. This applies to mobile code that may originate either internal to or external from the enclave. Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient. The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while denying for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.

Checks: C-31087r573789_chk

Go to Objects >> Security Profiles >> Antivirus If there are no Antivirus Profiles configured other than the default, this is a finding. View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB); if the "Action" is anything other than “deny” or "reset-both", this is a finding. Go to Policies >> Security Review each of the configured security policies in turn. For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix: F-31064r573743_fix

To create an Antivirus Profile: Go to Objects >> Security Profiles >> Antivirus Select "Add". In the "Antivirus Profile" window, complete the required fields. Complete the "Name" and "Description" fields. In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the "Action" to “deny" or "reset-both”. Select "OK". Use the Profile in a Security Policy: Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select Profiles. The window will change to display the different categories of Profiles. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must prevent the download of prohibited mobile code.

SC-18 - Medium - CCI-001169 - V-228853 - SV-228853r559712_rule

RMF Control

SC-18

Severity

Medium

CCI

CCI-001169

Version

PANW-AG-000074

Vuln IDs

V-228853
V-62587

Rule IDs

SV-228853r559712_rule
SV-77077

MMobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient. This applies to mobile code that may originate either internal to or external from the enclave. Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient. The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while denying for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.

Checks: C-31088r573741_chk

Go to Objects >> Security Profiles >> Antivirus If there are no Antivirus Profiles configured other than the default, this is a finding. View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB), if the "Action" is anything other than “drop” or “reset-both”, this is a finding. Go to Policies >> Security Review each of the configured security policies in turn. For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix: F-31065r573740_fix

To create an Antivirus Profile: Go to Objects >> Security Profiles >> Antivirus Select "Add". In the "Antivirus Profile" window, complete the required fields. Complete the "Name" and "Description" fields. In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the Action to "drop" or “reset-both”. Select "OK". Use the Profile in a Security Policy: Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; , in the "Profile Type" field, select Profiles. The window will change to display the different categories of Profiles. In the "Actions" tab, in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must control remote access methods (inspect and filter traffic).

AC-17 - Medium - CCI-002314 - V-228854 - SV-228854r831594_rule

RMF Control

AC-17

Severity

Medium

CCI

CCI-002314

Version

PANW-AG-000078

Vuln IDs

V-228854
V-62589

Rule IDs

SV-228854r831594_rule
SV-77079

Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best. Remote access is access to DoD-nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies). If the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, configure the device to inspect and filter decrypted traffic. For each type of SSL/TLS traffic that is decrypted, the resulting traffic must be inspected and filtered. For example, HTTPS traffic that is decrypted must have the HTTP traffic inspected and filtered.

Checks: C-31089r513857_chk

If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable. Go to Policies >> Decryption Note each configured decryption policy. Go to Policies >> Security View the configured security policies. If there is a decryption policy that does not have a corresponding security policy, this is a finding. The matching policy may not be obvious, and it may be necessary for the Administrator to identify the corresponding security policy.

Fix: F-31066r513858_fix

These instructions explain the steps involved, but do not provide specific details since the exact policies and expected traffic are not known. Go to Policies >> Security Select "Add". In the "Security Policy Rule" window, complete the required fields. Configure the Security Policy in accordance with the policy for the resulting decrypted traffic. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security, if used as a TLS gateway/decryption point or VPN concentrator, must provide the capability to immediately disconnect or disable remote access to the information system.

AC-17 - Medium - CCI-002322 - V-228855 - SV-228855r831595_rule

RMF Control

AC-17

Severity

Medium

CCI

CCI-002322

Version

PANW-AG-000079

Vuln IDs

V-228855
V-62591

Rule IDs

SV-228855r831595_rule
SV-77081

Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking place would not be immediately stopped. Remote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The remote access functionality may implement features such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack. If the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, configure the device to deny decrypted traffic that violates the enclave or system policies. For each type of SSL/TLS traffic that is decrypted, the resulting traffic must be inspected and filtered.

Checks: C-31090r513860_chk

If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable. Go to Policies >> Decryption Note each configured decryption policy. Go to Policies >> Security View the configured security policies. If there is a decryption policy that does not have a corresponding security policy, this is a finding. The matching policy may not be obvious, and it may be necessary for the Administrator to identify the corresponding security policy. Select the Security Policy Rules applied to the decrypted traffic. If it allows traffic that is prohibited, this is a finding.

Fix: F-31067r513861_fix

These instructions explain the steps involved but do not provide specific details since the exact policies and expected traffic are not known. Go to Policies >> Security Select "Add". In the "Security Policy Rule" window, complete the required fields. Configure the Security Policy in accordance with the enclave's or system's policy for the resulting decrypted traffic. For any traffic that violates the enclave policy, configure the Security Policy rule to deny the traffic. In the "Security Policy Rule" window, in the "Actions" tab, in the "Action Setting" section, select "deny". For any traffic that is allowed, configure the Security Policy Rule to allow the traffic and apply Antivirus and Vulnerability Protection Profiles. In the "Security Policy Rule" window, in the "Actions" tab, in the "Action Setting" section, select "allow". In the "Security Policy Rule" window, in the "Actions" tab, in the "Profiles Setting" section, select the necessary Profiles. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

To protect against data mining, the Palo Alto Networks security platform must detect and prevent SQL and other code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

AC-23 - Medium - CCI-002346 - V-228856 - SV-228856r831596_rule

RMF Control

AC-23

Severity

Medium

CCI

CCI-002346

Version

PANW-AG-000080

Vuln IDs

V-228856
V-62593

Rule IDs

SV-228856r831596_rule
SV-77083

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a code injection attack. This type of attack includes XPath and LDAP injections.

Checks: C-31091r513863_chk

Go to Objects >> Security Profiles >> Vulnerability Protection If there are no Vulnerability Protection Profiles configured, this is a finding. Ask the Administrator which Vulnerability Protection Profile is used to protect database assets by blocking and alerting on attacks. View the configured Vulnerability Protection Profile Check the "Severity" and "Action" columns. If the Vulnerability Protection Profile used for database protection does not block all critical, high, and medium threats, this is a finding. If the Vulnerability Protection Profile used for database protection does not alert on low and informational threats, this is a finding. Ask the Administrator which Security Policy is used to protect database assets: Go to Policies >> Security View the configured Security Policy. View the "Profile" column. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding. Moving the cursor over the symbol will list the exact Vulnerability Protection Profiles applied. If the specific Vulnerability Protection Profile is not listed, this is a finding.

Fix: F-31068r513864_fix

Create and apply a Vulnerability Protection Profile to protect database assets by blocking and alerting on attacks. This profile has two rules; the first blocks critical, high, and medium threats, and the second alerts on low and informational threats. Go to Objects >> Security Profiles >> Vulnerability Protection Select "Add". In the "Vulnerability Protection Profile" window, complete the required fields. In the "Name" field, enter the name of the Vulnerability Protection Profile. In the "Description" field, enter the description of the Vulnerability Protection Profile. In the "Rules" tab, select "Add". In the "Vulnerability Protection Rule" window, In the "Rule Name" field, enter the Rule name, In the "Threat Name" field, select "any", In the "Action" field, select "block". In the "Host type" field, select "server". Select the check boxes above the "CVE" and "Vendor ID" boxes. In the "Severity" section, select the "critical", "high", and "medium" check boxes. Select "OK". In the "Vulnerability Protection Profile" window, select the configured rule, then select "OK". Add a second rule that alerts on low and informational threats. Apply the Vulnerability Protection Profile to the Security Policy Rules permitting traffic to the databases. Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

To protect against data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

AC-23 - Medium - CCI-002346 - V-228857 - SV-228857r831597_rule

RMF Control

AC-23

Severity

Medium

CCI

CCI-002346

Version

PANW-AG-000081

Vuln IDs

V-228857
V-62595

Rule IDs

SV-228857r831597_rule
SV-77085

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information. Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. These attacks include buffer overrun, XML, JavaScript, and HTML injections. Most current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database. The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.

Checks: C-31092r513866_chk

Go to Objects >> Security Profiles >> Vulnerability Protection If there are no Vulnerability Protection Profiles configured, this is a finding. Ask the Administrator which Vulnerability Protection Profile is used to protect application assets by blocking and alerting on attacks. View the configured Vulnerability Protection Profile; check the "Severity" and "Action" columns. If the Vulnerability Protection Profile used for database protection does not block all critical, high, and medium threats, this is a finding. If the Vulnerability Protection Profile used for database protection does not alert on low and informational threats, this is a finding. Ask the Administrator which Security Policy is used to protect application assets: Go to Policies >> Security View the configured Security Policy; view the "Profile" column. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding. Moving the cursor over the symbol will list the exact Vulnerability Protection Profiles applied. If the specific Vulnerability Protection Profile is not listed, this is a finding.

Fix: F-31069r513867_fix

Create and apply a Vulnerability Protection Profile to protect application assets by blocking and alerting on attacks. This profile has two rules; the first blocks critical, high, and medium threats, and the second alerts on low and informational threats. Go to Objects >> Security Profiles >> Vulnerability Protection Select "Add". In the "Vulnerability Protection Profile" window, complete the required fields. In the "Name" field, enter the name of the Vulnerability Protection Profile. In the "Description" field, enter the description of the Vulnerability Protection Profile. In the "Rules" tab, select "Add". In the "Vulnerability Protection Rule" window, In the "Rule Name" field, enter the Rule name, In the "Threat Name" field, select "any", In the "Action" field, select "block". In the "Host type" field, select "server". Select the check boxes above the "CVE" and "Vendor ID" boxes. In the "Severity" section, select the "critical", "high", and "medium" check boxes. Select "OK". In the "Vulnerability Protection Profile" window, select the configured rule, then select "OK". Add a second rule that alerts on low and informational threats. Apply the Vulnerability Protection Profile to the Security Policy Rules permitting traffic to the applications. Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited.

AU-4 - Medium - CCI-001851 - V-228858 - SV-228858r831598_rule

RMF Control

AU-4

Severity

Medium

CCI

CCI-001851

Version

PANW-AG-000094

Vuln IDs

V-228858
V-62597

Rule IDs

SV-228858r831598_rule
SV-77087

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the device itself (management).

Checks: C-31093r513869_chk

To view a syslog server profile: Go to Device >> Server Profiles >> Syslog If there are no Syslog Server Profiles present, this is a finding. Select each Syslog Server Profile; if no server is configured, this is a finding. View the log-forwarding profile to determine which logs are forwarded to the syslog server: Go to Objects >> Log forwarding If no Log Forwarding Profile is present, this is a finding. The "Log Forwarding Profile" window has five columns. If there are no Syslog Server Profiles present in the Syslog column for the Traffic Log Type, this is a finding. If there are no Syslog Server Profiles present for each of the severity levels of the Threat Log Type, this is a finding. Go to Device >> Log Settings >> System The list of Severity levels is displayed. If any of the Severity levels does not have a configured Syslog Profile, this is a finding. Go to Device >> Log Settings >> Config If the "Syslog" field is blank, this is a finding. Note: Any one failure of a check results in a finding, but failing more than one still results in only one finding. There cannot be multiple findings for a single requirement.

Fix: F-31070r513870_fix

Create a syslog server profile: Go to Device >> Server Profiles >> Syslog Select "Add". In the Syslog Server Profile, enter the name of the profile. Select "Add". In the "Servers" tab, enter the required information. Name: Name of the syslog server Server: Server IP address where the logs will be forwarded to Port: Default port 514 Facility: Select from the drop-down list. Select the "OK" button. After the Server Profiles are created that define where to send the logs, enable log forwarding. The way forwarding is enabled depends on the log type: Traffic Logs-Enable forwarding of Traffic logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) and adding it to the security policies you want to trigger the log forwarding. Only traffic that matches a specific rule within the security policy will be logged and forwarded. Configure the log-forwarding profile to select the logs to be forwarded to syslog server. Go to Objects >> Log forwarding The "Log Forwarding Profile" window appears. Note that it has five columns. In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s). Select the "OK" button. When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile. Threat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels you want to forward and then adding it to the security policies for which you want to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection). Configure the log-forwarding profile to select the logs to be forwarded to syslog server. Go to Objects >> Log forwarding The "Log Forwarding Profile" window appears. Note that it has five columns. In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s). Select the "OK" button. When the Log Forwarding Profile window disappears, the screen will show the configured log-forwarding profile. System Logs-Enable forwarding of System logs by specifying a Server Profile in the log settings configuration. Go to Device >> Log Settings >> System The list of severity levels is displayed. You must select a Server Profile for each severity level you want to forward. Select each severity level in turn; with each selection, the Log "Systems - Setting" window will appear. In the "Log Systems - Setting" window, in the "Syslog" drop-down box, select the configured Server Profile. Select the "OK" button. Config Logs-Enable forwarding of Config logs by specifying a Server Profile in the log settings configuration: Go to Device >> Log Settings >> Config Select the "Edit" icon (the gear symbol in the upper-right corner of the pane). In the "Log Settings Config" window, in the "Syslog" drop-down box, select the configured Server Profile. Select the "OK" button. For Traffic Logs and Threat Logs, use the log forwarding profile in the security rules: Go to Policies >> Security Rule Select the rule for which the log forwarding needs to be applied. Apply the security profiles to the rule. Go to Actions >> Log forwarding Select the log forwarding profile from drop-down list. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform being used for TLS/SSL decryption using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certificate Authorities (CAs) for the establishment of protected sessions.

SC-23 - Medium - CCI-002470 - V-228859 - SV-228859r831599_rule

RMF Control

SC-23

Severity

Medium

CCI

CCI-002470

Version

PANW-AG-000101

Vuln IDs

V-228859
V-62599

Rule IDs

SV-228859r831599_rule
SV-77089

Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place that are sufficient for DoD systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users. The authoritative list of DoD-approved PKIs is published at http://iase.disa.mil/pki-pke/interoperability. DoD-approved PKI CAs may include Category I, II, and III certificates. Category I DoD-Approved External PKIs are PIV issuers. Category II DoD-Approved External PKIs are Non-Federal Agency PKIs cross certified with the Federal Bridge Certification Authority (FBCA). Category III DoD-Approved External PKIs are Foreign, Allied, or Coalition Partner PKIs. Deploying the ALG with TLS enabled will require the installation of DoD and/or DoD-Approved CA certificates in the trusted root certificate store of each proxy to be used for TLS traffic. If the Palo Alto Networks security platform is used for TLS/SSL decryption, configure the Palo Alto Networks security platform to only accept end entity certificates issued by DoD PKI or DoD-approved PKI CAs for the establishment of protected sessions.

Checks: C-31094r513872_chk

If the Palo Alto Networks security platform is not used for TLS/SSL decryption, this is not applicable. If the Palo Alto Networks security platform accepts non-DoD approved PKI end entity certificates, this is a finding.

Fix: F-31071r513873_fix

Import the intermediate CA certificates. To load a CA certificate on the Palo Alto Networks firewall: Go to Device >> Certificate Management >> Certificates On the "Device Certificate" tab, select "Import". In the "Import Certificate" window, complete the required information. In the "Certificate Name" field, enter the name of the certificate. In the "Certificate File" field, select "Browse", then browse to and select the appropriate file. In the "File Format" field, select "Base64 Encoded Certificate (PEM)". Select "OK". Create a Client Certificate Profile: Go to Device >>Certificate Management>> Certificate Profile Select "Add". In the Certificate Profile, complete the required fields. In the "Name" field, enter the name of the Certificate Profile. In the "Username" field, select "Subject". Note: The adjacent field will contain common-name. Add all of the DoD Intermediate Certificates. Select the "Use OCSP" check box. Select the "Block session if certificate status is unknown" check box. Select the "Block session if certificate status cannot be retrieved within timeout". Create an Authentication Profile: Go to Device >> Authentication Profile Select, "Add". In the "Authentication Profile" window, complete the required fields. In the "Authentication" field, add either "RADIUS" or "LDAP" based on the local requirements. In the Server Profile filed, select the server profile for the authentication server.

c

The Palo Alto Networks security platform must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.

SC-5 - High - CCI-002385 - V-228860 - SV-228860r1028362_rule

RMF Control

SC-5

Severity

High

CCI

CCI-002385

Version

PANW-AG-000102

Vuln IDs

V-228860
V-62601

Rule IDs

SV-228860r1028362_rule
SV-77091

If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users. Installation of content filtering gateways and application-layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type. Detection components that use rate-based behavior analysis can detect attacks when signatures for the attack do not exist or are not installed. These attacks include zero-day attacks that are new attacks for which vendors have not yet developed signatures. Rate-based behavior analysis can detect sophisticated, Distributed DoS (DDoS) attacks by correlating traffic information from multiple network segments or components. PAN-OS can use either Zone-Based Protection or End Host Protection to mitigate DoS attacks. Zone-Based Protection protects against most common floods, reconnaissance attacks, and other packet-based attacks and is applied to any zone. End Host Protection is specific to defined end hosts. Zone Protections are always applied on the ingress interface, so to protect against floods or scans from the internet, apply the profile on the zone containing the untrusted internet interface. Security administrators wishing to harden their networks even further can apply Zone Protections to both internal and external interfaces to ensure that protective measures are being applied across the entire environment. It is important to set the Flood Protection parameters that are suitable for the enclave or system. The Administrator should perform a traffic baseline to tune these parameters. Refer to https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVkCAK.

Checks: C-31095r1028360_chk

View the site's Security Protection Plan (SSP). Verify if Zone-based protection, DoS Protection, or both are required by the SSP. There may be more than one configured policy that protects external networks and DMZ networks from DoS type attacks generated from the internal devices on the trusted networks. If the SSP required one or more Zone Protection Policies: 1. Navigate to Network >> Network Profiles >> Zone Protection. 2. Navigate to Network >> Zones and view the "Zone Protection Profile", which should not be blank. 3. If a Zone Protection Profile is not configured, has a blank "Zone Protection Profile" column, or is incorrectly identified, this is a finding. If the SSP requires one or more DoS Protection Policies: 1. Navigate to Objects >> Security Profiles >> DoS Protection. 2. Navigate to Policies >> DoS Protection. 3. If a DoS Protection Profile is not configured, has a blank zone, or is incorrectly identified, this is a finding. If neither a Zone Protection Profile or a DoS Protection policy is not configured to protect external networks and DMZ networks from DoS type attacks generated from the internal devices on the trusted networks, this is a finding.

Fix: F-31072r1028361_fix

Configure either a Zone-Based Protection policy or a DoS Protection policy. Zone Protections are, at a minimum, applied on the ingress interface. To configure a Zone-Based Protection policy, perform the following: 1. Navigate to Network >> Network Profiles >> Zone Protection and select "Add". 2. In the "Zone Protection Profile" window, complete the required fields. 3. In the "General" tab, complete the "Name" and "Description" fields. 4. Configure Flood Protection: a. In the "Flood Protection" tab, select the "Syn" check box, in the "Action" field, select either "Random Early Drop" (preferred in this case) or "SYN Cookie"; complete the "Alert", "Activate", and "Maximum" fields. b. In the "Flood Protection" tab, select the "ICMP" check box; complete the "Alert", "Activate", and "Maximum" fields. c. In the "Flood Protection" tab, select the "ICMPv6" check box; complete the "Alert", "Activate", and "Maximum" fields. d. In the "Flood Protection" tab, select the "Other IP" check box; complete the "Alert", "Activate", and "Maximum" fields. e. In the "Flood Protection" tab, select the "UDP" check box; complete the "Alert", "Activate", and "Maximum" fields. f. For each of the "Alert", "Activate", and "Maximum" fields, the appropriate values depends on the expected traffic of the system. 5. Configure Reconnaissance Protection: a. In the "Reconnaissance Protection" tab, select the "TCP Port Scan", "Host Sweep", and "UDP Port Scan" rows. b. Select the action of Block IP. c. The Interval and Threshold values can either remain as the default values or they can be changed based on the specific traffic conditions of the network. 6. Configure Packet Based Attack Protection settings: a. Select the "Packet Based Attack Protection" tab and select the following at a minimum. b. IP Drop tab: select the "Spoofed IP address", "Strict Source Routing", "Loose Source Routing", "Unknown", and "Malformed". c. TCP Drop tab: select "Mismatched overlapping TCP segment" and "TCP Timestamp", and for the "Reject Non-SYN TCP" field, select "yes". For the "Asymmetric Path" field, select "bypass". d. ICMP Drop tab: select the "ICMP Ping ID 0, ICMP Fragment", and "ICMP Large Packet(>1024)" check-boxes. The "Suppress ICMP TTL Expired Error" and "Suppress ICMP Frag Needed" check-boxes can remain unchecked unless this profile will be applied to an internal or DMZ. e. IPv6 Drop tab: select the "Type 0 Routing Header", "IPv4 compatible address", "Anycast source address", "Needless fragment header", "MTU in ICMPv6 'Packet Too Big' less than 1280 bytes", "Hop-by-Hop extension", "Routing extension", "Destination extension", "Invalid IPv6 options in extension header", and "Non-zero reserved field" check-boxes. f. In the "ICMPv6" tab, select the "ICMPv6 destination unreachable", "ICMPv6 packet too big", "ICMPv6 time exceeded", "ICMPv6 parameter problem", and "ICMPv6 redirect" check-boxes. g. Click "OK". 7. Apply the Zone Protection Profile to the internal zone and the DMZ: a. Select Network >> Zones and select the internal zone. b. In the "Zone" window, in the "Zone Protection Profile" window, select the configured Zone Protection Profile. c. Click "OK". d. Select Network >> Zones and select the DMZ zone. e. In the "Zone" window, in the "Zone Protection Profile" window, select the configured Zone Protection Profile. f. Click "OK". 8. Commit the changes. To configure a DoS Protection policy: 1. Navigate to Objects >> Security Profiles >> DoS Protection. 2. Select "Add" to create a new profile. 3. In the "DoS Protection Profile" window, complete the required fields. For the "Type", select "Classified". 4. Configure Flood Protection by enabling each type of flood protection and configuring the following at a minimum: a. SYN Flood tab: select "SYN Cookie" as the action. b. UDP Flood tab: select "UDP Flood and complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. c. ICMP Flood tab: select "ICMP Flood" and complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. d. ICMPv6 Flood tab: select "ICMPv6 Flood" and complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. e. Other IP Flood tab: select "Other IP Flood" check box and complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields. 5. Configure Resources Protection in the Resources Protection tab with the following settings: a. Select "Maximum Concurrent Sessions". b. Complete the "Max Concurrent Sessions" field. If the DoS profile type is aggregate, this limit applies to the entire traffic hitting the DoS rule on which the DoS profile is applied. c. Click "OK", and then click "Commit". 6. Create a DoS protection policy that specifies the criteria for matching the incoming traffic. a. Navigate to Policies >> DoS Protection and select "Add" to create a new policy. b. In the "DoS Rule" Window, complete the required fields. c. In the "General" tab, complete the "Name" and "Description" fields. d. In the "Source" tab, for "Zone", select the "External zone", and for "Source Address", select "Any". e. In the "Destination" tab, "Zone", select "Internal zone", and for "Destination Address", select "Any". f. In the "Option/Protection" tab, for "Service", select "Any", and for "Action", select "Protect". g. Select the "Classified" check-box. h. In the "Profile" field, select the configured DoS Protection profile containing the ingress interface. i. In the "Address" field, select destination-ip-only. j. Click "OK", and then click "Commit".

b

The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.

SC-5 - Medium - CCI-002385 - V-228861 - SV-228861r831603_rule

RMF Control

SC-5

Severity

Medium

CCI

CCI-002385

Version

PANW-AG-000105

Vuln IDs

V-228861
V-62603

Rule IDs

SV-228861r831603_rule
SV-77093

If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users. Installation of content filtering gateways and application-layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume, type, or protocol usage.

Checks: C-31096r513878_chk

Go to Objects >> Security Profiles >> Vulnerability Protection If there are no Vulnerability Protection Profiles configured, this is a finding. Ask the Administrator which Vulnerability Protection Profile is used for interzone traffic. View the configured Vulnerability Protection Profiles. Check the "Severity" and "Action" columns. If the Vulnerability Protection Profile used for interzone traffic does not block all critical, high, and medium threats, this is a finding. Go to Policies >> Security Review each of the configured security policies in turn. For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix: F-31073r513879_fix

To add a Vulnerability Protection Profile: Go to Objects >> Security Profiles >> Vulnerability Protection Select "Add". In the "Vulnerability Protection Profile" window, complete the required fields. In the "Name" field, enter the name of the Vulnerability Protection Profile. In the "Description" field, enter the description of the Vulnerability Protection Profile. In the "Rules" tab, select "Add". In the "Vulnerability Protection Rule" window, In the "Rule Name" field, enter the Rule name, In the "Threat Name" field, enter "any" (this will match all signatures), In the "Action" field, select "block". In the "Host type" field, select "any", Select the checkboxes above the "CVE" and "Vendor ID" boxes. In the "Severity" section, select the "critical", "high", and "medium" check boxes. Select "OK". In the "Vulnerability Protection Profile" window, select the configured rule, then select "OK". Use the Profile in a Security Policy: Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.

SC-7 - Medium - CCI-002403 - V-228862 - SV-228862r997601_rule

RMF Control

SC-7

Severity

Medium

CCI

CCI-002403

Version

PANW-AG-000107

Vuln IDs

V-228862
V-62605

Rule IDs

SV-228862r997601_rule
SV-77095

Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application-level firewalls and web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate. Security policies on the Palo Alto Networks security platform match source, destination, application and a service. The application and service columns specify what applications can be identified on a defined set of ports, or on all available ports. The service column allows administrator to define one of the following: Application-default - The service application-default sets security policy to allow the application on the standard ports associated with the application. Pre-defined service “service-http” and “service-https” - The pre-defined services use TCP ports 80 and 8080 for HTTP, and TCP port 443 for HTTPS. Use this security policy if you want to restrict web browsing and HTTPS to these ports. Any - Use this service to deny applications. Custom service - Use this to define TCP/UDP port numbers to restrict applications to specific ports.

Checks: C-31097r997599_chk

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification or Accreditation Package. Go to Policies >> Security; review each of the configured security policies in turn. If any of the policies allows traffic that is not part of the authorized sources and destinations list, this is a finding.

Fix: F-31074r997600_fix

To create or edit a Security Policy: Go to Policies >> Security. Select "Add" to create a new security policy, or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must identify and log internal users associated with prohibited outgoing communications traffic.

SC-7 - Medium - CCI-002400 - V-228863 - SV-228863r831605_rule

RMF Control

SC-7

Severity

Medium

CCI

CCI-002400

Version

PANW-AG-000109

Vuln IDs

V-228863
V-62607

Rule IDs

SV-228863r831605_rule
SV-77097

Without identifying the users who initiated the traffic, it would be difficult to identify those responsible for the prohibited communications. This requirement applies to those network elements that perform Data Leakage Prevention (DLP) (e.g., ALGs, proxies, or application-level firewalls). The Palo Alto Networks Security Platform uses User-ID to map a user's identity to an IP address. This allows Administrators to configure and enforce firewall policies based on users and user groups in addition to network zones and addresses. If the user changes devices or the device is assigned a different IP address, User-ID tracks those changes and maintains the user to IP address mapping information. This supports non-repudiation. Before a security policy can be written for groups of users, the relationships between the users and the groups they are members of must be established. This information can be retrieved from an LDAP directory, such as Active Directory or eDirectory.

Checks: C-31098r513884_chk

Log into device Command Line Interface. Enter the command "show user ip-user-mapping all". If the output is blank, this is a finding. An alternate means to verify that User-ID is properly configured, view the URL Filtering and Traffic logs is to view the logs. To view the URL Filtering logs: Go to Monitor >> Logs >> URL Filtering To view the Traffic logs: Go to Monitor >> Logs >> Traffic User traffic originating from a trusted zone contains a username in the "Source User" column. If the "Source User" column is blank, this is a finding. Alternatively, verify that usernames are displayed in reports. Go to Monitor >> Reports Select the "Denied Applications Report". If the "Source User" fields are empty, this is a finding.

Fix: F-31075r513885_fix

User-ID can integrate with the enclave's systems using different methods; therefore, the exact configuration is dependent on the method chosen. Determine which method User-ID will use to integrate with the enclave's systems - Server Monitoring, Client Probing, Syslog User-ID Agent, Terminal Services Agent, or Captive Portal. Configure how groups and users are retrieved from the directory and which users groups are to be included in policies. Configure the Security Policies that controls traffic from client hosts in the trust zone to the untrust zone. Go to Policies >> Security Select "Add" to create a new policy or select the Name of the Policy to edit it. In the "Security Policy Rule" window, complete the required fields. In the "General" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. In the "User" tab, select "any". In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. In the "Applications" tab, select the authorized applications. In the "Service/URL Category" tab, select "application-default". To add a service, select the "Service" check box, select "Add" and select a listed service or add a new service or service group. In the "Actions" tab, select either "Deny" or "Allow (as required)" as the resulting action. Select the required Log Setting and Profile Settings as necessary. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

a

The Palo Alto Networks security platform must be configured to integrate with a system-wide intrusion detection system.

SI-4 - Low - CCI-002656 - V-228864 - SV-228864r831606_rule

RMF Control

SI-4

Severity

Low

CCI

CCI-002656

Version

PANW-AG-000111

Vuln IDs

V-228864
V-62609

Rule IDs

SV-228864r831606_rule
SV-77099

Without coordinated reporting between separate devices, it is not possible to identify the true scale and possible target of an attack. Integration of the Palo Alto Networks security platform with a system-wide intrusion detection system supports continuous monitoring and incident response programs. This requirement applies to monitoring at internal boundaries using TLS gateways, web content filters, email gateways, and other types of ALGs. The Palo Alto Networks security platform can work as part of the network monitoring capabilities to off-load inspection functions from the external boundary IDPS by performing more granular content inspection of protocols at the upper layers of the OSI reference model. NetFlow is an industry-standard protocol that enables the firewall to record statistics on the IP traffic that traverses its interfaces. The Palo Alto Networks security platform can export the statistics as NetFlow fields to a NetFlow collector. The NetFlow collector is a server you use to analyze network traffic for security, administration, accounting and troubleshooting purposes.

Checks: C-31099r513887_chk

Go to Device >> Server Profiles >> NetFlow If no NetFlow Server Profiles are configured, this is a finding. This step assumes that it is one of the Ethernet interfaces that is being monitored. The verification is the same for Ethernet, VLAN, Loopback and Tunnel interfaces. Ask the administrator which interface is being monitored; there may be more than one. Go to Network >> Interfaces >> Ethernet Select the interface that is being monitored. If the "Netflow Profile" field is "None", this is a finding.

Fix: F-31076r513888_fix

To create a NetFlow Server Profile: Go to Device >> Server Profiles >> NetFlow Select "Add". In the "NetFlow Server Profile" window, complete the required fields. In the "Name" field, enter the name of the NetFlow Server Profile. In the "Minutes" field, enter the number of minutes after which the NetFlow template is refreshed. In the "Packets" field, enter the number of packets after which the NetFlow template is refreshed. In the "Active Timeout" field, enter the frequency (in minutes) the device exports records. Select the "PAN-OS Field Types" check box to export "App-ID" and "User-ID" fields. Select "Add" to add a NetFlow collector. In the "Name" field, enter the name of the server. In the "NetFlow Server" field, enter the hostname or IP address of the server. In the "Port" field enter the port used by the NetFlow collector (default 2055). Select "OK". Assign the NetFlow server profile to the interfaces that carry the traffic to be analyzed. These steps assume that it is one of the Ethernet interfaces. The configuration is the same for Ethernet, VLAN, Loopback, and Tunnel interfaces. Go to Network >> Interfaces >> Ethernet Select the interface that the traffic traverses. In the "Ethernet Interface" window, in the "Netflow Profile" field, select the configured Netflow Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.

SI-4 - Medium - CCI-002683 - V-228865 - SV-228865r831607_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002683

Version

PANW-AG-000112

Vuln IDs

V-228865
V-62611

Rule IDs

SV-228865r831607_rule
SV-77101

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. Examples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.

Checks: C-31100r513890_chk

Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO. For each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic. If there is no list of unauthorized network services, this is a finding. If there are no configured security policies that specifically match the list of unauthorized network services, this is a finding. If the security policies do not deny the traffic associated with the unauthorized network services, this is a finding.

Fix: F-31077r513891_fix

To create or edit a Security Policy: Go to Policies >> Security Select "Add" to create a new security policy, or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must generate a log record when unauthorized network services are detected.

SI-4 - Medium - CCI-002684 - V-228866 - SV-228866r831608_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002684

Version

PANW-AG-000113

Vuln IDs

V-228866
V-62613

Rule IDs

SV-228866r831608_rule
SV-77103

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. Examples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.

Checks: C-31101r513893_chk

Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO. For each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic. To verify if a Security Policy logs denied traffic: Go to Policies >> Security Select the name of the security policy to view it. In the "Actions" tab, in the "Log Setting" section, if neither the "Log at Session Start" nor the "Log at Session End" check boxes are checked, this is a finding.

Fix: F-31078r513894_fix

To configure a Security Policy to log denied traffic: Go to Policies >> Security Select "Add" to create a new security policy, or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. In the "Actions" tab, select the Log forwarding profile and select "Log at Session End". "Log at Session Start" may be selected under specific circumstances, but "Log at Session End" is preferred. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when unauthorized network services are detected.

SI-4 - Medium - CCI-002684 - V-228867 - SV-228867r831609_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002684

Version

PANW-AG-000114

Vuln IDs

V-228867
V-62615

Rule IDs

SV-228867r831609_rule
SV-77105

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services. Automated mechanisms can be used to send automatic alerts or notifications. Such automatic alerts or notifications can be conveyed in a variety of ways (e.g., telephonically, via electronic mail, via text message, or via websites). The Palo Alto Networks security platform must either send the alert to an SNMP or Syslog console that is actively monitored by authorized personnel (including the ISSO and ISSM) or use e-mail to send the alert directly to designated personnel.

Checks: C-31102r513896_chk

Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO. For each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic. Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog). View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding. View the Log Forwarding Profiles: Go to Objects >> Log Forwarding Determine which Server Profile is associated with each Log Forwarding Profile. View the Security Policies that are used to block unauthorized network services. Go to Policies >> Security Select the name of the security policy to view it. In the "Actions" tab, in the "Log Setting" section, view the Log Forwarding Profile. If there is no Log Forwarding Profile, this is a finding.

Fix: F-31079r513897_fix

Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients. To create an email server profile: Go to Device >> Server Profiles >> Email Select "Add". In the Email Server Profile, enter the name of the profile. Select "Add". In the "Servers" tab, enter the required information: In the "Name" field, enter the name of the Email server In the "Email Display Name" field, enter the name shown in the "From" field of the email. In the "From" field, enter the From email address. In the "To" field, enter the email address of the recipient. In the "Additional Recipient" field, enter the email address of another recipient. Only one additional recipient can be added. To add multiple recipients, add the email address of a distribution list. In the "Gateway" field, enter the "IP address" or "host name" of the Simple Mail Transport Protocol (SMTP) server used to send the email. Select the "OK" button. Configure a Log Forwarding Profile: Go to Objects >> Log Forwarding Go to Policies >> Security Select "Add" to create a new security policy or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. In the "Actions" tab, select the Log forwarding profile and select "Log at Session End". "Log at Session Start" may be selected under specific circumstances, but "Log at Session End" is preferred. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must continuously monitor inbound communications traffic crossing internal security boundaries.

SI-4 - Medium - CCI-002661 - V-228868 - SV-228868r831610_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002661

Version

PANW-AG-000115

Vuln IDs

V-228868
V-62617

Rule IDs

SV-228868r831610_rule
SV-77107

If inbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs. Internal monitoring includes the observation of events occurring on the network crosses internal boundaries at managed interfaces such as web content filters. Depending on the type of ALG, organizations can monitor information systems by monitoring audit activities, application access patterns, characteristics of access, content filtering, or unauthorized exporting of information across boundaries. Unusual/unauthorized activities or conditions may include large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses. Most current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database. The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.

Checks: C-31103r513899_chk

Obtain the network architecture diagrams and identify where traffic crosses from one internal zone to another and review the configuration of the Palo Alto Networks security platform. The specific security policy is based on the authorized endpoints, applications, and protocols. If it does not monitor traffic passing between zones, this is a finding.

Fix: F-31080r513900_fix

The network architecture diagrams must identify where traffic crosses from one internal zone to another. The specific security policy is based on the authorized endpoints, applications, and protocols. To create or edit a Security Policy: Go to Policies >> Security Select "Add" to create a new security policy, or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must continuously monitor outbound communications traffic crossing internal security boundaries.

SI-4 - Medium - CCI-002662 - V-228869 - SV-228869r831611_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002662

Version

PANW-AG-000116

Vuln IDs

V-228869
V-62619

Rule IDs

SV-228869r831611_rule
SV-77109

If outbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs. Internal monitoring includes the observation of events occurring on the network crosses internal boundaries at managed interfaces such as web content filters. Depending on the type of ALG, organizations can monitor information systems by monitoring audit activities, application access patterns, characteristics of access, content filtering, or unauthorized exporting of information across boundaries. Unusual/unauthorized activities or conditions may include large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses. Most current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database. The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.

Checks: C-31104r513902_chk

Obtain the network architecture diagrams and identify where traffic crosses from one internal zone to another and review the configuration of the Palo Alto Networks security platform. If it does not monitor traffic passing between zones, this is a finding.

Fix: F-31081r513903_fix

The network architecture diagrams must identify where traffic crosses from one internal zone to another. The specific security policy is based on the authorized endpoints, applications, and protocols. To create or edit a Security Policy: Go to Policies >> Security Select "Add" to create a new security policy or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.

SI-4 - Medium - CCI-002664 - V-228870 - SV-228870r971533_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002664

Version

PANW-AG-000118

Vuln IDs

V-228870
V-62621

Rule IDs

SV-228870r971533_rule
SV-77111

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel. Current USSTRATCOM warning and tactical directives/orders include Fragmentary Order (FRAGO), Communications Tasking Orders (CTOs), IA Vulnerability Notices, Network Defense Tasking Message (NDTM), DOD GIG Tasking Message (DGTM), and Operations Order (OPORD).

Checks: C-31105r513905_chk

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog). View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding. View the Log Forwarding Profiles; this is under Objects >> Log Forwarding. Determine which Server Profile is associated with each Log Forwarding Profile. View the Security Policies that are used to enforce policies issued by authoritative sources. Go to Policies >> Security; select the name of the security policy to view it. In the Actions tab, in the Log Setting section, view the Log Forwarding Profile. If there is no Log Forwarding Profile, this is a finding.

Fix: F-31082r513906_fix

Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients. To create an email server profile: Go to Device >> Server Profiles >> Email Select "Add". In the Email Server Profile, enter the name of the profile. Select "Add". In the "Servers" tab, enter the required information: In the "Name" field, enter the name of the Email server In the "Email Display Name" field, enter the name shown in the From field of the email. In the "From" field, enter the From email address. In the "To" field, enter the email address of the recipient. In the "Additional Recipient" field, enter the email address of another recipient. Only one additional recipient can be added. To add multiple recipients, add the email address of a distribution list. In the "Gateway" field, enter the IP address or host name of the Simple Mail Transport Protocol (SMTP) server used to send the email. Select the "OK" button. Configure a Log Forwarding Profile: Go to Objects >> Log Forwarding Go to Policies >> Security Select "Add" to create a new security policy or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. In the "Actions" tab, select the Log forwarding profile and select "Log at Session End". "Log at Session Start" may be selected under specific circumstances, but "Log at Session End" is preferred. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when rootkits or other malicious software which allows unauthorized privileged access is detected.

SI-4 - Medium - CCI-002664 - V-228871 - SV-228871r971533_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002664

Version

PANW-AG-000119

Vuln IDs

V-228871
V-62623

Rule IDs

SV-228871r971533_rule
SV-77113

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The Palo Alto Networks security platform generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Category 1; Root Level Intrusion (Incident)-Unauthorized privileged access to an IS. Category 4; Malicious Logic (Incident)-Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks: C-31106r513908_chk

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog). View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding. View the Log Forwarding Profiles: Go to Objects >> Log Forwarding Determine which Server Profile is associated with each Log Forwarding Profile. View the Security Policies that are used to filter traffic into the Internal or DMZ zones. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding. If the "Profile" column does not display the "Anti-spyware" symbol (which looks like a magnifying glass on a shield), this is a finding. If the "Options" column does not display the "Log Forwarding Profile" symbol, this is a finding.

Fix: F-31083r513909_fix

This requires the use of an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile. Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients. Configure a Log Forwarding Profile: Go to Objects >> Log Forwarding Configure an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile in turn. Note: A custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. The selected Anti-spyware Profile must use the block action at the critical, high, and medium severity threat levels. Use the Antivirus Profile, Anti-spyware Profile, and the Vulnerability Protection Profile in a Security Policy that filters traffic to Internal and DMZ zones; Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile. In the "Actions" tab in the "Profile Setting" section; in the "Anti-spyware" field, select the configured or Strict Anti-spyware Profile. In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile. In the "Actions" tab in the "Log Setting" section, select "Log At Session End". This generates a traffic log entry for the end of a session and logs drop and deny entries. In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding field", select the log forwarding profile from drop-down list. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when rootkits or other malicious software which allows unauthorized non-privileged access is detected.

SI-4 - Medium - CCI-002664 - V-228872 - SV-228872r971533_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002664

Version

PANW-AG-000120

Vuln IDs

V-228872
V-62625

Rule IDs

SV-228872r971533_rule
SV-77115

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks: C-31107r513911_chk

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog). View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding. View the Log Forwarding Profiles: Go to Objects >> Log Forwarding Determine which Server Profile is associated with each Log Forwarding Profile. View the Security Policies that are used to filter traffic into the Internal or DMZ zones. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding. If the "Profile" column does not display the "Anti-spyware" symbol (which looks like a magnifying glass on a shield), this is a finding. If the "Options" column does not display the "Log Forwarding Profile" symbol, this is a finding.

Fix: F-31084r513912_fix

This requires the use of an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile. Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients. Configure a Log Forwarding Profile: Go to Objects >> Log Forwarding Configure an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile in turn. Note: A custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. The selected Anti-spyware Profile must use the block action at the critical, high, and medium severity threat levels. Use the Antivirus Profile, Anti-spyware Profile, and the Vulnerability Protection Profile in a Security Policy that filters traffic to Internal and DMZ zones: Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile. In the "Actions" tab in the "Profile Setting" section; in the "Anti-spyware" field, select the configured or Strict Anti-spyware Profile. In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile. In the "Actions" tab in the "Log Setting" section, select "Log At Session End". This generates a traffic log entry for the end of a session and logs drop and deny entries. In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding" field, select the log forwarding profile from drop-down list. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must generate a log record that can be used to send an alert to, at a minimum, the information system security officer (ISSO) and information system security manager (ISSM) when denial-of-service (DoS) incidents are detected.

SI-4 - Medium - CCI-002664 - V-228873 - SV-228873r1028365_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002664

Version

PANW-AG-000121

Vuln IDs

V-228873
V-62627

Rule IDs

SV-228873r1028365_rule
SV-77117

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DOD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel. Configure a Server Profile for use with Log Forwarding Profile(s);if email is used, the ISSO and ISSM must be recipients. Some sites have discovered that, when configuring Zone Protection, if the "Log Setting" is not configured for the zones where Zone Protection is applied (i.e., Log Setting is set to "None"), then the "Log Setting" column will show blank for those zone under Network >> Zones, and alerts for Zone Protection events will not be sent. Thus, alternative mitigations have been provided to meet this requirement.

Checks: C-31108r1028363_chk

Ask the Administrator how the ISSO and ISSM are receiving alerts (email, SNMP Trap, or Syslog). View the configured Server Profile: Go to Device >> Server Profile. If there is no Server Profile for the method explained, this is a finding. View the Log Forwarding Profiles: Go to Objects >> Log Forwarding. Determine which Server Profile is associated with each Log Forwarding Profile. If there are no Log Forwarding Profiles configured, this is a finding. Go to Policies >> DoS Protection. If there are no DoS Protection Policies, this is a finding. There may be more than one configured DoS Protection Policy. If there is no such DoS Protection Policy, this is a finding. In the "Log Forwarding" field, if there is no configured Log Forwarding Profile, this is a finding. Alternately, a Zone Protection Profile can be used either instead of, or in addition to, a DoS Protection Policy. Ask the Administrator how the ISSO and ISSM are receiving alerts (e-mail, SNMP Trap, or Syslog). View the configured Server Profile. If there is no Server Profile for the method explained, this is a finding. View the Log Forwarding Profiles: Go to Objects >> Log Forwarding. Determine which Server Profile is associated with each Log Forwarding Profile. If there are no Log Forwarding Profiles configured, this is a finding. Navigate to Network >> Zones. If the "Zone Protection Profile" column for all zones is blank, this is a finding. For each zone with the "Zone Protection Profile" column configured, if the "Log Setting" column is blank, this is a finding.

Fix: F-31085r1028364_fix

Configure a Log Forwarding Profile: Go to Objects >> Log Forwarding. Go to Policies >> DoS Protection. Select "Add" to create a new policy or select the Name of the Policy to edit it. In the "DoS Rule" Window, complete the required fields. In the "Option/Protection" tab, in the "Log Forwarding" field, select the configured Log Forwarding Profile. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears. Alternately, a Zone Protection Profile can be used either instead of or in addition to a DoS Protection Policy. Go to Network>>Zone. Select “Add” or select an existing Zone. In the Zone window, in the Zone Protection Profile field, select or create a Zone Protection Profile. Configure the applicable fields in the Flood Protection, Reconnaissance Protection, and Packet Based Attack Protection as needed. In the Zone window, in the Log Setting field, select a configured log forwarding profile. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.

SI-4 - Medium - CCI-002664 - V-228874 - SV-228874r971533_rule

RMF Control

SI-4

Severity

Medium

CCI

CCI-002664

Version

PANW-AG-000122

Vuln IDs

V-228874
V-62629

Rule IDs

SV-228874r971533_rule
SV-77119

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information. The device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema. CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected. Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks: C-31109r513917_chk

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog). View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding. View the Log Forwarding Profiles: Go to Objects >> Log Forwarding Determine which Server Profile is associated with each Log Forwarding Profile. View the Security Policies that are used to filter traffic between zones or subnets. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding. If the "Options" column does not display the "Log Forwarding Profile" symbol, this is a finding.

Fix: F-31086r513918_fix

Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients. Configure a Log Forwarding Profile: Go to Objects >> Log Forwarding Go to Objects >> Security Profiles >> Antivirus Select "Add" to create a new Antivirus Profile or select the name of the profile to edit it. Use the Antivirus Profile in a Security Policy: Go to Policies >> Security Select an existing policy rule or select "Add" to create a new one. In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile. Select "OK". In the "Actions" tab in the "Log Setting" section, select "Log At Session End". In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding" field, select the log forwarding profile from drop-down list. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must block traceroutes and ICMP probes originating from untrusted networks (e.g., ISP and other non-DoD networks).

SI-11 - Medium - CCI-001314 - V-228875 - SV-228875r557387_rule

RMF Control

SI-11

Severity

Medium

CCI

CCI-001314

Version

PANW-AG-000127

Vuln IDs

V-228875
V-62631

Rule IDs

SV-228875r557387_rule
SV-77121

Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can give configuration details about the network element. The traceroute utility will display routes and trip times on an IP network. An attacker can use traceroute responses to create a map of the subnets and hosts behind the boundary. The traditional traceroute relies on TTL - time exceeded responses from network elements along the path and an ICMP port-unreachable message from the target host. In some Operating Systems such as UNIX, trace route will use UDP port 33400 and increment ports on each response. Since blocking these UDP ports alone will not block trace route capabilities along with blocking potentially legitimate traffic on a network, it's unnecessary to block them explicitly. Because traceroutes typically rely on ICMP Type 11 - Time exceeded message, the time exceeded message will be the target for implicitly or explicitly blocking outbound from the trusted network.

Checks: C-31110r513920_chk

Ask the Administrator which Security Policy blocks traceroutes and ICMP probes. Go to Policies >> Security View the identified Security Policy. If the "Source Zone" field is not external and the "Source Address" field is not any, this is a finding. If the "Destination Zone" fields do not include the internal and DMZ zones and the "Destination Address" field is not any, this is a finding. Note: The exact number and name of zones is specific to the network. If the "Application" fields do not include "icmp", "ipv6-icmp", and "traceroute", this is a finding. If the "Actions" field does not show "Deny" as the resulting action, this is a finding.

Fix: F-31087r513921_fix

Although the default inter-zone Security Policy will deny this traffic, a specific Security Policy should be used. To configure the security policy: Go to Policies >> Security Select "Add". In the "Security Policy Rule" window, complete the required fields. In the "General" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. For the "Source Zone" field, select "external". For the "Source Address" field, select "any". In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. For the "Destination Zone" field, select the internal and DMZ zones. Note: The exact number and name of zones are specific to the network. For the "Destination Address" field, select "any". In the "Applications" tab, select "icmp", "ipv6-icmp", "traceroute". In the "Actions tab", select "Deny" as the resulting action. Select the required Log Setting and Profile Settings as necessary. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.

SC-13 - Medium - CCI-002450 - V-228876 - SV-228876r831617_rule

RMF Control

SC-13

Severity

Medium

CCI

CCI-002450

Version

PANW-AG-000141

Vuln IDs

V-228876
V-62633

Rule IDs

SV-228876r831617_rule
SV-77123

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Checks: C-31111r513923_chk

If the Palo Alto Networks security platform does not provide encryption intermediary services (e.g., HTTPS or TLS), this is not applicable. Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "show fips-mode" or the command show fips-cc (for more recent releases). If fips-mode or fips-cc is set to off, this is a finding.

Fix: F-31088r513924_fix

Power off the device by unplugging it from the electrical outlet. Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device. The serial parameters are "9600 baud", "8 data bits", "no parity", and "1 stop bit". A USB to serial adapter will be necessary if the computer does not have a serial port. During the boot sequence, this message will appear: Autoboot to default partition in 5 seconds. Enter "maint" to boot to "maint" partition. Enter "maint" to enter maintenance mode. Press "Enter", and the "Maintenance Recovery tool" menu will appear. Select "Set FIPS Mode" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode. Note: This will remove all installed licenses and disable the serial port.

b

The Palo Alto Networks security platform, if used for TLS/SSL decryption, must use NIST FIPS-validated cryptography to implement encryption.

SC-13 - Medium - CCI-002450 - V-228877 - SV-228877r831618_rule

RMF Control

SC-13

Severity

Medium

CCI

CCI-002450

Version

PANW-AG-000143

Vuln IDs

V-228877
V-62635

Rule IDs

SV-228877r831618_rule
SV-77125

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Checks: C-31112r513926_chk

If the Palo Alto Networks security platform is not used for TLS/SSL decryption, this is not applicable. Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "show fips-mode" or the command show fips-cc (for more recent releases). If fips mode is set to off, this is a finding.

Fix: F-31089r513927_fix

Power off the device by unplugging it from the electrical outlet. Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device. The serial parameters are "9600 baud", "8 data bits", "no parity", and "1 stop bit". A USB to serial adapter will be necessary if the computer does not have a serial port. During the boot sequence, this message will appear: Autoboot to default partition in 5 seconds. Enter "maint" to boot to "maint" partition. Enter "maint" to enter maintenance mode. Press "Enter", and the "Maintenance Recovery tool" menu will appear. Select "Set FIPS Mode" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode. Note: This will remove all installed licenses and disable the serial port.

a

The Palo Alto Networks security platform must, at a minimum, off-load threat and traffic log records onto a centralized log server in real time.

AU-4 - Low - CCI-001851 - V-228878 - SV-228878r831619_rule

RMF Control

AU-4

Severity

Low

CCI

CCI-001851

Version

PANW-AG-000144

Vuln IDs

V-228878
V-62637

Rule IDs

SV-228878r831619_rule
SV-77127

Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised. Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the Palo Alto Networks security platform is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time, which indicates that the time from event detection to off-loading is seconds or less. For the purposes of this requirement, the terms "real time" and "near-real time" are equivalent. This does not apply to audit logs generated on behalf of the device itself (management).

Checks: C-31113r513929_chk

To view a syslog server profile: Go to Device >> Server Profiles >> Syslog If there are no Syslog Server Profiles present, this is a finding. Select each Syslog Server Profile; if no server is configured, this is a finding. View the log-forwarding profile to determine which logs are forwarded to the syslog server. Go to Objects >> Log forwarding If no Log Forwarding Profile is present, this is a finding. The "Log Forwarding Profile" window has five columns. If there are no Syslog Server Profiles present in the "Syslog" column for the Traffic Log Type, this is a finding. If there are no Syslog Server Profiles present for each of the severity levels of the Threat Log Type, this is a finding. Go to Device >> Log Settings >> System Logs The list of Severity levels is displayed. If any of the Severity levels does not have a configured Syslog Profile, this is a finding. Go to Device >> Log Settings >> Config Logs If the "Syslog field" is blank, this is a finding.

Fix: F-31090r513930_fix

To create a syslog server profile: Go to Device >> Server Profiles >> Syslog Select "Add". In the Syslog Server Profile, enter the name of the profile. Select "Add". In the "Servers" tab, enter the required information. Name: Name of the syslog server Server: Server IP address where the logs will be forwarded to Port: Default port 514 Facility: Select from the drop-down list. Select the "OK" button. After you create the Server Profiles that define where to send the logs, log forwarding must be enabled. The way forwarding is enabled depends on the log type: Traffic Logs-Enable forwarding of Traffic logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) and adding it to the security policies to trigger the log forwarding. Only traffic that matches a specific rule within the security policy will be logged and forwarded. Configure the log-forwarding profile to select the logs to be forwarded to syslog server. Go to Objects >> Log forwarding The "Log Forwarding Profile" window appears. Note that it has five columns. In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s). Select the "OK" button. When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile. Threat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels to forward and then adding it to the security policies for which to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection). Configure the log-forwarding profile to select the logs to be forwarded to syslog server. Go to Objects >> Log forwarding The "Log Forwarding Profile" window appears. Note that it has five columns. In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s). Select the "OK" button. When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile. For Traffic Logs and Threat Logs, use the log forwarding profile in the security rules. Go to Policies >> Security Rule Select the rule for which the log forwarding needs to be applied. Apply the security profiles to the rule. Go to Actions >> Log forwarding Select the log forwarding profile from drop-down list. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

b

The Palo Alto Networks security platform must inspect inbound and outbound SMTP and Extended SMTP communications traffic (if authorized) for protocol compliance and protocol anomalies.

SC-7 - Medium - CCI-001125 - V-228879 - SV-228879r557387_rule

RMF Control

SC-7

Severity

Medium

CCI

CCI-001125

Version

PANW-AG-000147

Vuln IDs

V-228879
V-62639

Rule IDs

SV-228879r557387_rule
SV-77129

Application protocol anomaly detection examines application layer protocols such as SMTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound SMTP and Extended SMTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.

Checks: C-31114r513932_chk

If SMTP or ESMTP is authorized, ask the Administrator which Security Policy inspects authorized SMTP and ESMTP traffic. Go to Policies >> Security Select the identified Security Policy. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix: F-31091r513933_fix

If SMTP or ESMTP is authorized, configure a security policy to allow it and inspect it. Go to Policies >> Security Select "Add" to create a new security policy or select the name of the security policy to edit it. In the "Security Policy Rule" window, complete the required fields. In the "Name" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. In the "User" tab, complete the "Source User" and "HIP Profile" fields. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. In the "Applications" tab, either select the "Any" check box or add SMTP. Configured filters and groups can be selected if the group includes SMTP. In the "Actions" tab, select "allow". In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Profile Setting" section; in each of the "Profile" fields, select the configured Profile. Note: An Antivirus Profile and an Antispyware Profile are required.

b

The Palo Alto Networks security platform must inspect inbound and outbound FTP and FTPS communications traffic (if authorized) for protocol compliance and protocol anomalies.

SC-7 - Medium - CCI-001125 - V-228880 - SV-228880r864182_rule

RMF Control

SC-7

Severity

Medium

CCI

CCI-001125

Version

PANW-AG-000148

Vuln IDs

V-228880
V-62641

Rule IDs

SV-228880r864182_rule
SV-77131

Application protocol anomaly detection examines application layer protocols such as FTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound FTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.

Checks: C-31115r864180_chk

If the protocol is not used in the implementation, this is not a finding. Go to Policies >> Decryption If there are no configured Decryption Policies, this is a finding. Ask the Administrator which Security Policy inspects authorized FTP traffic. Go to Policies >> Security Select the identified Security Policy. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix: F-31092r864181_fix

If FTP and FTPS is authorized for use in the site's System Security Plan (SSP), configure a security policy to allow it and inspect it. Since Secure File Transfer Protocol is a form of FTP that adds TLS and SSL cryptographic protocols, it is necessary to decrypt TLS in order for the device to inspect the FTP stream. Go to Policies >> Decryption Select "Add". In the "Decryption Policy Rule" window, complete the required fields. In the "Name" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" or "Source User" fields. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" or "Destination User" fields. In the "Option" tab, select "Decrypt" as the Action. Select the decryption profile. In the "Type" field, there are three options; Select "SSL Forward Proxy to decrypt and inspect SSL/TLS traffic from internal users to outside networks". Select "SSH Proxy to decrypt inbound and outbound SSH connections passing through the device". Select "SSL Inbound Inspection to decrypt and inspect incoming SSL traffic". Note: This decryption mode can only work if you have control on the internal server certificate to import the Key Pair on Palo Alto Networks Device. Go to Policies >> Security Select "Add" to create a new security policy or select the name of the security policy to edit it. In the "Security Policy Rule" window, complete the required fields. In the "Name" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. In the "User" tab, complete the "Source User" and "HIP Profile" fields. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. In the "Applications" tab, either select the "Any" check box or add "ftp", "tftp", and "gridftp". Configured filters and groups can be selected if the group includes these protocols. In the "Actions" tab, select "allow". In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Profile Setting" section; in each of the Profile fields, select the configured Profile. Note: An Antivirus Profile and an Antispyware Profile are required.

b

The Palo Alto Networks security platform must inspect inbound and outbound HTTP traffic (if authorized) for protocol compliance and protocol anomalies.

CM-6 - Medium - CCI-000366 - V-228881 - SV-228881r557387_rule

RMF Control

CM-6

Severity

Medium

CCI

CCI-000366

Version

PANW-AG-000149

Vuln IDs

V-228881
V-62643

Rule IDs

SV-228881r557387_rule
SV-77133

Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound HTTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks. All inbound and outbound traffic, including HTTPS, must be inspected. However, the intention of this policy is not to mandate HTTPS inspection by the device. Typically, HTTPS traffic is inspected either at the source, destination, and/or is directed for inspection by an organization-defined network termination point.

Checks: C-31116r513938_chk

Ask the Administrator which Security Policy inspects authorized HTTP traffic. Go to Policies >> Security Select the identified Security Policy. If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding. If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix: F-31093r513939_fix

If HTTP is authorized, configure a security policy to allow it and inspect it. Go to Policies >> Security Select "Add" to create a new security policy or select the name of the security policy to edit it. In the "Security Policy Rule" window, complete the required fields. In the "Name" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. In the "User" tab, complete the "Source User" and "HIP Profile" fields. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. In the "Applications" tab, either select the "Any" check box or add web-browsing. Configured filters and groups can be selected if the group includes web-browsing. In the "Actions" tab, select "allow". In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles. In the "Profile Setting" section; in each of the Profile fields, select the configured Profile. Note: An Antivirus Profile and an Antispyware Profile are required.

Palo Alto Networks ALG Security Technical Implementation Guide

Compare

View

Checks: C-31067r513791_chk

Fix: F-31044r513792_fix

Generate Mitigation Statement:

Checks: C-31068r513794_chk

Fix: F-31045r513795_fix

Generate Mitigation Statement:

Checks: C-31069r513797_chk

Fix: F-31046r513798_fix

Generate Mitigation Statement:

Checks: C-31070r513800_chk

Fix: F-31047r513801_fix

Generate Mitigation Statement:

Checks: C-31071r513803_chk

Fix: F-31048r513804_fix

Generate Mitigation Statement:

Checks: C-31072r513806_chk

Fix: F-31049r513807_fix

Generate Mitigation Statement:

Checks: C-31073r513809_chk

Fix: F-31050r513810_fix

Generate Mitigation Statement:

Checks: C-31074r513812_chk

Fix: F-31051r513813_fix

Generate Mitigation Statement:

Checks: C-31075r513815_chk

Fix: F-31052r513816_fix

Generate Mitigation Statement:

Checks: C-31076r513818_chk

Fix: F-31053r513819_fix

Generate Mitigation Statement:

Checks: C-31077r1018648_chk

Fix: F-31054r997587_fix

Generate Mitigation Statement:

Checks: C-31078r997589_chk

Fix: F-31055r997590_fix

Generate Mitigation Statement:

Checks: C-31079r513827_chk

Fix: F-31056r513828_fix

Generate Mitigation Statement:

Checks: C-31080r513830_chk

Fix: F-31057r513831_fix

Generate Mitigation Statement:

Checks: C-31081r513833_chk

Fix: F-31058r513834_fix

Generate Mitigation Statement:

Checks: C-31082r997592_chk

Fix: F-31059r997593_fix

Generate Mitigation Statement:

Checks: C-31083r573745_chk

Fix: F-31060r573746_fix

Generate Mitigation Statement:

Checks: C-31084r513842_chk

Fix: F-31061r573747_fix

Generate Mitigation Statement:

Checks: C-31085r513845_chk

Fix: F-31062r513846_fix

Generate Mitigation Statement:

Checks: C-31086r997595_chk

Fix: F-31063r997596_fix

Generate Mitigation Statement:

Checks: C-31087r573789_chk

Fix: F-31064r573743_fix

Generate Mitigation Statement:

Checks: C-31088r573741_chk

Fix: F-31065r573740_fix

Generate Mitigation Statement:

Checks: C-31089r513857_chk

Fix: F-31066r513858_fix

Generate Mitigation Statement:

Checks: C-31090r513860_chk

Fix: F-31067r513861_fix

Generate Mitigation Statement:

Checks: C-31091r513863_chk

Fix: F-31068r513864_fix

Generate Mitigation Statement:

Checks: C-31092r513866_chk

Fix: F-31069r513867_fix