topic RIYADH in General Topics

RIYADH

aziz_paloalto — Sat, 22 Jul 2017 11:26:25 GMT

HELLO EVERYONE !!

I GOT GENERAL QUESTION ABOUT ACC RISK FACTOR

IT REACHES 4.0

DOES THIS WILL MAKE THE PALOALTO GO SLOW ?

AND WHAT IS BEST VERIFIED APPLICATION THAT I SHOULD ADD

SO IT CAN LOWER THE RISK . IF YOU HAVE A LIST THAT WOULD BE HELPFUL

THANK YOU 🙂

Re: RIYADH

Remo — Sat, 22 Jul 2017 11:58:00 GMT

Hi @aziz_paloalto

Welcome to the live community
Buy a keyboard where you can disable caps lock 😉
No, the risk factor is nothing that has a direct impact on the performance
What do you mean with a list of applications to lower the risk? The risk only somehow means that your users are using risky applications. In the acc you see these applications and it is up to you if you want to block them or not.
For example: You can also create an application filter group to generally block applications with a risk higher or equal to 4

Regards,

Remo

Re: RIYADH

MohamedSharief — Tue, 25 Jul 2017 08:01:39 GMT

Hi,

Just wanted to add something, if you trust those applications you can modify the risk factor for them. Of course its not recommended but this will decrease the risk factor.

Regards,

Sharief

Re: RIYADH

BPry — Tue, 25 Jul 2017 16:01:19 GMT

@aziz_paloalto,

Don't judge your actual risk factor by what the calculated risk factor is displayed as, that just has you worrying about potentially nothing. The default risk factor of applications will have that go up depending on what app-ids are being identified, however if you have a proper security rulebase configuration that locks everything down to sanctioned apps then I wouldn't be to worried about it.

Most applications will bring you close to a Risk cateogry of 4. App-ids such as ssl, youtube-base, web-browsing, google-base, facebook-video, facebook-base, apple-appstore, and many others are all Risk 4 app-ids. You can edit these if you simply want to tell management that your risk level has gone down, but really that number doesn't actually mean much of anything unless you've taken the time to fine-tune your different rulebases, created custom app-ids, lowered the Risk of known sanctioned applications that have inherint risks associated with them and so on. Otherwise I would kind of expect this to be anywhere from 3-4 depending on the type of network traffic that you are processing.