CIS Control 13.5 - Unauthorized use of encryption

Mr_Kaplan — Wed, 19 Aug 2020 13:49:59 GMT

Looking for input on this one. From a Palo Alto perspective, what would be the best way to monitor for encrypted traffic in general? Need a way to make sure we're specifically able to point to traffic that was encrypted and provide a report or show that in a dashboard perhaps in our SIEM. Taking a first look from the ground up and looking for open discussion. Thanks in advance!

Re: CIS Control 13.5 - Unauthorized use of encryption

LAYER_8 — Thu, 05 Aug 2021 14:17:38 GMT

Super slick way to get this done, let's utilize some built-in functionality to make this easy.

Create a custom vulnerability profile, in my example I used the hexadecimal payload in an SSL-response-version packet to indicate TLS 1.0 is being used.

Now that I have a custom vuln sig, we are able to see all the traffic touching it on the ACC tab.

Which means that I am now able to build custom reports based off that vuln.

You could fully automate getting emailed reports of the traffic touching your signature, or configure a custom log forwarding rule to generate email alerts, for example. Lots of options. For a SIEM, you could export the log/alert to an HTTP server profile. See example screenshot below. But instead of those real threats, you would see your custom encrypted traffic one.

topic CIS Control 13.5 - Unauthorized use of encryption in General Topics

CIS Control 13.5 - Unauthorized use of encryption

Re: CIS Control 13.5 - Unauthorized use of encryption