topic Re: Configuration checks against CIS security benchmarks in General Topics

Configuration checks against CIS security benchmarks

TimMcQuinn — Fri, 18 Jun 2021 12:33:08 GMT

Hello All, Do any of you compare local firewall or Panorama configurations against CIS benchmarks for security compliance checks ?

Either using an existing tool to check Firewall compliance with the CIS (Centre for Internet Security benchmarks) recommendations or manually using show merged config / show config ? The Palo BPA does expose some of the required information but not all and we are looking for a less manual solution.

Re: Configuration checks against CIS security benchmarks

BPry — Fri, 18 Jun 2021 14:03:58 GMT

@TimMcQuinn,

https://live.paloaltonetworks.com/t5/quickplay-solutions-articles/cis-benchmark-quick-assess/ta-p/390774

Re: Configuration checks against CIS security benchmarks

Remo — Fri, 18 Jun 2021 22:33:41 GMT

@TimMcQuinn

If you already use a vulnerability scanning tool, check if there is already support for the CIS benchmark. For example with the vulnerability scanners from Tenable you can also check for this benchmark.