Always Innovating in NetSec Series: Improving Phishing Detection, DNS and Industrial OT Security

[GBalamitran]

In an era where digital landscapes evolve at an unprecedented pace, our commitment to safeguarding your information is unwavering. Embark on a journey with us as we delve into the forefront of cybersecurity excellence in our latest blog series. At the intersection of knowledge and security, this blog series is your gateway to staying informed, empowered, and secure in an interconnected world.

______________________________________________________________________

This blog was written by Ganesh Balamitran and originally posted on June 13, 2023.

Palo Alto Networks is always innovating to protect our customers and help them manage cyber risk. We are constantly delivering new features that address the most important security needs and we want to ensure you are informed. Our network security platform features and innovations are now cloud delivered, which means they are immediately available to our users on our latest PAN-OS version. Our Cloud Delivered Security Services are being updated with new protections via a SaaS based model, delivering enhanced security as soon as they are released. We are constantly strengthening our network security platform and want to keep you updated with our new blog series, capturing our latest innovations in network security. 

For this edition of the Always Innovating in Network Security Blog Series, we are announcing recent innovations in three areas of Network Security, specifically around Cloud Delivered Security Services (CDSS): Zero Trust OT Security, DNS Security and Advanced URL Filtering.

1. Extending Zero Trust OT Security to Meet Air Gap Requirements: OT administrators can now move to modern cloud based OT security, while maintaining a logical air gap around their OT networks. They can deploy Industrial OT Security, a part of our Zero Trust OT Security solution, utilizing a specialized gateway. This forwards security metadata that our tools generate from isolated OT networks to our Industrial OT Security, cloud delivered service, without any direct or inbound Internet connections. To learn more details about this feature and the benefits of connecting to the cloud, check out more information on our Industrial OT Security solution here. You can also learn about our recent extension to meet air gap requirements on LIVEcommunity.
2. Subdomain Reputation Detection: Due to the evasive and cost effective nature of the dynamic domain name system (DDNS) and ease of access to web hosting services, cybercriminals are increasingly leveraging subdomains of popular web hosting or (DDNS) services to host and distribute malicious content. With the latest innovations in DNS Security, we are leveraging advanced machine learning (ML)-powered analytics to look at attributes like domain reputation, distribution of characters in domain name and web page behavior like redirection. All of these attributes enable us to instantly detect and block subdomains used for malicious purposes. Check out additional details on this topic on LIVEcommunity here or at Unit 42 here.
3. Innovations in Phishing Protection: Advanced URL Filtering, the industry’s first web security engine to stop unknown and highly-evasive web-based threats in real-time, is now introducing new ML-powered detection models to prevent advanced phishing attacks that leverage legitimate SaaS platforms, Meddler-in-the-Middle phishing attacks and attacks developed using phishing kits. Specifically in regards to phishing kit detection capabilities, Advanced URL Filtering utilizes kit source code fingerprints and directory attributes to generate unique signatures that can train its detection models to quickly identify when a page has been built with these kits. This allows Advanced URL Filtering to isolate and identify subsequent phishing pages built from the same source. Learn more about innovations in phishing protection here.

We are continually working to modernize Industrial OT security and improve web security for our customers, staying ahead of threat actors. Palo Alto Networks customers who already use Industrial OT Security, DNS Security and Advanced URL Filtering automatically get access to these improved features and protections.

These are just a few examples of how Palo Alto Networks is always innovating. In the coming months, we will continue to cover a broad array of topics that impact your network security. Be sure to come back every month to see what new innovations you can leverage to improve your security posture.