About ozheng

  Episode Transcript:   John: Hello, and welcome back to PANCast™. We have a special guest today. Before we get started, Joy, could you tell us about yourself?   Joy: Thanks John for having me, this is Joy and I am a Senior Technical Support Engineer for Prisma Cloud Compute with years Yi Zhao is a Senior Technical Support Engineer backed by years of support proficiency in Cyber Security. She is highly enthusiastic about sharing her knowledge and experience with customers. of support experience in cyber security. I have published my previous PANCast™ on Agentless and I am here to share insights on Defender installation.   John: Thanks Joy. The topic for today is Prisma Cloud Compute Defender or Defender for short. Why do we need them and how can we deploy them?    Joy: Well I am pretty sure that all the people who are interested in Prisma Cloud Compute will agree Defenders are something they will need to deploy and utilize on a daily basis. The content I would like to share today will enable them to become more ready to learn about how to install Defender and what to watch out for when installing it on different platforms.    John: This sounds like a lot of work. How do we Install Prisma Cloud Compute Defender in general?   Defender Installation   Joy: I believe we all know that Defender is a container security tool that helps you protect containerized applications from vulnerabilities and threats. Therefore installing Defenders is of great importance to secure your environment.   Well, installing Defenders is straightforward. The first step is to navigate to the “Manage” page for deploying Defenders and configuring details. This process involves specifying the deployment method for your use case, configuring the network settings and console communication details, as well as specifying the security settings for Defenders, for example, if you would like to pull Defender image from your private registry, you need to input the name of the secret for the private registry in “Advanced Settings” section.    John: OK, what happens next when the details have been configured?   Joy: After the details have been configured on the web console, you need to copy the installation script from the console to proceed installation. What this script does is actually download the installation package to further fetch the Defender image as well as the necessary configuration files.   Once the above process is complete, you can then install the Defender on your cloud workloads. The installation process involves deploying the Defender as a container on your cloud workloads and configuring it to communicate with the Prisma Cloud Compute management console.    After the Defender is installed and configured, it will start monitoring your workloads for security threats and vulnerabilities. It's like having a security guard watching over your cloud workloads!   John: This is a great solution but how can I make this more resilient? Can we install Prisma Cloud Compute Defender on a cluster?   Joy: Of course we can install Defenders on a cluster. A cluster is made of several nodes rather than a single host, so this is a bit more complicated since you need to take more things into consideration when deploying Defenders in a cluster, for example like the orchestrator and runtime version. It might sound a bit tough now but I believe it will be much easier once you get a hang of it. So now let’s take Kubernetes as an example since we are seeing more and more customers using orchestration tools like Kubernetes in their environment.    First, you need to ensure that the Kubernetes version you are running is compatible with the version of the Defender you are installing. Think of it like making sure your Defender friend is the right fit for your Kubernetes platform.    You also need to ensure that the Kubernetes nodes are configured to allow the Defender to communicate with the Prisma Cloud management console. This involves opening up the necessary network ports and configuring the Kubernetes API server to allow external communication. This will make sure Defenders have the keys to the gate! At the end of the article, you may find documents which tell you more about the connection details.   John: If all the connection settings are in place, is there anything else we need to look out for?   Joy: One important thing to watch out for when installing Defender on Kubernetes is the resource usage of the Defender container. Since Defenders are constantly monitoring your cloud workloads, it will need a necessary amount of resources to work properly. Therefore, you need to ensure that your Kubernetes nodes have enough resources to support the Defender without impacting the performance of your applications. Think of it like making sure Defenders have enough energy to keep watch over your cloud workloads!   There are a few more things to take into consideration when deploying Defenders in a cluster. First please pay attention to the Runtime selection when it comes to a cluster. It is not rare that we see customer ignore the setting when they are actually using “contained” as Runtime management. This could lead to Defenders being able to be installed but unable to function properly. Secondly please select “Assign globally unique names to Hosts” in Advanced Settings, the reason is that this will help avoid duplicate Defender hostnames for easier management. Sometimes without selecting this option, you will see some Defenders sharing the same hostname which can cause confusions. Last but not least, there is one setting called “Run Defenders as privileged”, please do consider your environment setup requirements before you enable or disable this setting. By running Defender as privileged, you will most possibly avoid seeing the error message like “Failed to enable process monitoring. operation not permitted” in Defender log.   John: Great, so if we see the service does not work as expected. How do we go about troubleshooting?   Common Installation Issues   Joy: Well, now that we have understood the way of deploying Defenders on both hosts and clusters, frankly speaking, there are many common issues I have seen in the past few years. Let’s discuss some of them which you might encounter during the installation process.   While installing Prisma Cloud Compute Defender is generally a straightforward process, sometimes you may encounter issues during the installation process. Here are some common issues that you may encounter during installation and how to troubleshoot them.   What’s most commonly seen is connection issues: If the Defender is unable to connect to the Prisma Cloud management console, it may be due to a network issue. You can troubleshoot this issue by checking the network settings for the Defender container and ensuring that the necessary network ports are open. Furthermore you can check Defender logs for specific error messages to help you narrow down the problem.   Another important and hard to catch is resource issues: If the Defender is not getting the resources it requires, its functionality may be impacted as well. Especially when you are using Defenders for registry scan which is a major task for Defenders, it will require even more resources to complete the mission. You can troubleshoot this issue by reviewing the resource usage for the Defender container and adjusting the resource allocation if necessary.    John: While resources can impact the Defender’s functionality, can compatibility cause issues?   Compatibility Issues   Joy: Good catch! Last but not least is compatibility issues: If the Defender is not compatible with your cloud platform or other components in your environment, it may not function properly. You can troubleshoot compatibility issues by reviewing the system requirements for the Defender from our official documents and ensuring that all components are compatible.   When troubleshooting with Defender installation, it's important to have a systematic approach. Start by reviewing the installation documentation and verifying that you have followed all the necessary steps. Then, review any error messages or warnings that you have encountered and try to identify the root cause of the issue. To help you better troubleshoot Defender installation issues, You can go to live.paloaltonetworks.com to check for the transcript and more useful articles. If you are unable to resolve the issue on your own, you can reach out to the Prisma Cloud support team for assistance. John: It certainly helps when support is just a phone call away. Joy, what would be the key takeaways for today?   Key Takeaways   Joy: Remember these points: What is the function of a Defender,  How do you install the Defender on a single host or in a cluster,  What to look out for when installing Defenders in a cluster and  How to identify and fix errors during the installation process.    With the right approach and resources , you can successfully install and configure Defenders to monitor your cloud workloads and keep your applications secure.   John: Thank you, Joy, for sharing how Defenders can protect and secure your environment. You can find the transcript and some valuable links on live.paloaltonetworks.com under PANCast™.   Joy: Thank you for having me here today to discuss Defender installations. Do remember the key points shared for a successful deployment. Look forward to joining you on another episode of PANCast™!   John: PANCasters, if you have topics you need us to cover, please send in your feedback through the Ideas Submission page on LIVEcommunity, and we’ll be happy to review them.  Until next time. Bye!   Related Content: System Requirements & Resource Requirements Defender Architecture How To Install Defender While installing Prisma Cloud Defender, seeing older version being loaded with error message 'Unable to find image 'twistlock/private:defender_xx_xx_xxx' locally' How to install a container defender in each container runtimes Seeing Error "Failed to enable process monitoring. operation not permitted" after Deploying Defender with Orchestrator in Prisma Cloud Compute Prisma Cloud Compute: Cannot connect to Console address Prisma Cloud #Defender #Twistlock SaaS Security    ... View more

  Episode Transcript:   John: Hello, and welcome back to PANCast. In today's episode, we will discuss Phishing Emails and relevant Threat Prevention features in PAN-OS. We have a special guest today to talk about this, Jithu. Before we start Jithu, could you tell us about yourself?   Jithu: Hey John, I’m a Principal Cybersecurity Specialist in the Threat team and have been with Palo Alto networks for about 7  Jithu is a Principal Cybersecurity Specialist in the GCS threat team, he is passionate about Cybersecurity and has a special interest in handling Cyber Incidents and breaches. He has been with Palo Alto Networks for around 7 years. years now. Our team mainly deals with issues associated with the Threat prevention features of the Palo Alto Networks firewall.   John: Thanks Jithu, so to start with, what is Phishing?   What is Phishing?   Jithu: Phishing is a form of social engineering where a threat actor sends one or more fraudulent communications to a user in an attempt to trick them into downloading malware onto a device or forfeit sensitive information such as login credentials, personal identifiable information (PII) or financial data. In most cases, phishing usually occurs through communication channels such as email, SMS messages, social media or phone calls (also called vishing). Today we'll be talking about phishing emails and coverages we have in PAN-OS.   John: Great, so what coverage do we have and what are typical scenarios?   What Coverage Do We Have in PAN-OS?   Jithu: Phishing is a very popular initial attack vector and we'll be discussing 2 scenarios today. Before I start, I want to stress on the point that SSL Inbound inspection has to be configured in the firewall for it to be able to inspect inbound SMTP traffic running over TLS.   Scenario No 1 - Email with Phishing link passing through the firewall   This is a common scenario where an attacker sends out phishing emails with a link, with the goal of convincing the user to click on the link and provide login credentials, download and execute malware etc.   If the Wildfire Profile is attached to the security policy matching the traffic and it's configured to forward email-links, the firewall extracts the HTTP/HTTPS links and forwards it to Wildfire for Analysis. WildFire visits submitted links to determine if the corresponding web page hosts any exploits or displays phishing activity. A link that WildFire finds to be malicious or phishing is:   Recorded on the firewall as a WildFire Submissions log entry. Please note that the Email-Links are only detected by Wildfire and the email itself will not be blocked by the firewall. The log entry also includes the email header information like email sender, recipient, and subject so that you can identify the message and delete it from the mail server, or mitigate the threat if the email has been delivered or opened. Added to PAN-DB and the URL will be categorized as malware/phishing.   Now, let's move on to what happens when the user clicks the link assuming that this is a phishing attempt focusing on credential theft. Scenario where the link downloads a malware is similar to the scenario no 2 that I'll be talking about next:   DNS Resolution happened first, which could be blocked by DNS Signatures (or DNS Security) if the domain or FQDN is classified as Malware. URL Filtering can block the HTTP request, SSL Decryption is required if the connection is over HTTPS. We also have real-time detection, Local and Cloud inline detection to detect web-based attacks that use advanced evasion techniques.  URL Filtering User Credential Detection can be used to block credential submission to sites in untrusted categories, this needs the User-ID feature to be configured in the firewall.   Scenario No 2 - Phishing Email with malicious Attachment passing through the firewall   This is also a common scenario where an attacker sends out phishing emails with a malicious attachment with the goal of tricking the user to execute the malware.   This malicious attachment can be blocked by Wildfire Signatures, Antivirus Signature or Wildfire Inline ML. All these are configured as a part of Antivirus profile, Wildfire and Antivirus Signatures are signatures released as a part of Wildfire and Antivirus Bundle respectively. The WildFire inline ML option present in the Antivirus profile enables the firewall dataplane to apply machine learning on PE (portable executable), ELF (executable and linked format), MS Office files, PowerShell scripts and shell scripts in real-time. This protection extends to currently unknown as well as future variants of threats that match characteristics that Palo Alto Networks has identified as malicious. To keep up with the latest changes in the threat landscape, inline ML models are added or updated via content releases.   Apart from this, Wildfire profile can be attached to the security policies and Wildfire supported file types will be forwarded to Wildfire for Analysis. Wildfire will analyze the sample in the sandbox and Wildfire Submissions log will be written in the firewall with verdict 'malware'. Wildfire Submissions logs will be written irrespective of if the sample was blocked by the above mentioned features or not, the main difference is the priority of the logs:   High Priority indicates that the file was NOT blocked. Informational Priority indicates that the file was blocked.   So, if a file has passed through the firewall 5 times and was allowed 1 time and blocked 4 times, there will be 1 High priority log and 4 Informational priority logs under Wildfire Submissions. As a customer you should always review the High Priority Wildfire submissions log as these samples were not blocked by the firewall and have potentially reached the end-point.    Once Wildfire classifies a sample as Malware, a signature is released and sent to the firewall as a part of Wildfire bundle or real-time based on the configuration. This signature will eventually be released as a part of the Antivirus bundle in 24-48 hours.   You can also leverage File Blocking profiles to block unwanted files being allowed over security policy matching SMTP traffic. You should have a custom file blocking profile that's mapped to the security policy allowing SMTP traffic and should ask yourself questions like "Do I really need to allow encrypted-rar, encrypted-zip or even exe file type over SMTP?".   John: Looks like we have strategies to counter phishing emails.  Jithu, what would be the key takeaways for today?   Key Takeways   Jithu: The key takeaways would be to be diligent with hardening the security profiles and making sure that the profiles are applied to the relevant security policies so that all the protections that I mentioned are applied.   I would like to reiterate the importance of having a process in place to handle High Priority Wildfire Submissions Logs.   John: Thanks, Jithu, great info on some of our threat prevention features. You can find the transcript and some valuable links on live.paloaltonetworks.com under PANCast. Thanks again Jithu.   Jithu: Thank you for having me, looking forward to being a part of more episodes.   John: Hope you have learnt something today PANCasters and remember to subscribe on all popular podcast platforms. Bye for now.   Related Content: Forward Files for WildFire Analysis DNS Security Test URL Filtering Configuration Inline Deep Learning Analysis for Advanced URL Filtering User Credential Detection Set Up File Blocking Phishing campaign result is altered by WildFire profile as email-link is clicked by Wildfire sandbox Hold Mode for WildFire Real Time Signature Lookup Threat Prevention WildFire NGFW  ... View more