About kpotts

URL Filtering Category Modifications: Grayware and Questionable In late October 2020, we will redefine two existing URL Filtering categories.  The Grayware category’s definition will be expanding and the Questionable category's definition will be narrowed.   ACTION:   Action may be required.  Please consider impact in alignment with organizational policies.   What is Grayware? Palo Alto Networks defines the Grayware category as websites that do not pose a direct security threat but display other obtrusive behavior and tempt the end user to grant remote access or perform unauthorized actions.   The Grayware category will now include websites whose content pertains to scams, illegal activities, criminal activities, and get rich quick sites, as well as adware, and other unwanted or unsolicited applications, such as embedded crypto miners or hijackers that change the elements of the browser.  Additionally the Grayware category will include typosquatting domains that are not defined as phishing or defensive squatting.   What is Questionable? Palo Alto Networks defines the Questionable category as websites containing tasteless humor, offensive content targeting specific demographics of individuals or groups of people.   The Questionable category will no longer include websites that pertain to illegal activities, criminal activities, or get rich quick sites, as these are now included in the Grayware category.   Why are we redefining these categories? Some customers may want to allow access to some questionable content such as tasteless humor, while continuing to block access to suspect content, such as criminal activities and get rich quick sites.  Because they currently reside in the same category, Questionable, the customer would need to either block all access or allow access to the category.  Blocking the category and creating exceptions is not scalable.  The additional separation of the topics between the Grayware and Questionable categories will allow customers to easily implement this policy decision.   When will these new category definitions be effective? Late October 2020   Are there test domains for these categories? Grayware: http://urlfiltering.paloaltonetworks.com/test-grayware Questionable: http://urlfiltering.paloaltonetworks.com/test-questionable   Additional Information Best Practices: URL Filtering Category Recommendations ... View more

DNS Security Category: Parked As part of the PAN-OS 10.0 release, Palo Alto Networks is adding a new DNS Security category for Parked. ACTION:   The Parked category will be set to “allow” as a default action.  However, it is recommended to change the action to "sinkhole".   What is Parked? Palo Alto Networks defines Parked as websites which host limited content or click-through ads which may generate revenue for the host entity but generally do not contain content that is useful to the end user.   When will the Parked Category be available in DNS Security? The Parked category is available as part of the PAN-OS 10.0 release.  The content update will be available the week of September 7 and the cloud service will begin publishing verdicts at the end of September.  The default action will be set to 'Allow' under the anti-spyware profile.  However, it is recommended to change the action to "sinkhole".  On 9.0 and 9.1 releases, Parked category support will not be available.  For categories supported in those releases, please refer to the following documentation on DNS Security .   DNS security will prevent access to known Parked Fully Qualified Domain Names. For comprehensive coverage, we recommend our URL filtering service that looks into a complete URL for categorization.   Does Palo Alto Networks have a test domain for the new Parked category? Yes.  test -parked.testpanw.com   Additional Information Complete List of PAN-DB URL Filtering Categories DNS Security Signature Categories       ... View more

New DNS Security Category: Grayware As part of the PAN-OS 10.0 release, Palo Alto Networks is adding a new DNS Security category for Grayware.   ACTION:   There is no action required at this time. The Grayware category will be set to “block” as a default action.   What is Grayware? Palo Alto Networks defines Grayware as websites that do not pose a direct security threat but display other obtrusive behavior and tempt the end user to grant remote access or perform unauthorized actions.   The Grayware category will now include websites whose content pertains to scam, illegal activities, criminal activities, and get rich quick sites, as well as adware, and other unwanted or unsolicited applications, such as embedded crypto miners or hijackers that change the elements of the browser. Additionally the Grayware category will include 'typosquatting' domains that are not defined as phishing or defensive squatting.   When will the Grayware category be available in DNS Security? The Grayware category is available as part of the PAN-OS 10.0 release. The content update will be available the week of August 4th, and the cloud service will begin publishing verdicts by the end of August. The default action will be set to 'Block' under the anti-spyware profile. On PAN-OS 9.0 and 9.1 releases, Grayware category support will not be available. For categories supported in those PAN-OS releases, please refer to the following documentation on DNS Security .   DNS security will prevent access to known Grayware Fully Qualified Domain Names. For comprehensive coverage, we recommend our URL filtering service that looks into a complete URL for categorization.   Does Palo Alto Networks have a test domain for the new Grayware category? Yes.  test-grayware.testpanw.com   Additional Information Complete List of PAN-DB URL Filtering Categories DNS Security Signature Categories       ... View more