About jennaqualls

  We wanted to take a moment to thank YOU, our community members for all the support, content and sharing that happened this past month.   We are back to recognize one of our most active contributors with a monthly LIVEcommunity Member Spotlight!    For the May 2023 Member Spotlight, we’d like to applaud one of our community members,  @Raido_Rattameister , for their participation and engagement in the LIVEcommunity.   Since joining the community in May 2020, they have written 1212  posts , received 412  likes , and authored 182  solutions  (and counting)!   Thank you for your contribution and participation in the community @Raido_Rattameister!   We are excited to see you grow as a contributor. We couldn’t do it without our amazing community.    Do you know a LIVEcommunity member you think should be recognized for their contributions to the community? Drop us a comment below!   ... View more

  Authored By: Eric Trexler SVP, Public Sector   Public Sector Ignite Is Coming to Tysons — Will You Be There?   Cybersecurity is a top priority across the public sector. Federal agencies have made tremendous strides toward establishing a Zero Trust environment, but challenges are everywhere. Agencies are now grappling with many questions:   How do we secure the mission against future threats? How can we leverage automation and orchestration to best utilize existing human capital? How can we consolidate dozens of point products to simplify and modernize IT? Where do we start with Zero Trust?   At Public Sector Ignite ’23, sponsored by Carahsoft, we’re bringing together our top cybersecurity experts and government leaders to answer these questions and much more.   Register now   to join us at Capital One Hall on May 16 in Tysons, Virginia for a special one-day experience where we’ll explore what’s now, new and next in cybersecurity for the federal government.   This will be my first Public Sector Ignite as the VP of U.S. Public Sector for Palo Alto Networks, and I’m thrilled to share the stage with a stellar lineup of speakers from across the federal government:   Shane Barney, CISO, USCIS Colonel Becky Beers, Deputy CISO, Department of Air Force Sheena Burrell, CIO, National Archives and Records Administration Gerald Caron, CIO, International Trade Administration Jackie Cheramie, Sr. Scientific Technical Manager, Cybersecurity Combat Systems Integration Nathan Colodney, Deputy Director, Cybersecurity, US Army Gregory Edwards, Ph.D., CISO, FEMA Jamie Holcombe, CIO, U.S. Patent and Trademark Office Michael Karas, Chief Enterprise Architect, TSA Matthew McFadden, VP, cyber, General Dynamics Information Technology Dovarius L. Peoples, CIO, U.S. Army Corps of Engineers Victoria Yan Pillitteri, Supervisory Computer Scientists, Computer Security Division, NIST Wayne Rodgers, Zero Trust Lead, U.S. Department of Education And many more…   Our speakers will share their best practices and innovative approaches to preventing future threats throughout thought leadership keynotes, breakout sessions and networking opportunities. Our keynotes and breakouts will cover a variety of topics:   current threat landscape and the future of cybersecurity President Biden’s cybersecurity EO implementing Zero Trust in the DOD attack surface management cloud security in a multi-cloud world IoT and 5G Technology Modernization Fund   A full list of our   featured speakers   can be found on our registration page, along with our complete   conference agenda.   Registration for Public Sector Ignite ’23   is now open, and attendance is free to government employees. Register today!   ... View more

    Authored By: Samuel Lee @SamuelLee    We’ve just launched Cloud NGFW for Azure  to strengthen security for applications running on Azure while streamlining network security operations. This fully managed, Azure-native, next-generation firewall service  is built to better protect cloud-native and migrated applications with the industry’s only AI and ML-powered next-generation firewall technology.    The Rise in Cloud Adoption and Its Drivers   Here’s the context: Over the past few years, cloud adoption has been steadily on the rise, revolutionizing and reinventing the way organizations drive their businesses. To stay ahead of the competition, organizations are looking for agility and scalability in product development and processes. What’s more, cloud adoption frees up valuable resources to focus on rapid application innovation that delivers business value.    To realize the potential of cloud-driven productivity, cost savings, and competitiveness, organizations leverage hybrid and multi-cloud strategies to automate infrastructure management and deployments. Getting to these benefits is one thing. Safeguarding it is another.    Three Key Challenges of Securing Cloud Deployments   Minimizing risk is critical as data centers become virtualized and applications are developed in the cloud — or migrated to the cloud. According to the 2021 Thales Data Threat Report , almost half (45%) of US companies suffered a data breach in the past year, and those worrisome numbers continue to grow.    Those findings confirm what our customers tell us — that they struggle to adequately secure their Azure deployments against advanced cyber threats in a way that seamlessly fits into how their cloud security and network security teams work. They need their security solutions in Azure to provide these three essential capabilities:    Prevents advanced cyber threats: Threats are constantly morphing. Basic Layer 4 security and IPS signatures are not enough to secure workloads anywhere, including in Azure. Organizations need best-in-class security to stop new threats and reduce the risk of breaches. Fits into how customers work in Azure: Organizations don’t want to deal with complexity or incur operational overhead to secure their deployments. They want network security to be as easy to deploy and automate as any other native Azure service. Works with how customers manage network security: Organizations have existing tools and processes for managing network security across multiple environments. Why change them? They want to leverage these same tools to centrally manage network security policy and logs in Azure.   Why Palo Alto Networks Created a Managed Firewall Service for Azure   Inspired by honest conversations with our customers, Palo Alto Networks has set out to create a new category of firewall that simplifies the deployment and management of the firewall — all while providing best-in-class security. Cloud NGFW for Azure meets those needs by:    Providing the ability to prevent advanced cyber threats For the 11th straight year, Palo Alto Networks was named a Leader in the Gartner® Magic Quadrant™ for Network Firewalls . This network security leadership is built on cutting-edge technology, including the industry’s only machine learning (ML) powered NGFW, capable of stopping known, unknown, and zero-day cyber threats. It enables customers to reduce the risk of an attack by controlling network traffic based on applications identified with our patented App-ID technology.    It doesn’t stop there. Through integration with Advanced Threat Prevention, customers are able to block more unknown command-and-control (C2) traffic and more zero-day exploits in real-time than traditional IPS solutions. Add Advanced URL Filtering detection capabilities powered by Inline Deep Learning, and Cloud NGFW for Azure can prevent known and unknown malicious URLs long before other vendors.    With DNS Security, we offer the most comprehensive threat coverage against DNS-layer threats. Finally, WildFire tackles the rise in sophisticated malware and stops more evasive malware than ever before. And to provide even more flexibility, Cloud NGFW for Azure detects and stops threats in all traffic, including encrypted traffic, via integration with Azure Key Vault.   Figure 1: Best-In-Class Security features Fitting into how customers currently work on Azure Thanks to extensive collaboration with Microsoft Azure, we’ve integrated our industry-leading NGFW capabilities onto the Azure  portal as a native service. Think about that. As an Azure service, you can easily use your Azure identity to create and manage firewalls directly from the Azure portal, without logging into another UI. On top of being offered as a service, Cloud NGFW is integrated with Virtual WAN Hub to provide robust, secure, and scalable connectivity between your hub and branches. This greatly simplifies security deployments for Virtual WAN, thanks in large part to our built-in auto-scaling feature.      To further leverage Azure native services, you can configure Cloud NGFW for Azure to securely access keys in Azure Key Vault to decrypt traffic and inspect it for hidden threats. Finally, to empower the automation of security management of Azure workloads, Cloud NGFW for Azure will soon be integrated with native Azure APIs, CLI, SDK, and Terraform Provider.     Dovetails into how customers manage network security With Panorama integration, securing your cloud migration journey will be greatly simplified. You can create and edit security rules in accordance with your organization’s security policy, across firewall deployments, from one central location: Panorama. You can also leverage the existing institutional knowledge of your security team codified as a configuration in Panorama. This allows you to maintain your current NGFW workflows and integrations, and simplify your operations by streamlining configuration and automating tasks. Finally, with Panorama integration, you will gain actionable insights into your network traffic and security threats, as well as centralized logging and visibility.   Cloud NGFW Use Cases   Broadly speaking, you can use Cloud NGFW to protect your Azure deployments from three network-based threat vectors:   The first network-based threat vector in the cloud comes from outbound connections to the Internet. As applications need to download software updates from the internet and connect to API services such as Google, most organizations' firewalls are configured to allow these outbound connections. However, these connections can also be used to download malware, establish connections to command and control servers and exfiltrate your critical data. If these outbound connections are secured using Cloud NGFW, these malicious connections can be automatically blocked to prevent exploitation by ransomware, stop command-and-control applications, and prevent data exfiltration.   The second threat vector comes from allowing traffic from the Internet to connect to applications such as a web server. Cybercriminals can use these network connections to exploit unknown or unpatched vulnerabilities in application software.    While organizations aim to patch all the vulnerabilities before the applications go into production, there are several reasons why vulnerabilities continue to exist in your environment. Unknown vulnerabilities such as Log4J existed for seven years before it was discovered and announced as a common vulnerability and exposure (CVE). There might be hundreds of such vulnerabilities out there that are being exploited by attackers, which organizations are unaware of and hence are unable to patch them against.    Even in the best-case scenario, where a patch exists, delays in patching still occur. It takes enterprises weeks or even months to patch these vulnerabilities. During these gap periods, organizations are exposed while trying to patch these vulnerabilities. If your organization's inbound connections are secured using Cloud NGFW, it can block attackers from exploiting these vulnerabilities while you work on patching. It buys you time and acts as a compensating control. Additionally, Cloud NGFW traffic logs provide deep visibility and context of network traffic (such as country, URL category, App-ID, application functions, filename, and file type) to your SIEM, CSPM, and CWP tools. This added visibility further helps identify, isolate, and remediate compromised or unpatched workloads.    Lastly, the third threat vector is lateral connections between workloads in your environment. For example, multiple applications may need to connect to a database server. To follow the true philosophy of Zero Trust, organizations need to protect all connections within their environment, including those between internal workloads and applications. Otherwise, organizations run the risk of hackers using a breach of one application to spread laterally to other applications.   Cloud NGFW in Action   Setup and deployment is a simple process, as shown below and demonstrated in this video walkthrough.     Explore the Benefits of Cloud NGFW for Azure with Your Free Trial   To get started with a 30-day free trial, visit the Azure Marketplace . To get more technical details, please take a look at the documentation and FAQ pages.  Cloud NGFW for Azure is currently available in five regions across the world: East US, East US 2, Central US, Australia East, and West Europe. Rapid expansion to additional regions is planned.   ... View more

Welcome to our Member Testimonial video series, where we invite members to share why LIVEcommunity is their trusted resource for building skills, sharing ideas, troubleshooting issues, and finding solutions!   @TomYoung  has been a member of LIVEcommunity since 2017 and part of the community's Cyber Elite program — which recognizes our most committed, helpful, and knowledgeable members — since it launched in 2020. He is an involved, responsive,  and thoughtful member, and we’re grateful to have him as a part of LIVEcommunity. To date, he has made 625 posts, given 317 kudos and created 132 accepted solutions!   Achieving Cyber Elite status on the LIVEcommunity means a lot to Tom, as it recognizes his expertise and commitment to providing the best solutions to his team. Tom Young is the Principal Network Architect at Flair Data Systems, a Palo Alto Networks reseller with over 100 years of experience in the industry. He has been with Flare Data Systems for 20 years and has expertise in various areas of networking technologies, including routers, switches, firewalls, security, wireless, and data center.   In his interview, Tom says that the LIVEcommunity is a valuable resource for him as he gets to hear from other experts, customers, and even Palo Alto Networks engineers on how they solve problems and their best practices. He also sees LIVEcommunity as a great “sounding board” to express his ideas and get feedback from others.   Tom states that he also appreciates the LIVEcommunity and its diversity. He says that the platform provides out-of-the-box thinking as users come from different backgrounds and have different experiences, helping him uncover new ideas and solutions to problems that he might not have thought of otherwise.   "It’s a great forum for sharing knowledge but also just interacting with other network engineers and security engineers who have the same problems,” shared Tom in his interview.    Learn how @TomYoung  leverages LIVEcommunity to answer questions, solve problems, and be more productive at work in this Member Testimonial video:     The LIVEcommunity team would like to extend a special thank you to Patrick Spencer, of TIRO Communications, for his help on the production of this series.   Subscribe to LIVEcommunity’s Member Testimonial area to get notified when we post a new video! ... View more

  The last 24 months have shown that work is no longer just a place we go, but an activity we perform. 80% of organizations have adopted a hybrid cloud strategy, with apps used everywhere.   In fact, they use an average of 110 SaaS apps within their environments.   Simultaneously, users are now everywhere. 76% of employees want to work hybrid, even after the pandemic.   All of this brings new cybersecurity challenges, which means organizations can no longer rely on ZTNA 1.0.   Watch the unveiling of ZTNA 2.0 with Palo Alto Networks Prisma Access and learn directly from industry experts as they share evolving market challenges, strategic best practices and the latest innovations from Prisma Access.   Tune into the launch event on-demand and hear from the group of leading industry experts that joined in:    Nikesh Arora, Chief Executive Officer and Chairman at Palo Alto Networks Lee Klarich, Chief Product Officer at Palo Alto Networks Kumar Ramachandran, Senior Vice President of Product at Palo Alto Networks David Holmes, Senior Analyst at Forrester Kenneth Ogami, Senior Vice President and Chief Information Officer U.S. at Westfield LLC   Watch On-Demand now for Prisma SASE: AI-Powered Innovation Takes Center Stage ... View more

                                                This blog was written by Jane Goh   3CXDesktopApp Supply Chain Attack Rapid Response   A supply chain attack involving a software-based phone application called 3CXDesktopApp hit at the end of March. The 3CXDesktopApp attack, first reported by CrowdStrike on March 29, 2023, was quickly investigated by Unit 42 the next day. Unit 42 discovered the 3CXDesktopApp installer hosted on the developer’s website installed the application with two malicious libraries. The malicious libraries ultimately run shellcode to load a backdoor on the system that allows actors to install additional malware on the victim machine. Please refer to this  Unit 42 Threat Brief  for more details on the threat and the latest Palo Alto Network protections summaries.   This Playbook of the Week blog will focus on automated response actions you can leverage using XSOAR. XSOAR can help you orchestrate response for incidents related to this attack across your EDR, XDR, SIEMs, and threat intelligence sources.  The  3CXDesktopApp Supply Chain Attack  playbook can be triggered manually or as a scheduled job.    What it Does   This playbook automates the process of data enrichment by collecting, extracting, tagging, and linking indicators from various sources such as Unit 42, Huntress and CrowdStrike, and linking them to incidents. It also downloads Sigma and Yara signature rules.   Playbook sample: extract, tag, and link indicators   Next, the playbook performs automated threat hunting queries looking for detected execution of the 3CX applications, detected network connections to known C2 domains and/or compromised 3CX app activity, across multiple sources including: Cortex XDR Splunk QRadar Elasticsearch PAN-OS Cortex Data Lake ElasticSearch Azure Log Analytics Playbook sample: Generic and XDR threat hunting   Playbook sample: SIEM Threat Hunting Lastly, you can set the playbook to perform remediation tasks such as blocking indicators automatically, or have the analyst continue to perform further analysis before closing the investigation.   Playbook sample: Remediation tasks   Learn More   Note: We have provided some highlights of the tasks available via this playbook. It does call other sub-playbooks not mentioned in this blog so to get the full scope of the playbook automation workflow, please refer to our Cortex Marketplace   content pack   documentation. You might also be interested in our series of   Rapid Breach response playbooks.   Don’t have Cortex XSOAR? Download our free   Community Edition   today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   ... View more

    April Spark User Summit - Stay One Step Ahead of Adversaries with PAN-OS 11.0 Nova Cyber threats continue to increase in volume and complexity, with threat actors developing new ways to avoid detection — including highly evasive malware. To help organizations outpace these evolving threats, Palo Alto Networks announces PAN-OS® 11.0 Nova, the latest version of its Industry-leading PAN-OS software, unleashing 50+ product updates and innovations. Nova is a leap forward in network security. It stops 26% more zero-day malware than traditional sandboxes, detects 60% more injection attacks, simplifies security architecture, and helps organizations adopt cybersecurity best practices. The bottom line is that Nova helps keep organizations one step ahead of attackers. Join Palo Alto Networks experts to learn how you can stay one step ahead of zero-day threats with Nova.   Learn About - Hear about the new innovations in PAN-OS 11.0 Nova that offer security against Zero Day threats with new Advanced WildFire and enhancements in Advanced Threat Prevention, simplified and consistent security with Web Proxy and NG-CASB and strong cyber posture with enhancements in AIOps. - You'll also get a peek into our five newest fourth-generation ML-Powered NGFWs that offer over 5X performance enhancement. - Get a demo on these innovations from our experts.    Event Details Register Now Wed, Apr 19, 9:30 AM (PDT) ... View more