About vsharma1

New Ransomware URL Filtering Category   Starting September 27, 2022, Palo Alto Networks started to publish URLs into the newly introduced category “Ransomware” available with content release version 8592 and above.   Action: (If the content release version is 8592 and above) Ransomware category “Site Access” action set to “block” only for the default profile. If customer has multiple URL Filtering security profiles, they will need to update “Site Access” action to “BLOCK” for each profiles. This applies to all versions of PAN-OS software.   More information can be found at  New Advanced URL Filtering/PANDB Category: Ransomware   This new category was added in BPA version 7.3.0 ... View more

Select Relevant BPA Check   At Palo Alto Networks, we understand that certain aspects of the Best Practice Assessment (BPA) report might not be relevant to customers without context of their use case. Thus we added a capability within the BPA HTML report so that our customers can select relevant BPA checks which are aligned with their use case.   Below snip is from the Best Practice Assessment page within the HTML report. Here, the mapping definition page shows the overall result of the BPA checks run against device configuration, the overall passing percentage of the BPA checks is 47.1 %.      For customers to be able to see the results which are aligned with their use case they can now select a filter named “ Show Best Practice Checks ” by clicking on Local Filter .        Customers can select one or multiple BPA checks from the list and click “Apply”.       Once changes are applied the Mapping Definition page will show result based on selected BPA checks along with changed passing percentage result.       ... View more

Best Practice Assessment  Executive Summary   Best Practice Assessment (BPA) Executive Summary is a brief introduction of your network security posture and how it’s aligned with your business needs. This summary report will help to prioritize remediation needs and formulate a plan to execute needed steps. This is essential for the inception, growth and overall success of your company. It provides you and your leadership team with a vision for the future and a clear strategy. It contains a high level best practice assessment summary that can be downloaded in a PDF format from the HTML report so that it can be shared with CIO, CISO, and other C-level executives. With this new change the PDF file will no longer be part of the BPA report zip folder . This process to generate a BPA report remains the same. Once a BPA report is generated there will be a new tab at the top left side of an HTML report called the “Executive Summary”.         The newer version of executive summary will contain the following sections as shown below.   Best Practice Assessment Overview The BPA overview consists of three major components as shown below.     BPA System rating: It evaluates device (NGFW, Panorama, or Prisma Access) security capabilities and feature adoption against best practices. CDSS Capabilities: CDSS utilization score focuses on the efficiency of a company’s use of its network security assets. The score measures the extent to which companies have adopted services they have purchased. Vulnerability Protection: The vulnerability protection score will measure the effectiveness of network security assets  in responding to cyber attacks.   Find out more information about BPA overview here     Capability Adoption The capability adoption covers the overall adoption across key capabilities and compares it against Industry benchmarks. Within the .html version of an executive summary report, you will be able to view  capability adoption data for the current report. It also provides the data for the coverage across key appliance standards such as NIST and CIS Controls.           BPA Executive Summary Risk Assessment As the complexity and frequency of threats increase, large and small businesses are more vulnerable than ever to cyber attacks. The average cost of a data breach has reached an all time high. Organizations must understand risks they are exposed to in order to make an informed decision about new technology and policy implementation . The risk assessment is the process of identifying, analyzing, and evaluating cybersecurity risks. Nearly all organizations are at risk of a cyber attack. To understand how great this risk is and to be able to manage it, organizations need to know their cybersecurity risk assessment. This identifies which assets are most vulnerable to the risks the organization might face.     (Note: The dollar amount shown under each of the attack types is static and refers as the average cost associated with recovering from the breach)   The current version of executive summary has three types of attack as listed below along with the disclaimer “About Breach Costs” which takes you to the web page that has data relevant to the breach cost.   Business Email Compromise (BEC) attacks DNS Attacks Ransomware attacks   Business Email Compromise (BEC)   Business Email Compromise (BEC) is a category of threat activity involving sophisticated scams which target legitimate business email accounts through social engineering (e.g., phishing) or other computer intrusion activities. Once businesses are compromised, cybercriminals leverage their access to initiate or redirect the transfer of business funds for personal gain. Cybercriminals use a variety of techniques in business email compromise wire-fraud schemes. Forms of social engineering, such as phishing, offer an easy and cost-effective way to gain covert access while maintaining a low risk of discovery. According to the report, in many cases cybercriminals are simply asking their unwitting targets to hand over their credentials and getting them. The U.S. Federal Bureau of Investigation calls BEC the “$43 billion scam,” referring to statistics for incidents reported to the Internet Crime Complaint Center from 2016-2021. Techniques for business email compromise can vary. Some threat groups gain access to targeted accounts through brute-force credential attacks, for example. However, social engineering, including phishing, is often an easy and cost-effective way to gain clandestine access while maintaining a low risk of discovery. In many cases, cybercriminals are simply asking their unwitting targets to hand over their credentials—and getting them.   Cite: IC3 latest 2022 report on Business Email Compromise - https://www.ic3.gov/Media/Y2022/PSA220504 Domain Name Server (DNS) Attacks   Being one of the core foundations of the internet, the Domain Name System (DNS) is fundamental technology to all organizations. Many organizations have solutions in place to protect areas in their network like web and email, but do nothing to secure their DNS traffic, leading to an alarming rise in DNS-layer threats. A proper utilization of a DNS security service could lead to enhanced DNS security. A DNS attack targets the DNS infrastructure. Attacks can be tailored to either recursive or authoritative servers. The two most common types of DNS attacks are Denial-of-service (DoS) attacks and Distributed-denial-of-service (DDoS) attacks. In both cases, attackers flood internet servers with many requests that they simply can’t answer them all, and the system crashes as a result. A simple DoS attack uses one computer and one internet connection to flood a remote server. They are not very effective at overwhelming today’s high-capacity systems.    Cite: https://www.efficientip.com/resources/idc-dns-threat-report-2021/      Ransomware Attacks   Ransomware is a family of malware that attempts to encrypt files on end-user computers and then demands some form of e-payment to recover the encrypted files. A proper configuration of WildFire Advanced and Advanced URL Filtering could drastically help to mitigate such attacks. URL Filtering will limit access by comparing web traffic against a database to prevent employees from accessing harmful sites. And, WildFire utilizes near real-time analysis to detect previously unseen, targeted malware and advanced persistent threats, keeping your organization protected. Ransomware is one of the most common threats in the modern threat landscape; there are many different variants, an infection can cost a lot of money to recover from, and the actors responsible for the infections are driven to generate as much revenue as possible by extorting their victims. Ransomware in particular has been a focus area for many in the cybersecurity industry because of the impact on targeted organizations and those who depend on them. Unfortunately, these attacks have been made even easier with the rise of ransomware-as-a-service (RaaS) offerings. Ransomware as a service (RaaS) is a business for criminals, by criminals, with agreements that set the terms for providing ransomware to affiliates, often in exchange for monthly fees or a percentage of ransoms paid. RaaS makes carrying out attacks that much easier, lowering the barrier to entry for would-be threat actors and expanding the reach of ransomware.   Find out more information about BPA Risk Assessment here   Key Recommendations The key recommendations will be based on the failed best practice checks. The initial version of the new executive summary has the following  common classifications types that are listed below along with their descriptions.       Preventative Prevents incidents before they occur, steps taken to avoid unwanted or unauthorized activity from occurring. Here, the view tab will list all the failed Best Practice Checks (BPA) listed under preventative capability summary from the mapping definition.   Performance Intend to increase the performance or help identify those causing performance degradation to help retain optimal performance. Here, the view tab will list all the failed Best Practice Checks (BPA) listed under performance capability summary from the mapping definition.   Detective It identifies an incident’s activities or helps identify security violations after they have occurred. Here, the view tab will list all the failed Best Practice Checks (BPA) listed under detective capability summary from the mapping definition.   Contact BPA team at bpa@paloaltonetworks.com Visit us at www.paloaltonetworks.com/ ... View more

Best Practice Assessment Executive Summary Risk Assessment     The cyber security incidents continue to increase and strengthen, big and small businesses are more vulnerable than ever to cybercrime. Average cost of a data breach reached an all time high.In order for any business to make an informed decision about its technology and services investments they need to know about the risk that they might be exposed to by analyzing risks. The risk assessment is the process of identifying, analyzing, and evaluating cybersecurity risks. Nearly all organizations are at risk of a cyber attack. To understand how great this risk is and to be able to manage it, organizations need to know their cybersecurity risk assessment. This identifies which assets are most vulnerable to the risks the organization might face. In this document we have listed three types of attacks which are as follows.   Business Email Compromise (BEC) attacks DNS Attacks Ransomware attacks       (Note: The dollar amount shown under each of the attack types is static and refers as the average cost associated with recovering from the breach)   The report will dynamically show the types of attacks based on the adoption calculation done in the BPA.     Business Email Compromise (BEC)   Business Email Compromise (BEC) is a category of threat activity involving sophisticated scams which target legitimate business email accounts through social engineering (e.g., phishing) or other computer intrusion activities. Once businesses are compromised, cybercriminals leverage their access to initiate or redirect the transfer of business funds for personal gain. Cybercriminals used a variety of techniques in business email compromise wire-fraud schemes. Forms of social engineering, such as phishing, offer an easy and cost-effective way to gain covert access while maintaining a low risk of discovery. According to the report, in many cases cybercriminals are simply asking their unwitting targets to hand over their credentials and getting them. The U.S. Federal Bureau of Investigation calls BEC the “$43 billion scam,” referring to statistics for incidents reported to the Internet Crime Complaint Center from 2016-2021. Techniques for business email compromise can vary. Some threat groups gain access to targeted accounts through brute-force credential attacks, for example. However, social engineering, including phishing, is often an easy and cost-effective way to gain clandestine access while maintaining a low risk of discovery. In many cases, cybercriminals are simply asking their unwitting targets to hand over their credentials—and getting them.   Disclaimer About Breach Cost: BEC Attack Report   Cite: IC3 latest 2022 report on Business Email Compromise - https://www.ic3.gov/Media/Y2022/PSA220504   Recommendation: It is recommended to follow best practices to configure following capabilities to mitigate BEC attacks. Advanced Threat Prevention WildFire Advanced Advanced URL Filtering DNS Security   How BEC Attack is calculated If the adoption percentage for any one of the adoption highlighted below (WildFire, Threat Prevention, URL Filtering, and DNS Security) or any of their sub adoption category is less than equal to 50% than BEC attack will be displayed under Risk Assessment.     Domain Name Server (DNS) Attacks   Being one of the core foundations of the internet, the Domain Name System (DNS) is fundamental to all organizations. Most of the organizations have solutions in place to protect areas in their network like web and email, but do nothing to secure their DNS traffic, leading to an alarming rise in DNS-layer threats. A proper utilization of a DNS security service could lead to enhanced DNS security. A DNS attack targets the DNS infrastructure. Attacks can be tailored to either recursive or authoritative servers. The two most common types of DNS attacks are Denial-of-service (DoS) attacks and Distributed-denial-of-service (DDoS) attacks. In both cases, attackers flood internet servers with many requests that they simply can’t  answer them all, and the system crashes as a result. A simple DoS attack uses one computer and one internet connection to flood a remote server. They aren’t terribly effective at overwhelming today’s high-capacity systems.    Disclaimer About Breach Cost: IDC 2021 Global DNS Threat Report   Cite: https://www.efficientip.com/resources/idc-dns-threat-report-2021/ Recommendation The DNS Security subscription offers limitless protection against tens of millions of malicious domains, identifying them with real-time analysis and continuously growing global threat intelligence. Our cloud database scales with data from a large and ever-expanding threat intelligence sharing community, adding to Palo Alto Networks sources that include:   WildFire malware prevention service to find new C2 domains, file download source domains, and domains in malicious email links. URL Filtering to continuously crawl newfound or uncategorized sites for threat indicators. Passive DNS and device telemetry to understand domain resolution history seen from thousands of deployed NGFWs, generating petabytes of data per day. Unit 42 threat research to provide human-driven adversary tracking and malware reverse engineering, including insight from globally deployed honeypots.   How DNS Attack is calculated If the % adoption for DNS Security is less than equal to 50% than DNS attack will be displayed under Risk Assessment.     Ransomware Attacks   Ransomware is a family of malware that attempts to encrypt files on end-user computers and then demands some form of e-payment to recover the encrypted files. A proper configuration of URL Filtering and WildFire could drastically help to mitigate such attacks. A URL Filtering will limit access by comparing web traffic against a database to prevent employees from accessing harmful sites. And,  WildFire utilizes near real-time analysis to detect previously unseen, targeted malware and advanced persistent threats, keeping your organization protected. Ransomware is one of the most common threats in the modern threat landscape; there are many different variants, an infection can cost a lot of money to recover from, and the actors responsible for the infections are driven to generate as much revenue as possible by extorting their victims. Ransomware in particular has been a focus area for many in the cybersecurity industry because of the impact on targeted organizations and those who depend on them. Threat actors gain control over critical data and resources and then leverage this control to coerce high-dollar payments from their victims. Unfortunately, these attacks have been made even easier with the rise of ransomware-as-a-service (RaaS) offerings. Ransomware as a service (RaaS) is a business for criminals, by criminals, with agreements that set the terms for providing ransomware to affiliates, often in exchange for monthly fees or a percentage of ransoms paid. RaaS makes carrying out attacks that much easier, lowering the barrier to entry for would-be threat actors and expanding the reach of ransomware. Disclaimer About Breach Cost: 2022 Unit 42 Ransomware Threat Report  Reduce the Attack Surface Gain full visibility and block unknown traffic. Identify all traffic on the network and block unknown, potentially high-risk traffic.  Enforce application- and user-based controls. Restrict access to SaaS-based tools for employees who have no business need for them.  Block all dangerous file types. Not all file types are malicious, but those known to present higher risk, or associated with recent attacks, can be controlled.  Implement an endpoint policy aligned to risk. Enforce policies that restrict noncompliant endpoints from connecting to critical network resources.    Prevent Known Threats  Stop known exploits, malware, and command-and-control traffic. Blocking known threats raises the cost of an attack and ultimately reduces the likelihood of an attacker attempting a breach.  Block access to malicious and phishing URLs. Prevent users from inadvertently downloading a payload or having their credentials stolen by blocking known malicious and phishing URLs. Scan for known malware on SaaS-based applications. SaaS-based applications represent a new path for malware delivery and must be properly secured.  Block known malware and exploits on the endpoint. Endpoints are common targets for attacks. Ensure you are keeping your endpoints secure by blocking any known malware or exploits.    Identify and Prevent Unknown Threats Detects and analyzes unknown threats in files and URLs. As new files are submitted, detonate, analyze and look for malicious behavior. Update protections across the organization to prevent previously unknown threats. Automatically push protections to different parts of your organization’s security infrastructure.  Add context to threats, and create proactive protections and mitigation. Developing protections requires context to better understand the attacker, malware and indicators of compromise. Block unknown malware and exploits on the endpoint. Once unknown threats or trends of suspicious behavior have been identified and blocked, block unknown malware and exploits on the endpoint.     Recommendation: It is recommended to follow best practices to configure following capabilities to mitigate ransomware attacks. WildFire URL Filtering     How Ransomware Attack is calculated If the adoption percentage for either WildFire or URL Filtering is less than equal to 50% than Risk Assessment will show Ransomware Attack.    The text displayed under Ransomware attack will dynamically change based on cases listed as below.   Case# 1: If the adoption percentage of WildFire is less than equal to 50% then below text will show up.   Description - Ransomware is a family of malware that attempts to encrypt files on end-user computers and then demands some form of e-payment to recover the encrypted files. A proper configuration of WildFire could drastically help to mitigate such an attack. WildFire utilizes near real-time analysis to detect previously unseen, targeted malware and advanced persistent threats, keeping your organization protected.    Case# 2: If the adoption percentage of either URL Filtering Adoption or Credential Theft Adoption (or both of them) is less than equal to 50% then below text will show up.    Description - Ransomware is a family of malware that attempts to encrypt files on end-user computers and then demands some form of e-payment to recover the encrypted files. A proper configuration of URL Filtering could drastically help to mitigate such attacks. A URL Filtering will limit access by comparing web traffic against a database to prevent employees from accessing harmful sites.    Case# 3: If the adoption percentage for both WildFire and URL Filtering adoption [URL Filtering Adoption or Credential Theft Adoption (or both of them)] is less than equal to 50% then below text will show up.   Description - Ransomware is a family of malware that attempts to encrypt files on end-user computers and then demands some form of e-payment to recover the encrypted files. A proper configuration of WildFire and URL Filtering could drastically help to mitigate such attacks. WildFire utilizes near real-time analysis to detect previously unseen, targeted malware and advanced persistent threats, keeping your organization protected. A URL Filtering will limit access by comparing web traffic against a database to prevent employees from accessing harmful sites.     Contact BPA team at bpa@paloaltonetworks.com Visit us at www.paloaltonetworks.com/ ... View more

BPA Executive Summary  Overview     The BPA overview section provides the overall security posture of your Palo Alto Network Next-Generation Firewall, Panorama and Prisma Access. The three major components are:   BPA System rating CDSS Capabilities  Vulnerability Protection Score     BPA System Rating The BPA system rating evaluates the device (Next-Generation Firewall, Panorama, or Prisma Access) security capabilities and feature adoption against best practices.  It is the average percentage of following:   Overall capability adoption And, the average passing percentage for all the BPA checks (it can be found under Mapping Definition page) BPA System Rating Calculation BPA System Rating =   (Avg. of overall capability adoption  + Avg. of mapping definitions) / 2                                                 Example Avg. of overall capability adoption Avg. of mapping definitions BPA System Rating 600 / 9 = 66.66% 52.3% (66.66 + 52.3) / 2 = 59.48%                                   The BPA system ratings are categorized in three different categories based on the score from the above calculation.   Severity Score Range Color in Box Description Conclusion Low 0 - 39 Red Based on the results of the assessment, there are significant gaps in your overall capability adoption and passing percentage of BPA checks. It's recommended that users review each section and work through the results to understand gaps and where improvements can be made. Moderate 40 - 79 Yellow The assessment results indicate that some security capabilities and best practice checks have been implemented. It's recommended that users review each section and work through the results to understand gaps  that need to be addressed in order to fully ensure a consistent and secure approach. High 80 - 100 Green The assessment results show a mature security capability approach. Review individual areas or questions that scored lower and continue to build on an otherwise strong platform.   Cloud-Delivered Security Services (CDSS) Utilization CDSS utilization score focuses on the efficiency of a company’s use of its network security assets. The score measures the extent to which companies have adopted services they have purchased.   CDSS Utilization Calculation CDSS Utilization Score = (sum of average adoption percentages of each CDSS service category) / # of service categories   Service Categories in BPA Exec Summary:  Wildfire, Threat Prevention, DNS Security, URL Filtering For each category, average adoption percentage = (sum of adoption % of all services within the category) / # services in the category   Example (using data from Serial Number & Vsys):     Average Adoption % WildFire = 85.7 % Threat Prevention (IPS) = (92.9 + 7.1 + 100.0 + 85.7) / 4 = 71.425% DNS Security = 0.0 % URL Filtering = (0.0 + 0.0) / 2 = 0/0% CDSS Utilization Score 39.28 % = (85.7 + 71.425 + 0.0 + 0.0) / 4     CDSS utilization score is categorized in three different categories based on the score from the above formula.   Severity Score Range Color in Box Description Conclusion Low 0 - 39 Red The assessment indicates there are significant gaps in adoption of at least two of the CDSS utilization categories (Wildfire, Threat Prevention, DNS Security, URL Filtering). To ensure efficient, secure use of CDSS resources, it is recommended that users review the adoption percentage of each category to identify and resolve misconfigurations. Moderate 40 - 79 Yellow The assessment indicates there are moderate to significant gaps in adoption of at least one of the CDSS utilization categories (Wildfire, Threat Prevention, DNS Security, URL Filtering). To ensure efficient, secure use of CDSS resources, it is recommended that users review the adoption percentage of each category to identify and resolve misconfigurations. High 80 - 100 Green The assessment indicates there are no significant gaps in any of the CDSS utilization categories, suggesting an efficient use of resources. Review individual categories with lower adoption percentages to maximize use of best practices.   Vulnerability Protection The vulnerability protection score will measure the effectiveness of network security assets  in responding to cyber attacks.  Below is the list of BPA checks that must be counted when calculating vulnerability protection score.   Check ID BPA Check Name top_nav left_nav 7 Log Forwarding Policies Security 13 Intrazone Allow Rules with Logging Policies Security 41 Vulnerability Protection Profile Threat Exceptions Objects Vulnerability Protection 42 Vulnerability Protection Strict Profile Objects Vulnerability Protection 51 Traffic Settings Objects Log Forwarding 52 Threat Settings Objects Log Forwarding 60 Zone Protection Profile Applied to Zone Network Zones 86 Reconnaissance Protection Network Zone Protection 87 Packet Based Attack Protection Network Zone Protection 189 Apps & Threats Device Dynamic Updates 192 Apps & Threats Sync to Peer Device Dynamic Updates 200 Vulnerability Protection Low/Informational Profile Objects Vulnerability Protection 237 Apps & Threats Content Update Device Dynamic Updates   Vulnerability Protection Calculation Formula will be based on the average of passing % of all the BPA checks as listed above.   Example - Here we will calculate the average percentage of all three checks passing %  Vulnerability  Protection Score = (0 + 25 + 50) / 3 = 25%   (Here, we will count all the above listed BPA checks in the table for actual calculation)    Below screen is from the Mapping definition under Best Practice Assessment tab.                     Vulnerability Protection Score categorized in three different categories based on the score from the above formula. Severity Score Range Color in Box Description Conclusion Low 0 - 39 Red The assessment indicates there are significant gaps in adoption of at least two or more capabilities. To ensure efficient, secure use of resources, it is recommended that users review the adoption percentage of each category to identify and resolve misconfigurations. Moderate 40 - 79 Yellow The assessment indicates there are moderate to significant gaps in adoption of at least one of the capabilities. To ensure efficient, secure use of resources, it is recommended that users review the adoption percentage of each category to identify and resolve misconfigurations. High 80 - 100 Green The assessment indicates there are no significant gaps in any of the capabilities configured on the device, suggesting an efficient use of resources. Review individual categories with lower adoption percentages to maximize use of best practices.         Capability Adoption This shows overall adoption across key capabilities and compares it against Industry benchmarks. Users will also be able to view capability adoption data for the current report and will also have a drop down list option to select and view capability adoption data for previously generated reports.  We are already capturing Capability adoption data in a BPA report, we will use the same data and present it in the new format for Exec Summary.                                      The Coverage across key compliance standard section consists of following. NIST Avg. - The calculation for NIST Security Controls can be obtained from the Best Practice Summary page (as shown below).                                   CIS Avg. -  This will be the average percentage of all the CIS Critical Security Controls Summary listed under Best Practice Summary screen.                           Capability Avg. - This represents the average of overall capability adoption percentage in best practice mode under adoption summary screen from a BPA report.                                                         Contact BPA team at bpa@paloaltonetworks.com Visit us at www.paloaltonetworks.com/ ... View more

Best Practice Assessment Executive Summary Key Recommendations     The BPA executive summary provides key recommendation based on CISSP security control. The current version of executive summary focuses on three security controls as: Preventative Performance Detective                         The “View” button redirect to the Mapping definition page with the filtered view that shows BPA Checks listed under Capability summary as “Preventative”. Calculation for Preventative Recommendation This section shows how we get the Preventative percentage numbers and the description per score range.  In Best Practice Assessment summary page if the passing percentage of Preventative is less than 60% under Capability Summary section than Key Recommendation will provide recommendation against “Preventative” security control.                               Below table shows different score ranges and their text.   Passing % Range Color Potential Impact Recommendation Action Required 0 - 39 Red No single layer of security will ensure that your business has the appropriate level of security to identify and remediate potential threats. To eliminate as many vulnerabilities as possible and to keep your business systems and network optimally secure, you need to deploy preventative security controls. Our recommendation is to identify list of failed BPA checks and the ones that are not configured to improve your Preventative security controls Identify and review individual BPA checks, and adhere to best practices to build robust security posture. 40 - 79   Yellow Ensure that your business has the appropriate level of security to identify and remediate potential threats. Eliminate vulnerabilities to keep your business systems and network optimally secure, and use preventative security controls. Our recommendation is to identify gaps and remediate failed BPA checks to improve your Preventative security controls. Ensure efficient and secure use of Best Practices, it is recommended to review each Best Practice checks to resolve misconfigurations. 80 - 99 Green Always adhere to Preventative security controls to reduce the impact of a successful threat event. Our recommendation is to identify a list of BPA Checks to take action against and remediate those failed BPA checks to  achieve greater  Preventative security controls. Review BPA checks that are not following best practices and plan to remediate if there are any misconfigurations. 100 Dark Green Your company is following best practices for standards, encryption, and firewalls. Your company is adhering to best practices for a strong security posture by using preventative countermeasures. No action needed.   Note: Above logic and description in the table will remain same for performance and detective security controls.            Contact BPA team at bpa@paloaltonetworks.com Visit us at www.paloaltonetworks.com/ ... View more

 BPA Release Notes (Version 6.4.0)   Starting BPA Version 6.0.0 Prisma Access BPA report will provide Health Check information about your Prisma Access. Health checks are essential in establishing a solid foundation upon which cybersecurity infrastructure is built, it will help to identify weakest security areas, and will also recommend the best practice actions to mitigate any potential risks.   The Service Health option under Best Practice Assessment tab will provide you with the detailed information about each health check and the necessary actions that are required to pass each one of them.    Figure 1: Service Health under Best Practice Assessment To learn more about health checks in Prisma Access BPA report please click here   Health Checks added to BPA in BPA V6.4.0 Category Health Checks Security  UserID Remote Network Redistribution UserID Agent from On-Prem  Mobile Users Authentication SAML Connectivity Mobile Users Authentication Sequence       Review the latest Known Issues Severity Description S2 HTML Report > Deployment Type missing from Mapping Definitions: Deployment Type showing as undefined, whereas it should actually show the correct mapping definitions S2 - Major Action on DNS Queries for DNS Sinkhole is not set to “sinkhole” and still passes S3 - Minor Reloading the HTML Report will repeatedly show New Features pop up S3 - Minor SNMP tab text not matching main screen text Enhancement Distinguish between authentication profile and profiles and authentication sequence and sequences for better user experience S3-Minor Device management license should have the same SN as host SN S3 - Minor Target Device is being set as none instead of the serial number of the device S3 - Minor Filter is capitalization sensitive - The local filters are capitalization sensitive when typing in a search query. The filter should be able to take in both capitalized words and non capitalized words. Review the Addressed Issues from the last release Severity Description S3-Minor Authentication tab text not matching main screen text S2-Major Change to ECMP Load Balancing tag in 10.1 caused issue processing TSF file S1-Critical Error while running BPA Report for Prisma Access. Authentication Cookie timeout is not set for customer S3-Minor Batch license info shows empty even if there are batch licenses. S2-Major When we generate a BPA report for strata we need to exclude any PA HC. S3-Minor Global Protect Checks fails due to incorrect SAML flag S3-Minor BPA API HTML Issue which prevented downloading and viewing a report offline For BPA support, please contact us at bpa@paloaltonetworks.com   Resources   How to generate a Prisma Access BPA Report How to Generate a BPA Report Health Check Demo Video BPA Solution Brief   Best Practice Assessment (BPA) Tool LIVEcommunity Page   Configuration Wizard Demos Best Practice Assessment Plus (BPA+) Overview Video Best Practice Assessment Video Playlist   ... View more

 BPA Release Notes (Version 6.3.0)   Starting BPA Version 6.0.0 Prisma Access BPA report will provide Health Check information about your Prisma Access. Health checks are essential in establishing a solid foundation upon which cybersecurity infrastructure is built, it will help to identify weakest security areas, and will also recommend the best practice actions to mitigate any potential risks.   The Service Health option under Best Practice Assessment tab will provide you with the detailed information about each health check and the necessary actions that are required to pass each one of them.    Figure 1: Service Health under Best Practice Assessment To learn more about health checks in Prisma Access BPA report please click here Health Checks added to BPA in BPA V6.3.0   Category Health Checks Security Mobile Users Policy Security Policy zones untrust Remote Network Policy Security Policy zones untrust Mobile Users Security Policy UserID Mobile Users Policy Security Policy Sensitive Traffic Remote Network Policy Security Policy Sensitive Traffic  Infrastructure Mobile User Deployment Service Connection Presence Mobile Users Gateway Regions Mobile User Deployment IP Pool Allocation Mobile Users Onboarding Prisma Access Subnet Service Connection Onboarding Prisma Access Service Subnet Connectivity QoS Remote Network     Review the latest Known Issues Severity Description S2 HTML Report > Deployment Type missing from Mapping Definitions.  Deployment Type showing as undefined, whereas it should actually show the correct mapping definitions. S2 - Major Action on DNS Queries for DNS Sinkhole is not set to “sinkhole” and still passes S3 - Minor Reloading the HTML Report will repeatedly show New Features pop up S3-Minor Authentication tab text not matching main screen text S3 - Minor SNMP tab text not matching main screen text S3-Minor Device management license should have the same SN as host SN S3 - Minor Target Device is being set as none instead of the serial number of the device S3 - Minor The local filters are capitalization sensitive when typing in a search query. The filter should be able to take in both capitalized words and non capitalized words.    Review the Addressed Issues from the last release Severity Description S2 Error After Uploading TSF to CSS S3-Minor Batch license info showing empty S1 Error while running BPA Report for Prisma Access. Authentication Cookie timeout is not set for customer S2 Report generation is failing for strata  S3 Global Protect Checks fails For BPA support, please contact us at bpa@paloaltonetworks.com Resources   How to generate a Prisma Access BPA Report How to Generate a BPA Report Health Check Demo Video BPA Solution Brief   Best Practice Assessment (BPA) Tool LIVEcommunity Page Configuration Wizard Demos Best Practice Assessment Plus (BPA+) Overview Video Best Practice Assessment Video Playlist   ... View more

BPA Release Notes (Version 6.2.0) Starting BPA Version 6.0.0 Prisma Access BPA report will provide Health Check information about your Prisma Access. Health checks are essential in establishing a solid foundation upon which cybersecurity infrastructure is built, it will help to identify weakest security areas, and will also recommend the best practice actions to mitigate any potential risks.   The Service Health option under Best Practice Assessment tab will provide you with the detailed information about each health check and the necessary actions that are required to pass each one of them.  Figure 1: Service Health under Best Practice Assessment   To learn more about health checks in Prisma Access BPA report please click here Health Checks added to BPA in BPA V6.2.0   Category Health Checks Security MU_Security_Policy_zones RN_Security_Policy_zones UserID_MU_Groupmapping_include_list UserID_RN_Groupmapping_include_list RN_Security_Policy_userid MU_Security_Policy_userid MU_Cookie_Lifetime Connectivity RN_Routing_overlapping_subnets MU_VPN_Protocol MU_APP_Connection_Timers MU_Authentication_LDAP_Bindtime     Review the latest Known Issues Severity Description S2 Error After Uploading TSF to Customer Success Site and Customer Support Portal S2 Under HMTL report "Deployment Type" missing from the Mapping Definitions S2 Action on DNS Queries for DNS Sinkhole is not set to “sinkhole” still passes S3 Reloading the HTML report will repeatedly show New Features pop up S3 Batch license info showing empty S3 Authentication tab text not matching main screen text     For BPA support, please contact us at bpa@paloaltonetworks.com   Resources How to generate a Prisma Access BPA Report How to Generate a BPA Report Health Check Demo Video BPA Solution Brief   Best Practice Assessment (BPA) Tool LIVEcommunity Page   Configuration Wizard Demos Best Practice Assessment Plus (BPA+) Overview Video Best Practice Assessment Video Playlist ... View more

Starting BPA Version 6.0.0 Prisma Access BPA report will provide Health Check information about your Prisma Access. Health checks are essential in establishing a solid foundation upon which cybersecurity infrastructure is built, it will help to identify weakest security areas, and will also recommend the best practice actions to mitigate any potential risks.   The Service Health option under Best Practice Assessment tab will provide you with the detailed information about each health check and the necessary actions that are required to pass each one of them.    Figure 1: Service Health under Best Practice Assessment   To learn more about health checks in Prisma Access BPA report please click here   Health Checks added to BPA in BPA V6.1.2   Category Health Checks Security MU_Log_Forwarding_Policy RN_Log_Forwarding_Policy RN_Log_Forwarding_Profile MU_APP_Invalid_Portal_Cert MU_Authentication_LDAP_SSL Connectivity SC_VPN_Monitoring_Dead_peer_all_enable SC_VPN_Monitoring_Tunnel_BGP RN_VPN_Monitoring_Tunnel_BGP SC_VPN_Monitoring_Tunnel_all_enable MU_App_Pre_Logon_Tunnel_Rename_Timeout MU_APP_Disable_GlobalProtect_App MU_App_TCP_Connection_Timeout MU_App_Portal_Connection_Timeout MU_App_Preserve_Tunnel_on_User_Logoff_Timeout Review the latest Known Issues Severity Description S2 HMTL Report > Deployment Type missing from Mapping Definitions  S2 Action on DNS Queries for DNS Sinkhole is not set to “sinkhole” still passes S3 Reloading the HTML Report will repeatedly show New Features pop up For BPA support, please contact us at bpa@paloaltonetworks.com     Resources   How to generate a Prisma Access BPA Report How to Generate a BPA Report Health Check Demo Video BPA Solution Brief   Best Practice Assessment (BPA) Tool LIVEcommunity Page   Configuration Wizard Demos Configuration Wizard Overview Video Best Practice Assessment Video Playlist ... View more

An html file provides Prisma Access health summary along with  security capability feature adoption. Addition of Prisma Access health check capability in BPA report is a great way to look at the security infrastructure and investigate where it is necessary to improve or build upon.   For more information related to health check please click here   ... View more

BPA Release Notes (Version 6.0.0)     New Feature   Prisma Access BPA report will provide Health Check information about your Prisma Access. Health checks become essential in establishing a solid foundation upon which cybersecurity infrastructure is built, it will help to identify weakest security areas, and will also recommend the best practice actions to mitigate any potential risks.   The Service Health option under Best Practice Assessment tab will provide you with the detailed information about each health check and the necessary actions that are required to pass each one of them.      Figure 1: Service Health under Best Practice Assessment To learn more about health checks in Prisma Access BPA report please click here Review the latest Known Issues Severity Description S2 - Major Action on DNS Queries for DNS Sinkhole is not set to “sinkhole” still passes. S3 - Minor Reloading the HTML Report will repeatedly show New Features pop up. For BPA support, please contact us at bpa@paloaltonetworks.com Resources   How to generate a Prisma Access BPA Report How to Generate a BPA Report BPA Solution Brief   Best Practice Assessment (BPA) Tool LIVEcommunity Page   BPA+ (Configuration Wizard) Demos Best Practice Assessment Plus (BPA+) Overview Video Best Practice Assessment Video Playlist   ... View more

Best Practice Assessment (BPA) Prisma Access Health Checks     With the increased velocity in the security landscape, and at the same time where cyber attacks are moving faster than defense. Organizations often don’t have resources with the expertise or time to evaluate their cybersecurity defenses in order to maintain an effective network security environment. In this fast changing world where new technologies are regularly deployed to meet changing business requirements without assessing the impact it might have on information security, process changes that affect business communication flow or security gaps in an IT environment. It becomes important for us to proactively help our customers by providing them visibility into their network security.   The Best Practice Assessment (BPA) measures usage of Palo Alto Networks Ⓡ Next Generation Firewall, Panorama™, and Prisma Access security capabilities across your deployment, enabling you to make adjustments to maximize your return on investment and strengthen security. The BPA enables you to obtain context into your security posture from a configuration perspective by generating high-level graphics, heatmaps and reports that compare how your configuration aligns with best practices across your industry. Additionally, more granular metrics are shown along with recommendations on how to take action in order to improve configuration security postures across all devices.    A BPA report with Prisma Access health checks will quickly and clearly demonstrate Prisma Access strengths and weaknesses, indicating how to become more effective and to where action is needed. You’ll discover how to increase your level of protection and an actionable result from a health check can lead to robust security posture.     Prisma Access Health Checks BPA Overview Prisma Access provides consistent security to remote network and mobile users, thus a BPA report with Prisma Access health check becomes essential in establishing a solid foundation upon which cybersecurity infrastructure is built, it will help to identify weakest security areas, and will also recommend the best practice actions to mitigate any potential risks.   Figure 1: Service Health under Best Practice Assessment Benefits of Prisma Access Health Checks in BPA Report Health check is a great way to take a look at the security infrastructure you have within your business and investigate where it is necessary  to improve or build upon. Even if everything is in top working order now, a health check can give tips for the blueprint for the future or different ways you might wish to work in the coming months or years.   Here are a few reasons why it is an important step to take.     Prisma Access Health Checks BPA Result The detailed health check report will quickly and clearly demonstrate your Prisma Access strengths and weaknesses, indicating how to become more effective and to where action is needed. You’ll discover how to increase your level of protection.    The Service Health option under Best Practice Assessment tab will provide you with the detailed information about each health check and the necessary actions that are required to pass each one of them.   Figure 2: Health Checks Description   Quickly understand where to focus your security team’s efforts by regular BPA scans to identify the health of your Prisma Access to prioritize tasks to address deficiencies.   Figure 3: Health Check Summary report under Best Practice Assessment Summary tab.   Keep track of your progress by checking trending data every time a BPA report is generated. This will help you to understand and outline the health of your Prisma Access.   Figure 4: Service Health Passing percentage track     Figure 5: Service Health Historical data Heatmap under Adoption Heatmap tab. About Palo Alto Networks Palo Alto Networks, the global cybersecurity leader, is shaping the cloud-centric future with technology that is transforming the way people and organizations operate. Our mission is to be the cybersecurity partner of choice, protecting our digital way of life. We help address the world’s greatest security challenges with continuous innovation that seizes the latest break- throughs in artificial intelligence, analytics, automation, and orchestration. By delivering an integrated platform and em- powering a growing ecosystem of partners, we are at the fore- front of protecting tens of thousands of organizations across clouds, networks, and mobile devices. Our vision is a world where each day is safer and more secure than the one before.   For BPA support, please contact us at bpa@paloaltonetworks.com For more information, visit www.paloaltonetworks.com .     Resources How to generate a Prisma Access BPA Report How to Generate a BPA Report BPA Solution Brief   Best Practice Assessment (BPA) Tool LIVEcommunity Page   BPA+ (Configuration Wizard) Demos Best Practice Assessment Plus (BPA+) Overview Video Best Practice Assessment Video Playlist ... View more