{"stig":{"title":"Palo Alto Networks ALG Security Technical Implementation Guide","version":"3","release":"4"},"checks":[{"vulnId":"V-228832","ruleId":"SV-228832r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform, if used to provide intermediary services for remote access communications traffic (TLS or SSL decryption), must ensure inbound and outbound traffic is monitored for compliance with remote access security policies.","description":"Automated monitoring of remote access traffic allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by inspecting connection activities of remote access capabilities.\n\nRemote access methods include both unencrypted and encrypted traffic (e.g., web portals, web content filter, TLS, and webmail). With inbound TLS inspection, the traffic must be inspected prior to being allowed on the enclave's web servers hosting TLS or HTTPS applications. With outbound traffic inspection, traffic must be inspected prior to being forwarded to destinations outside of the enclave, such as external email traffic. This requirement does not mandate the decryption and inspection of SSL/TLS; it requires that if this is performed in the device, the decrypted traffic be inspected and conform to security policies.\n\nIf SSL/TLS traffic is decrypted in the device, it must be inspected.  The Palo Alto Networks security platform can be configured to decrypt and inspect SSL/TLS connections going through the device.  With SSL Decryption, SSL-encrypted traffic is decrypted and App-ID and the Antivirus, Vulnerability, Anti-Spyware, URL Filtering, and File-Blocking Profiles can be applied to decrypted traffic before being re-encrypted and being forwarded.  This is not limited to SSL encrypted HTTP traffic (HTTPS); other protocols \"wrapped\" in SSL/TLS can be decrypted and inspected.\n\nDecryption is policy-based and can be used to decrypt, inspect, and control both inbound and outbound SSL and SSH connections. Decryption policies allow the administrator to specify traffic for decryption according to destination, source, or URL category and in order to block or restrict the specified traffic according to security settings.","checkContent":"If the Palo Alto Networks security platform does not serve as an intermediary for remote access traffic (e.g., web content filter, TLS, and webmail), this is not applicable.\n\nGo to Policies >> Decryption; note each configured decryption policy.\nGo to Policies >> Security\nView the configured security policies.\n\nIf there is a decryption policy that does not have a corresponding security policy, this is a finding.\n\nThe matching policy may not be obvious and it may be necessary for the Administrator to identify the corresponding security policy.","fixText":"Note: These instructions assume that certificates have already been loaded on the device.  Multiple decryption policies can be configured; these instructions explain the steps involved but do not provide specific details since the exact local policies are not known.  The Administrator must tailor the configuration to match the site-specific requirements.\n\nGo to Policies >> Decryption\nSelect \"Add\".\nIn the \"Decryption Policy Rule\" window, complete the required fields.\nIn the \"Name\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" or \"Source User\" fields.\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" or \"Destination User\" fields.\nIn the \"URL Category\" tab, select which categories will be decrypted.\nSelect \"Any\" to decrypt all traffic.  This is used for web traffic.\nIn the \"Option\" tab, select \"Decrypt\" as the Action.  Select the decryption profile.\nIn the Type field, there are three options;\nSelect \"SSL Forward Proxy to decrypt and inspect SSL/TLS traffic from internal users to outside networks\".\nSelect \"SSH Proxy to decrypt inbound and outbound SSH connections passing through the device\".\nSelect \"SSL Inbound Inspection to decrypt and inspect incoming SSL traffic\".\n\nNote: This decryption mode can only work if you have control on the internal server certificate to import the Key Pair on Palo Alto Networks Device.\n\nDecrypted traffic is blocked and restricted according to the policies configured on the firewall.  For each Decryption Policy, there must be a Security Policy in order to inspect and filter the decrypted traffic.  Multiple security policies can be configured; these instructions explain the steps involved but do not provide specific details since the exact local policies are not known.\n\nGo to Policies >> Security\nSelect \"Add\".\nIn the \"Security Policy Rule\" window, complete the required fields.\nIn the \"Name\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" fields.\nIn the \"User\" tab, complete the \"Source User\" and \"HIP Profile\" fields.\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" fields.\nIn the \"Applications\" tab, either select the \"Any\" check box or add the specific applications.  Configured filters and groups can be selected.\nIn the \"Actions\" tab, select the desired resulting action (allow or deny).  If logging of matches on the rule is required, select the \"Log forwarding\" profile, and select \"Log at Session End\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-000067"]},{"vulnId":"V-228833","ruleId":"SV-228833r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.","description":"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.  Encryption provides a means to secure the remote connection so as to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of the mechanism is selected based on the security categorization of the information.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections.","checkContent":"If the Palo Alto Networks security platform does not serve as an intermediary for remote access traffic (e.g., web content filter, TLS, and webmail), this is not applicable.\n\nUse the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command \"show fips-mode\" or the command show fips-cc (for more recent releases).\n\nIf fips-mode or fips-cc is set to \"off\", this is a finding.","fixText":"To configure the Palo Alto Networks security platform to operate in FIPS mode:\n\nPower off the device by unplugging it from the electrical outlet.\n \nConnect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.\n \nThe serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit.\n \nA USB to serial adapter will be necessary if the computer does not have a serial port.\n\nDuring the boot sequence, this message will appear:\n\n\"Autoboot to default partition in 5 seconds\".\n\nEnter \"maint\" to boot to \"maint\" partition.\n\nEnter \"maint\" to enter maintenance mode.\n\nPress \"Enter\", and the \"Maintenance Recovery tool\" menu will appear.\n\nSelect \"Set FIPS Mode\" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode.\n\nNote: This will remove all installed licenses and disable the serial port.","ccis":["CCI-000068"]},{"vulnId":"V-228834","ruleId":"SV-228834r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.","description":"Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder. \n\nPrivate key data associated with software certificates is required to be generated and protected in at least a FIPS 140-2 Level 1 validated cryptographic module.","checkContent":"Use the command line interface to determine if the device is operating in FIPS mode.\n\nIf fips-mode or fips-cc is set to \"off\", this is a finding.","fixText":"To configure the Palo Alto Networks security platform to operate in FIPS mode:\n\nPower off the device by unplugging it from the electrical outlet.\n \nConnect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.\n \nThe serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit.\n \nA USB to serial adapter will be necessary if the computer does not have a serial port.\n\nDuring the boot sequence, this message will appear:\n\n\"Autoboot to default partition in 5 seconds\".\n\nEnter \"maint\" to boot to \"maint\" partition.\n\nEnter \"maint\" to enter maintenance mode.\n\nPress \"Enter\", and the \"Maintenance Recovery tool\" menu will appear.\n\nSelect \"Set FIPS Mode\" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode.\n\nNote: This will remove all installed licenses and disable the serial port.","ccis":["CCI-000068"]},{"vulnId":"V-228835","ruleId":"SV-228835r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.","description":"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.  Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).","checkContent":"If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable.\n\nUse the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command \"show fips-mode\" or the command show fips-cc (for more recent releases).","fixText":"If the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, it must use NIST FIPS-validated cryptography.\n\nPower off the device by unplugging it from the electrical outlet.\n \nConnect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.\n \nThe serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit.\n \nA USB to serial adapter will be necessary if the computer does not have a serial port.\n\nDuring the boot sequence, this message will appear:\n\"Autoboot to default partition in 5 seconds\".\n\nEnter \"maint\" to boot to \"maint\" partition.\n\nEnter \"maint\" to enter maintenance mode.\n\nPress \"Enter\", and the \"Maintenance Recovery tool\" menu will appear.\n\nSelect \"Set FIPS Mode\" (or select fips-cc for more recent versions) from the menu; once the device has finished rebooting, it will be in FIPS mode.\n\nNote: This will remove all installed licenses and disable the serial port.","ccis":["CCI-001453"]},{"vulnId":"V-228836","ruleId":"SV-228836r557387_rule","severity":"low","ruleTitle":"The Palo Alto Networks security platform must log violations of security policies.","description":"Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event. In addition to logging where sources of events such as IP addresses, processes, and node or device names, it is important to log the name or identifier of each specific policy or rule that is violated.\n\nIn the Palo Alto Networks security platform, traffic logs record information about each traffic flow, and threat logs record the threats or problems with the network traffic, such as virus or spyware detection.  Note that the antivirus, anti-spyware, and vulnerability protection profiles associated with each rule determine which threats are logged (locally or remotely).","checkContent":"Go to Policies >> Security\nView the configured security policies.\n\nFor any Security Policy where the \"Action\" column shows \"deny\", view the \"Options\" column; if there are no icons in the column, this is a finding.\n\nNote: The \"Action\" column and the \"Option\" column are usually near the right edge; it may be necessary to use the slide to view them.","fixText":"Go to Policies >> Security\nSelect \"Add\" to create a new security policy or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nIn the \"Actions\" tab, select \"Log At Session End\".  This generates a traffic log entry for the end of a session and logs drop and deny entries.\n\nNote: Traffic and Security Logs are required to be forwarded to syslog servers.\n\nIn the \"Log Forwarding\" field, select a configured log forwarding profile.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-000133"]},{"vulnId":"V-228837","ruleId":"SV-228837r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must only enable User-ID on trusted zones.","description":"User-ID can use Windows Management Instrumentation (WMI) probing as a method of mapping users to IP addresses. If this is used, the User-ID Agent will send a probe to each learned IP address in its list to verify that the same user is still logged in. The results of the probe will be used to update the record on the agent and then be passed on to the firewall.  WMI probing is a Microsoft feature that collects user information from Windows hosts and contains a username and encrypted password hash of a Domain Administrator account.\n\nIf User-ID and WMI probing are enabled on an external untrusted zone (such as the Internet), probes could be sent outside the protected network, resulting in an information disclosure of the User-ID Agent service account name, domain name, and encrypted password hash.  This information has the potential to be cracked and exploited by an attacker to gain unauthorized access to protected resources.  For this important reason, User-ID should never be enabled on an untrusted zone.","checkContent":"To verify that Windows Management Instrumentation (WMI) probing is unchecked for all untrusted zones:\n\nGo to Network >> Zones, view each zone.\nIf the Zone is untrusted and if the UserID Enabled column is checked, this is a finding.\n\nGo to Network >> Network Profiles >> Interface Mgmt\nView the configured Interface Management Profiles.\nNote which Interface Management Profiles have the \"User-ID\" field enabled (checked).\nGo Network >> Interfaces\nEach interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel.  Each type can have an Interface Management Profile applied to it.\n\nView each interface that is in an untrusted security zone; if each one has no Interface Management Profile applied, this is not a finding.\n\nIf each interface in an untrusted security zone has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled; if it does, this is a finding.","fixText":"To deny User-ID on untrusted zones:\nGo to Network >> Zones, select the name of the zone.\nIf the Zone is untrusted, In the Zone window, deselect (uncheck) the Enable User Identification check box.\nSelect \"OK\".\nGo to Network >> Network Profiles >> Interface Mgmt\nSelect \"Add\" to create a new profile or select the name of a profile to edit it.\nIn the \"Interface Management Profile\" window, deselect the \"User-ID\" check box if it is selected.\nSelect \"OK\".\n\nNote: This action precludes that particular Interface Management Profile from supporting User-ID.\n\nAn interface does not need an Interface Management Profile to operate; only to be managed on that interface.\nGo Network >> Interfaces\nEach interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel.\nEach type can have an Interface Management Profile applied to it.\nView each interface that is in an untrusted security zone; if it has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled.","ccis":["CCI-000381"]},{"vulnId":"V-228838","ruleId":"SV-228838r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must disable WMI probing if it is not used.","description":"User-ID can use Windows Management Instrumentation (WMI) probing as a method of mapping users to IP addresses. If this is used, the User-ID Agent will send a probe to each learned IP address in its list to verify that the same user is still logged in. The results of the probe will be used to update the record on the agent and then be passed on to the firewall.  WMI probing is a Microsoft feature that collects user information from Windows hosts, and contains a username and encrypted password hash of a Domain Administrator account.\n\nWMI probing on external/untrusted zones can result in the User-ID agent sending WMI probes to external/untrusted hosts.  An attacker can capture these probes and obtain the username, domain name and encrypted password hash associated with the User-ID account. If WMI probing is not used as a method of user to IP address mapping, it must be disabled.","checkContent":"Ask the Administrator if User-ID uses WMI Probing; if it does, this is not a finding.\n\nGo to Device >> User Identification\nOn the \"User Mapping\" tab, in the \"Palo Alto Networks User ID Agent\" pane, view the \"Enable Probing\" check box. If it is selected, this is a finding.","fixText":"To disable WMI probing if it is not used:\nGo to Device >> User Identification\nOn the \"User Mapping\" tab, in the \"Palo Alto Networks User ID Agent\" pane, view the \"Enable Probing\" check box.\nIf it is selected, select the \"Edit\" icon in the upper-right corner of the pane.\nIn the \"Palo Alto Networks User ID Agent Setup\" window, in the \"Client Probing\" tab, deselect the \"Enable Probing\" check box.","ccis":["CCI-000381"]},{"vulnId":"V-228839","ruleId":"SV-228839r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must not enable the DNS proxy.","description":"The Palo Alto Networks security platform can act as a DNS proxy and send the DNS queries on behalf of the clients. DNS queries that arrive on an interface IP address can be directed to different DNS servers based on full or partial domain names.\n\nHowever, unrelated or unneeded proxy services increase the attack vector surface and add excessive complexity to securing the device.","checkContent":"To check if DNS Proxy is configured:\nGo to Network >> DNS Proxy\nIf there are entries in the pane, this is a finding.","fixText":"Do not configure and enable the DNS Proxy capability.\n\nGo to Network >> DNS Proxy\nIf there are no entries in the pane, then this capability has not been enabled.","ccis":["CCI-000381"]},{"vulnId":"V-228840","ruleId":"SV-228840r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nThe DoD continually assesses the ports, protocols, and services that can be used for network communications. Some ports, protocols, or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. It is the responsibility of the enclave owner to have the applications the enclave uses registered in the PPSM database.\n\nThe Palo Alto Networks security platform must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary.  If the device is in a Deny-by-Default posture and what is allowed through the filter is IAW DoD Instruction 8551, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to PPS being blocked are satisfied. \n\nSince the enclave or system may support custom applications, it may be necessary to configure a Custom Application.  This requires detailed analysis of the application traffic and requires validation testing before deployment.","checkContent":"Review the list of authorized applications, endpoints, services, and protocols that has been added to the PPSM database.\nGo to Policies >> Security\nReview each of the configured security policies in turn.\nIf any of the policies allows traffic that is prohibited by the PPSM CAL, this is a finding.","fixText":"To configure a security policy:\nGo to Policies >> Security\nSelect \"Add\".\nIn the \"Security Policy Rule\" window, complete the required fields.\nIn the \"General\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" fields.  \nIn the \"User\" tab, select \"Any\" or complete the \"Source User\" field; this is completed if the policy performs the defined actions based on an individual user or group of users.  If using GlobalProtect with Host Information Profile (HIP) enabled, select the \"HIP Profiles\" check box, and add the HIP Object or HIP Profile.\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" fields. \nIn the \"Applications\" tab, select the authorized applications.\nIn the \"Service/URL Category\" tab, select application-default. To add a service, select the \"Service\" check box, select \"Add\", and select a listed service or add a new service or service group.\nIn the \"Actions\" tab, select either \"Deny\" or \"Allow\" (as required) as the resulting action.  Select the required Log Setting and Profile Settings as necessary.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-000382"]},{"vulnId":"V-228841","ruleId":"SV-228841r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.","description":"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\n\nCertification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.\n\nThe Palo Alto Networks security platform can be configured to use Open Certificate Status Protocol (OCSP) and/or certificate revocation lists (CRLs) to verify the revocation status of certificates and the device itself can be configured as an OCSP responder.","checkContent":"If the Palo Alto Networks security platform does not provide intermediary services for TLS or application protocols that use TLS (e.g., HTTPS), this is not applicable.\nGo to Device >> Certificate Management >> OCSP Responder\nIf no OCSP Responder is configured, this is a finding.\nGo to Device >> Setup >> Management\nIn the \"Management Interface Settings\" pane, if \"HTTP OCSP\" is not listed under \"Services\", this is a finding.","fixText":"To configure the Palo Alto Networks security platform to use an OCSP responder:\nGo to Device >> Certificate Management >> OCSP Responder\nSelect \"Add\".\nIn the \"OCSP Responder\" window, enter the host name or IP address of the OCSP responder.\n\nNote: If the firewall itself is configured as an OCSP responder, the host name must resolve to an IP address in the interface that the firewall uses for OCSP services.\n\nTo enable OCSP communication on the firewall:\nGo to Device >> Setup >> Management\nIn the \"Management Interface Settings\" pane, select the \"Edit\" icon.\nIn the \"Management Interface Settings\" box, under \"Services\" check HTTP OCSP to enable it.\nSelect \"OK\"\n\nOptionally, to configure the device itself as an OCSP responder, add an Interface Management Profile to the interface used for OCSP services.\n\nGo to Network >> Network Profiles >> Interface Management\nSelect \"Add\" to create a new profile or click the name of an existing profile.\nIn the \"Interface Management Profiles\" window, under \"Permitted Services\", check HTTP OCSP.\nSelect \"OK\".\n\nGo to Network >> Interfaces\nSelect the name of the interface that the firewall will use for OCSP services.\n\nNote: When the  device itself as an OCSP responder, the OCSP Host Name must resolve to an IP address in this interface.\n\nIn the \"Interface\" window, under Other Info, in the \"Management Profile\" field, select the configured Management Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-000185"]},{"vulnId":"V-228842","ruleId":"SV-228842r1028359_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must protect against the use of internal systems for launching denial-of-service (DoS) attacks against external networks or endpoints.","description":"DoS attacks from DOD sources risk the reputation of the organization. Thus, it is important to protect against the DOD system being used to launch an attack on external systems. Although Zone Protections are applied on the ingress interface, at a minimum, DOD requires a zero-trust approach.\n\nThese attacks may use legitimate internal or rogue endpoints from inside the enclave. These attacks can be simple \"floods\" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks.\n\nIt is important to set the Flood Protection parameters that are suitable for the enclave or system. The Administrator should characterize the traffic regularly (perform a traffic baseline) and tune these parameters based on that information.","checkContent":"Ask the Administrator if the device is using a Zone-Based Protection policy or a DoS Protection policy to protect against DoS attacks originating from the enclave.\n\nIf it is using a DoS Protection policy, perform the following:\nNavigate to Objects >> Security Profiles >> DoS Protection.\nIf there are no DoS Protection Profiles configured, this is a finding.\n\nThere may be more than one configured DoS Protection Profile; ask the Administrator which DoS Protection Profile is intended to protect outside networks from internally-originated DoS attacks.\nIf there is no such DoS Protection Profiles, this is a finding.\n\nIf it is using a Zone-Based Protection policy, perform the following:\nNavigate to Network >> Network Profiles >> Zone Protection.\nIf there are no Zone Protection Profiles configured, this is a finding.\n\nThere may be more than one configured Zone Protection Profile; ask the Administrator which Zone Protection Profile is intended to protect outside networks from internally-originated DoS attacks.\nIf there is no such Zone Protection Profile, this is a finding.\n\nNavigate to Network >> Zones.\nIf the \"Zone Protection Profile\" column for the internal zone or the DMZ is blank, this is a finding.\nIf it lists an incorrect Zone Protection Profile, this is also a finding.","fixText":"Configure either a Zone-Based Protection policy or a DoS Protection policy to protect against DoS attacks originating from the enclave.\n\nTo configure a DoS Protection policy, perform the following:\nNavigate to Objects >> Security Profiles >> DoS Protection.\nSelect \"Add\" to create a new profile.\nIn the \"DoS Protection Profile\" window, complete the required fields.\nFor the \"Type\", select \"Classified\".\nIn the \"Flood Protection\" tab, \"SYN Flood\" sub-tab, select the \"SYN Flood\" check box and select either \"Random Early Drop\" (preferred in this case) or \"SYN Cookie\"; complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields.\nIn the \"Flood Protection\" tab, \"UDP Flood\" sub-tab, select the \"UDP Flood\" check box; complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields.\nIn the \"Flood Protection\" tab, \"ICMP Flood\" sub-tab, select the \"ICMP Flood\" check box; complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields.\nIn the \"Flood Protection\" tab, \"ICMPv6 Flood\" sub-tab, select the \"ICMPv6 Flood\" check box; complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields. \nIn the \"Flood Protection\" tab, \"Other IP Flood\" sub-tab, select the \"Other IP Flood\" check box; complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields. \nIn the \"Resources Protection\" tab, leave the \"Maximum Concurrent Sessions\" check box unselected.\nSelect \"OK\".\n\nNavigate to Policies >> DoS Protection.\nSelect \"Add\" to create a new policy.\nIn the \"DoS Rule\" window, complete the required fields.\nIn the \"General\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, for \"Zone\", select the \"Internal\" zone, for \"Source Address\", select \"Any\".\nIn the \"Destination\" tab, \"Zone\", select \"External\" zone, for \"Destination Address\", select \"Any\".\nIn the \"Option/Protection\" tab:\nFor \"Service\", select \"Any\".\nFor \"Action\", select \"Protect\".\nSelect the \"Classified\" check box.\nIn the \"Profile\" field, select the configured DoS Protection profile for outbound traffic.\nIn the \"Address\" field, select source-ip-only.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.\n\nTo configure a Zone-Based Protection policy, perform the following:\nNavigate to Network >> Network Profiles >> Zone Protection\nSelect \"Add\".\nIn the \"Zone Protection Profile\" window, complete the required fields.\nIn the \"General\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Flood Protection\" tab, select the \"SYN\" check box, in the \"Action\" field, select either \"Random Early Drop\" (preferred in this case) or \"SYN Cookie\"; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \nIn the \"Flood Protection\" tab, select the \"ICMP\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \nIn the \"Flood Protection\" tab, select the \"ICMPv6\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \nIn the \"Flood Protection\" tab, select the \"Other IP\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \nIn the \"Flood Protection\" tab, select the \"UDP\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields.\nFor each of the \"Alert\", \"Activate\", and \"Maximum\" fields, the appropriate values depend on the expected traffic of the system. \nIn the \"Reconnaissance Protection\" tab, select the \"TCP Port Scan\", \"Host Sweep\", and \"UDP Port Scan\" rows. In the \"Action\" field, select \"Block\". The \"Interval\" and \"Threshold\" values can either remain as the default values or they can be changed based on the specific traffic conditions of the network (preferred).\n\nIn the \"Packet Based Attack Protection\" tab:\n\"TCP/IP Drop\" sub-tab, select the \"Spoofed IP address\", and \"Mismatched overlapping TCP segment\" check boxes.\nIn the \"IP Option Drop\" section, select the \"Strict Source Routing\", \"Loose Source Routing\", \"Timestamp\", \"Unknown\", and \"Malformed\" check boxes. \nThe \"Record Route\", \"Security\", and \"Stream ID\" check boxes can remain unchecked.\nFor the \"Reject Non-SYN TCP\" field, select \"yes\".\nFor the \"Asymmetric Path\" field, select \"bypass\".\n\n\"ICMP Drop\" sub-tab, select the \"ICMP Ping ID 0\", \"ICMP Fragment\", \"ICMP Large Packet(>1024)\" check boxes.\nThe \"Discard ICMP embedded with error message\", \"Suppress ICMP TTL Expired Error\", and \"Suppress ICMP Frag Needed\" boxes can remain unchecked.\nSince this requirement is specifically to prevent internal systems from launching DoS attacks against other networks or endpoints, select the following from the \"ICMP Drop\" sub-tab: \"ICMP Ping ID 0\", \"ICMP Fragment\", \"ICMP Large Packet(>1024)\", \"Suppress ICMP TTL Expired Error\", \"Suppress ICMP Frag Needed\".\n\"IPv6 Drop\" sub-tab, select the \"Type 0 Routing Header\", \"IPv4 compatible address\", \"Anycast source address\", \"Needless fragment header\", \"MTU in ICMPv6 'Packet Too Big' less than 1280 bytes\", \"Hop-by-Hop extension\", \"Routing extension\", \"Destination extension\", \"Invalid IPv6 options in extension header\", and \"Non-zero reserved field\" check boxes.\n\"ICMPv6\" sub-tab, select the \"ICMPv6 destination unreachable\", \"ICMPv6 packet too big\", \"ICMPv6 time exceeded\", \"ICMPv6 parameter problem\", and \"ICMPv6 redirect\" check boxes.\nSelect \"OK\".\n\nApply the Zone Protection Profile to any zone that includes egress interfaces to external networks:\nNavigate to Network >> Zones.\nSelect the zone to be configured.\nIn the \"Zone\" window, in the \"Zone Protection Profile\" window, select the configured Zone Protection Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001094","CCI-004866"]},{"vulnId":"V-228843","ruleId":"SV-228843r997591_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must block phone home traffic.","description":"A variety of Distributed Denial of Service (DDoS) attacks and other attacks use \"botnets\" as an attack vector. A botnet is a collection of software agents (referred to as \"bot\"), residing on compromised computers. Attacks are orchestrated by a \"bot herder\" to command these agents to launch attacks. Part of the command and control communication between the controller and the bots is a message sent from a bot that informs the controller that it is operating. This is referred to as a \"phone home\" message.\n\nOn the Palo Alto Networks security platform, a security policy can include an Anti-spyware Profile for “phone home” detection (detection of traffic from installed spyware). The device has two pre-configured Anti-spyware Profiles; Default and Strict. The Default Anti-spyware Profile sends an alert for detected phone-home traffic for all severity levels except the low and informational severity threat levels, while the Strict Anti-spyware Profile blocks phone-home traffic for the critical, high, and medium severity threat levels.\n\nPhone home traffic must either be blocked or intercepted by the DNS Sinkholing feature. Therefore, a custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. Note that there are specific implementation requirements for DNS Sinkholing to operate properly; refer to the Palo Alto Networks documentation for details.","checkContent":"Ask the Administrator which Anti-Spyware profile is used:\nGo to Objects >> Security Profiles >> Anti-Spyware.\nSelect the Anti-Spyware Profile.\nIn the \"Anti-Spyware Profile\" window, in the \"DNS Signatures\" tab, in the Action on \"DNS queries\" field, if either \"block\" or \"sinkhole\" is not selected, this is a finding.\n\nAsk the Administrator which Security Policy Rule allows traffic from client hosts in the trust zone to the untrust zone:\nGo to Policies >> Security.\nSelect the identified policy rule.\nView the \"Security Policy Rule\" window.\nSelect the \"Actions\" tab.\nIn the \"Profile Setting\" section, in the \"Anti-Spyware\" field, if there is no Anti-Spyware Profile or the Anti-Spyware Profile is not the correct one, this is a finding.","fixText":"Go to Objects >> Security Profiles >> Anti-Spyware.\nSelect the name of a configured Anti-Spyware Profile or select \"Add\" to create a new one.\nIn the \"Anti-Spyware Profile\" window, in the \"DNS Signatures\" tab, in the Action on \"DNS queries\" field, select \"block\" or \"sinkhole\".\nIf \"sinkhole\" is selected, complete the \"Sinkhole IPv4\" and \"Sinkhole IPv6\" fields.\n\nNote: If DNS Sinkholing is used, the device and network must be configured to support it.\n\nIf this is a new Anti-Spyware Profile, complete the required fields in all tabs.\nSelect \"OK\". \nUse the Anti-Spyware Profile in a Security Policy;\nEdit the Security Policy Rule that allows traffic from client hosts in the trust zone to the untrust zone to include the sinkhole zone as a destination and attach the Anti-spyware Profile. Select or configure a rule that allows traffic from the client host zone to the untrust zone.\n\nGo to Policies >> Security.\nSelect the appropriate existing policy rule or select \"Add\" to create a new one.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\". The window will change to display the different categories of Profiles.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Anti-Spyware\" field, select the configured Anti-Spyware Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001094","CCI-004866"]},{"vulnId":"V-228844","ruleId":"SV-228844r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.","description":"A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in \"botnets\", which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, who then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken.\n\nEnclaves must enforce egress filtering. In egress filtering, packets leaving the enclave are discarded if the source IP address is not part of the IP address network(s), also known as prefixes, which are assigned to the enclave. A more specific form of egress filtering is to allow only those hosts and protocols that have been identified and authorized to exit the enclave. All traffic leaving the enclave, regardless of the destination, must be filtered by the premise router's egress filter to verify that the source IP address belongs to the enclave.\n\nConfigure a security policy that allows only traffic originating from the IP address prefixes assigned to the enclave to exit the enclave.  The implicit deny cross zone traffic rule will then be used, in part, to deny illegitimate source address traffic originating from an internal zone to go to another zone.","checkContent":"Verify an anti-spoofing policy is configured for each outgoing zone that drops any traffic when the source IP does not match the list of allowed IP ranges for each outgoing zone.\n\nNavigate to the “Zone Protection Profile” configuration screen\n\nSelect the “Packet-Based Attack Protection” tab\n\nSelect the “IP Drop” tab\n\nIf the “Spoofed IP Address” box is not checked for each outgoing zone, this is a finding.","fixText":"Create an anti-spoofing policy for each outgoing zone that drops any traffic when the source IP does not match the list of allowed IP ranges for each outgoing zone.\n\nNavigate to the “Zone Protection Profile” configuration screen.\n\nSelect the “Packet- Based Attack Protection” tab.\n\nSelect the “IP Drop” tab.\n\nCheck the “Spoofed IP Address” box.","ccis":["CCI-001094"]},{"vulnId":"V-228845","ruleId":"SV-228845r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).","description":"A deny-all, permit-by-exception network communications traffic policy ensures that only those connections that are essential and approved are allowed.  As a managed boundary interface between networks, the Palo Alto Networks security platform must block all inbound and outbound network traffic unless a policy filter is installed to explicitly allow it. The allow policy filters must comply with the site's security policy. A deny-all, permit–by-exception network communications traffic policy ensures that only those connections that are essential and approved are allowed.\n\nBy default, there are two security policies on the Palo Alto Networks firewall:\nAllow traffic within the same zone (intra-zone)\nDeny traffic from one zone to another zone (inter-zone).\n\nNo policy that circumvents the inter-zone policy is allowed. Traffic through the device is permitted by policies developed to allow only that specific traffic that the system or enclave requires.","checkContent":"Go to Policies >> Security\nReview each of the configured security policies in turn.\nSelect each policy in turn; in the \"Security Policy Rule\" window, if the \"Source Address\" has \"Any\" selected, the \"Destination Address\" has \"Any\" selected, the \"Application\" has \"Any\" selected, and the \"Action\" Setting is \"Allow\", this is a finding.\n\nIf any Security Policy is too broad (allowing all traffic either inbound or outbound), this is also a finding.","fixText":"Do not configure any policies or rules that violate a deny-all, permit-by-exception policy.\nConfigure policies that allow traffic through the device based only on the mission and system requirements.","ccis":["CCI-001109"]},{"vulnId":"V-228846","ruleId":"SV-228846r971530_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must terminate communications sessions after 15 minutes of inactivity.","description":"Idle sessions can accumulate, leading to an exhaustion of memory in network elements processing traffic flows.\nNote that the 15 minute period is a maximum value; Administrators can choose shorter timeout values to account for system- or network-specific requirements.\n\nOn a Palo Alto Networks security platform,  a session is defined by two uni-directional flows, each uniquely identified by a 6-tuple key: source-address, destination-address, source-port, destination-port, protocol, and security-zone.  Besides the six attributes that identify a session, each session has few more notable identifiers: end hosts - the source IP and destination IP which will be marked as client(source IP) and server(destination IP) and flow direction - each session is bi-directional and is identified by a two uni-directional flows, the first flow is client-to-server(c2s) and the returning flow is server-to-client(s2c).\n\nSessions between endpoints are kept active by either normal traffic or by keepalive messages (also sometimes referred to as heartbeat messages).  On the Palo Alto Networks security platform, the session timeout period is the time (seconds) required for the application to time out due to inactivity.  Session timeouts are configured globally and on a per-application basis.  When configured, timeouts for an application override the global TCP or UDP session timeouts.","checkContent":"To check global values:\nGo to Device >> Setup >> Session\nIn the \"Session Timeouts\" pane, if the TCP field has a value of greater than \"900\", this is a finding.\n\nObtain the list of authorized applications for the system or network.\nTo check application-specific values:\nGo to Objects >> Applications\nSelect, in turn, each authorized application.\nIn the \"Application\" window, in the \"Options\" pane, view the \"TCP\" and \"UDP Timeout\" fields, if the value is greater than \"900\", this is a finding.\n\nMany applications will not have one of these two fields.","fixText":"To configure the global values:\nGo to Device >> Setup >> Session\nIn the \"Session Timeouts\" pane, select the \"Edit\" icon (the gear symbol in the upper-right corner of the pane).\nIn the \"TCP\" field, enter \"900\".\nSelect \"OK\".\n\nTo configure application-specific values:\nGo to Objects >> Applications\nSelect an application name to view additional details about the application.\nTo search for a specific application, enter the \"application name\" or \"description\" in the \"Search\" field.\nIn the \"Application\" window, in the \"Options\" pane, in the \"TCP Timeout\" field, select \"Customize\".\nIn the Application specific window, in the \"TCP\" and \"UDP Timeout\" fields, enter \"900\" if the existing value is greater than \"900\".   Many applications will not have one of these two fields.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001133"]},{"vulnId":"V-228847","ruleId":"SV-228847r1018772_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.","description":"In order to minimize any potential negative impact to the organization caused by malicious code, malicious code must be identified and eradicated. Malicious code includes viruses, worms, Trojan horses, and Spyware.","checkContent":"Check if the device is using the most current protection mechanisms and signature definitions.\nIf the device has authorized connectivity to the Palo Alto site, the automated process can be used.\nGo to Device >> Dynamic Updates.\nView the list of updates, and note the date of the most recent one.\nSelect \"Check Now\" at the bottom of the page; if new updates appear, this is a finding.\nIf the device does not have connectivity to the Palo Alto site, a manual process must be used.\nLog on to the Palo Alto Support site (registration required).\nSelect the “Dynamic Updates” hyperlink.\nCheck for the most current update (the version and release date of each update is listed).\nGo to Device >> Dynamic Updates.\nView the list of updates and note the date of the most recent one.\nIf the device does not have the most current updates installed, this is a finding.","fixText":"If the device has authorized connectivity to the Palo Alto site, automatic updates can be used.\n\nTo schedule automatic updates:\nGo to Device >> Dynamic Updates.\nSelect the text to the right of Schedule.\nIn the \"Applications and Threat Updates Schedule\" Window; complete the required information.\nIn the \"Recurrence\" field, select the desired frequency. If the update frequency is Weekly, select which day of the week.\nIn the \"Time\" field, enter the time at which you want the device to check for updates.\nFor the Action, select \"Download and Install\".\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.\n\nTo retrieve the latest signatures:\nGo to Device >> Dynamic Updates.\nSelect \"Check Now\" at the bottom of the page. \n\nIf the device does not have authorized connectivity to the Palo Alto site, a manual process must be used. If manual updates are used, an administrator must obtain updates from the Palo Alto Networks website and upload them from a workstation or server to the device.\nGo to Device >> Dynamic Updates.\nSelect \"Upload\" (at the bottom of the pane).\nIn the Select \"Package Type\" for the \"Upload\" window in the \"Package Type\" field, select \"anti-virus\".\nBrowse to and select the appropriate file.\nSelect \"OK\".\nSelect \"Install From File\" (at the bottom of the pane).\nIn the \"Select Package Type for Installation\" window, select \"antivirus\".\nSelect \"OK\".\nIn the \"Install Application and Threats From File\" window, select the previously uploaded file.\nSelect \"OK\".","ccis":["CCI-004965","CCI-001240"]},{"vulnId":"V-228848","ruleId":"SV-228848r559740_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must drop malicious code upon detection.","description":"Malicious code is designed to compromise information systems; therefore, it must be prevented from being transferred to uninfected hosts.\n\nThe Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while dropping for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.","checkContent":"Go to Objects >> Security Profiles >> Antivirus\nIf there are no Antivirus Profiles configured other than the default, this is a finding.\n\nView the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB) if the \"Action\" is anything other than “drop” or \"reset-both\", this is a finding.\n\nGo to Policies >> Security.\n\nReview each of the configured security policies in turn. For any Security Policy that allows traffic between Zones (interzone), view the \"Profile\" column.\n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.","fixText":"To create an Antivirus Profile:\nGo to Objects >> Security Profiles >> Antivirus.\n\nSelect \"Add\".\n\nIn the \"Antivirus Profile\" window, complete the required fields.\n\nComplete the \"Name\" and \"Description\" fields.\n\nIn the \"Antivirus\" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols) set the \"Action\" to “drop” or \"reset-both\".\n\nSelect \"OK\".\n\nUse the Antivirus Profile in a Security Policy:\nGo to Policies >> Security.\n\nSelect an existing policy rule or select \"Add\" to create a new one.\n\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\". The window will change to display the different categories of Profiles.\n\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Antivirus\" field, select the configured Antivirus Profile.\n\nSelect \"OK\".\n\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\n\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001243"]},{"vulnId":"V-228849","ruleId":"SV-228849r559739_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection.","description":"Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of this code on the network. This requirement is limited to ALGs web content filters and packet inspection firewalls that perform malicious code detection as part of their functionality.\n\nThe Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. \n\nThere is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while dropping traffic for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.\n\nInspection is done through stream-based analysis, which means files are not cached or stored in their entirety on the firewall, but analyzed in real-time as they pass through the firewall. Therefore, any detected virus will automatically be deleted when detected.","checkContent":"Go to Objects >> Security Profiles >> Antivirus\n\nIf there are no Antivirus Profiles configured other than the default, this is a finding.\n\nView the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB), if the \"Action\" is anything other than “drop” or \"reset-both\", this is a finding. \n\nGo to Policies >> Security\n\nReview each of the configured security policies in turn. For any Security Policy that affects traffic between Zones (interzone), view the \"Profile\" column. \n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.","fixText":"To create an Antivirus Profile:\nGo to Objects >> Security Profiles >> Antivirus\n\nSelect \"Add\".\n\nIn the \"Antivirus Profile\" window, complete the required fields.\n\nComplete the \"Name\" and \"Description\" fields. \n\nIn the \"Antivirus\" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols) set the \"Action\" to “drop” or \"reset-both\". This will drop the data stream and create a log record. \n\nSelect \"OK\".\n\nUse the Profile in a Security Policy:\nGo to Policies >> Security\n\nSelect an existing policy rule or select \"Add\" to create a new one. \n\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\". The window will change to display the different categories of Profiles.\n\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Antivirus\" field, select the configured Antivirus Profile.\nSelect \"OK\".\n\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen. \n\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001243"]},{"vulnId":"V-228850","ruleId":"SV-228850r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must send an immediate (within seconds) alert to the system administrator, at a minimum, in response to malicious code detection.","description":"Without an alert, security personnel may be unaware of an impending failure of the audit capability; then the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded.\n\nThe device must generate an immediate (within seconds) alert that notifies designated personnel of the incident.  Since sending a message to an unattended log or console does not meet this requirement, the threat logs must be sent to an attended console or to e-mail.\n\nWhen the Palo Alto Networks security platform blocks malicious code, it also generates a record in the threat log.  This message has a medium severity.","checkContent":"The following is an example of how to check if the device is sending messages to e-mail; this is one option that meets the requirement.  If sending messages to an SNMP server or Syslog servers is used, follow the vendor guidance on how to verify that function:\nGo to Device >> Server Profiles >> Email\nIf there is no Email Server Profile configured, this is a finding.\nGo to Objects >> Log forwarding\nIf there is no Email Forwarding Profile configured, this is a finding.\n\nGo to Policies >> Security\nView the Security Policy that is used to detect malicious code (the \"Profile\" column does displays the \"Antivirus Profile\" symbol) in the \"Options\" column.\nIf the Email Forwarding Profile is not used, this is a finding.","fixText":"The following is an example of how to configure the device to send messages to e-mail; this is one option that meets the requirement.  If sending messages to an SNMP server or Syslog servers is used, follow the vendor guidance on how to configure that function.\nTo create an email server profile:\nGo to Device >> Server Profiles >> Email\nSelect \"Add\". \nIn the Email Server Profile, enter the name of the profile.\nSelect \"Add\".\nIn the \"Servers\" tab, enter the required information.\nIn the \"Name\" field, enter the name of the Email server.\nIn the \"Email Display Name\" field, enter the name shown in the \"From\" field of the email.\nIn the \"From\" field, enter the \"From email address\".\nIn the \"To\" field, enter the email address of the recipient.\nIn the \"Additional Recipient\" field, enter the email address of another recipient. You can only add one additional recipient. To add multiple recipients, add the email address of a distribution list.\nIn the \"Gateway\" field, enter the IP address or host name of the Simple Mail Transport Protocol (SMTP) server used to send the email.\nSelect the \"OK\" button.\nAfter you create the Server Profiles that define where to send your logs, you must enable log forwarding. \nThreat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels you want to forward and then adding it to the security policies for which you want to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection).\nConfigure the log-forwarding profile to select the logs to be forwarded to Email server.\nGo to Objects >> Log forwarding\nThe \"Log Forwarding Profile\" window appears.  Note: It has five columns.  \nIn the \"Name\" Field, enter the name of the Log Forwarding Profile.\nIn the \"Threat Settings\" Section in the \"Email\" column, select the Email server profile for forwarding threat logs to the configured server(s).\nSelect the \"OK\" button.\nWhen the \"Log Forwarding Profile\" window disappears, the screen will show the configured log-forwarding profile.\nFor Threat Logs, use the log forwarding profile in the security rules.\nGo to Policies >> Security Rule.\nSelect the rule for which the log forwarding needs to be applied, which in this case is the Security Policy that is used to detect malicious code (the \"Profile\" column does display the Antivirus Profile symbol). Apply the log forwarding profile to the rule.\nIn the \"Actions\" tab in the \"Log Setting\" section; in the \"Log Forwarding\" field, select the log forwarding profile from drop-down list.\nNote: The Log Forwarding field can only have one profile.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001243"]},{"vulnId":"V-228851","ruleId":"SV-228851r1018773_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must automatically update malicious code protection mechanisms.","description":"Remote access is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).","checkContent":"Go to Device >> Dynamic Updates.\nIf no entries for Applications and Threats are present, this is a finding.\nIf the Applications and Threats entry states Download Only, this is a finding.\n\nThis can be downgraded if a manual process is used. If a manual process is used, compare the Applications and Threats database for the most recent version.\nGo to Dashboard >> General Information, if the application, threat, and URL filtering definition versions are not the most current ones listed on the vendor support site, this is a finding.","fixText":"Go to Device >> Dynamic Updates; select \"Check Now\" at the bottom of the page to retrieve the latest signatures.\nTo schedule automatic signature updates. Note: The steps provided below do not account for local change management policies.\nGo to Device >> Dynamic Updates; select the text to the right of Schedule.\nIn the \"Applications and Threat Updates Schedule\" window; complete the required information.\nIn the \"Recurrence\" field, select Daily.\nIn the \"Time\" field, enter the time at which you want the device to check for updates.\nFor the Action, select \"Download and Install\".\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen. Select \"OK\" when the confirmation dialog appears.\n\nIf using Dynamic Updates is not possible due to mission requirements, implement a manual process.","ccis":["CCI-004964","CCI-001247"]},{"vulnId":"V-228852","ruleId":"SV-228852r559734_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code.","description":"Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.\n\nThis applies to mobile code that may originate either internal to or external from the enclave. Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.\n\nThe Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while denying for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.","checkContent":"Go to Objects >> Security Profiles >> Antivirus\n\nIf there are no Antivirus Profiles configured other than the default, this is a finding.\n\nView the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB); if the \"Action\" is anything other than “deny” or \"reset-both\", this is a finding.\n\nGo to Policies >> Security\n\nReview each of the configured security policies in turn.\nFor any Security Policy that affects traffic between Zones (interzone), view the \"Profile\" column.\n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.","fixText":"To create an Antivirus Profile:\nGo to Objects >> Security Profiles >> Antivirus\n\nSelect \"Add\".\n\nIn the \"Antivirus Profile\" window, complete the required fields. \n\nComplete the \"Name\" and \"Description\" fields. \n\nIn the \"Antivirus\" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the \"Action\" to “deny\" or \"reset-both”.\n\nSelect \"OK\".\n\nUse the Profile in a Security Policy:\nGo to Policies >> Security\n\nSelect an existing policy rule or select \"Add\" to create a new one.\n\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\". The window will change to display the different categories of Profiles. \n\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select Profiles. The window will change to display the different categories of Profiles.\n\nSelect \"OK\".\n\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\n\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001695"]},{"vulnId":"V-228853","ruleId":"SV-228853r559712_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must prevent the download of prohibited mobile code.","description":"MMobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.\n\nThis applies to mobile code that may originate either internal to or external from the enclave. Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.\n\nThe Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while denying for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.","checkContent":"Go to Objects >> Security Profiles >> Antivirus\n\nIf there are no Antivirus Profiles configured other than the default, this is a finding.\n\nView the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB), if the \"Action\" is anything other than “drop” or “reset-both”, this is a finding.\n\nGo to Policies >> Security\n\nReview each of the configured security policies in turn. \n\nFor any Security Policy that affects traffic between Zones (interzone), view the \"Profile\" column. \n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.","fixText":"To create an Antivirus Profile:\nGo to Objects >> Security Profiles >> Antivirus\n\nSelect \"Add\".\n\nIn the \"Antivirus Profile\" window, complete the required fields.\n\nComplete the \"Name\" and \"Description\" fields.\n\nIn the \"Antivirus\" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the Action to \"drop\" or “reset-both”.\n\nSelect \"OK\".\n\nUse the Profile in a Security Policy:\nGo to Policies >> Security\n\nSelect an existing policy rule or select \"Add\" to create a new one.\n\nIn the \"Actions\" tab in the \"Profile Setting\" section; , in the \"Profile Type\" field, select Profiles. The window will change to display the different categories of Profiles.\n\nIn the \"Actions\" tab, in the \"Profile Setting\" section; in the \"Antivirus\" field, select the configured Antivirus Profile. \n\nSelect \"OK\".\n\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen. \n\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001169"]},{"vulnId":"V-228854","ruleId":"SV-228854r831594_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must control remote access methods (inspect and filter traffic).","description":"Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.\n\nRemote access is access to DoD-nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).\n\nIf the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, configure the device to inspect and filter decrypted traffic. For each type of SSL/TLS traffic that is decrypted, the resulting traffic must be inspected and filtered.  For example, HTTPS traffic that is decrypted must have the HTTP traffic inspected and filtered.","checkContent":"If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable.\n\nGo to Policies >> Decryption\nNote each configured decryption policy.\nGo to Policies >> Security\nView the configured security policies.\n\nIf there is a decryption policy that does not have a corresponding security policy, this is a finding.\nThe matching policy may not be obvious, and it may be necessary for the Administrator to identify the corresponding security policy.","fixText":"These instructions explain the steps involved, but do not provide specific details since the exact policies and expected traffic are not known.\n\nGo to Policies >> Security\nSelect \"Add\".\nIn the \"Security Policy Rule\" window, complete the required fields.\nConfigure the Security Policy in accordance with the policy for the resulting decrypted traffic.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002314"]},{"vulnId":"V-228855","ruleId":"SV-228855r831595_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security, if used as a TLS gateway/decryption point or VPN concentrator, must provide the capability to immediately disconnect or disable remote access to the information system.","description":"Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking place would not be immediately stopped.\n\nRemote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The remote access functionality may implement features such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.\n\nIf the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, configure the device to deny decrypted traffic that violates the enclave or system policies. For each type of SSL/TLS traffic that is decrypted, the resulting traffic must be inspected and filtered.","checkContent":"If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable.\n\nGo to Policies >> Decryption\nNote each configured decryption policy.\nGo to Policies >> Security\nView the configured security policies.\nIf there is a decryption policy that does not have a corresponding security policy, this is a finding.\n\nThe matching policy may not be obvious, and it may be necessary for the Administrator to identify the corresponding security policy.\nSelect the Security Policy Rules applied to the decrypted traffic. If it allows traffic that is prohibited, this is a finding.","fixText":"These instructions explain the steps involved but do not provide specific details since the exact policies and expected traffic are not known.\n\nGo to Policies >> Security\nSelect \"Add\".\nIn the \"Security Policy Rule\" window, complete the required fields.\nConfigure the Security Policy in accordance with the enclave's or system's policy for the resulting decrypted traffic.\nFor any traffic that violates the enclave policy, configure the Security Policy rule to deny the traffic.\nIn the \"Security Policy Rule\" window, in the \"Actions\" tab, in the \"Action Setting\" section, select \"deny\".\nFor any traffic that is allowed, configure the Security Policy Rule to allow the traffic and apply Antivirus and Vulnerability Protection Profiles. \nIn the \"Security Policy Rule\" window, in the \"Actions\" tab, in the \"Action Setting\" section, select \"allow\".\nIn the \"Security Policy Rule\" window, in the \"Actions\" tab, in the \"Profiles Setting\" section, select the necessary Profiles.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002322"]},{"vulnId":"V-228856","ruleId":"SV-228856r831596_rule","severity":"medium","ruleTitle":"To protect against data mining, the Palo Alto Networks security platform must detect and prevent SQL and other code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.","description":"Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information.\n\nInjection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a code injection attack. This type of attack includes XPath and LDAP injections.","checkContent":"Go to  Objects >> Security Profiles >> Vulnerability Protection\nIf there are no Vulnerability Protection Profiles configured, this is a finding.\n\nAsk the Administrator which Vulnerability Protection Profile is used to protect database assets by blocking and alerting on attacks.\nView the configured Vulnerability Protection Profile\nCheck the \"Severity\" and \"Action\" columns.\nIf the Vulnerability Protection Profile used for database protection does not block all critical, high, and medium threats, this is a finding.\n\nIf the Vulnerability Protection Profile used for database protection does not alert on low and informational threats, this is a finding.\n\nAsk the Administrator which Security Policy is used to protect database assets:\nGo to Policies >> Security\nView the configured Security Policy.\nView the \"Profile\" column.\nIf the \"Profile\" column does not display the \"Vulnerability Protection Profile\" symbol, this is a finding.\n\nMoving the cursor over the symbol will list the exact Vulnerability Protection Profiles applied.\n\nIf the specific Vulnerability Protection Profile is not listed, this is a finding.","fixText":"Create and apply a Vulnerability Protection Profile to protect database assets by blocking and alerting on attacks. This profile has two rules; the first blocks critical, high, and medium threats, and the second alerts on low and informational threats.\n\nGo to Objects >> Security Profiles >> Vulnerability Protection\nSelect \"Add\".\nIn the \"Vulnerability Protection Profile\" window, complete the required fields.\nIn the \"Name\" field, enter the name of the Vulnerability Protection Profile.\nIn the \"Description\" field, enter the description of the Vulnerability Protection Profile.\nIn the \"Rules\" tab, select \"Add\".\nIn the \"Vulnerability Protection Rule\" window, \nIn the \"Rule Name\" field, enter the Rule name,\nIn the \"Threat Name\" field, select \"any\",\nIn the \"Action\" field, select \"block\".\nIn the \"Host type\" field, select \"server\".\nSelect the check boxes above the \"CVE\" and \"Vendor ID\" boxes. \nIn the \"Severity\" section, select the \"critical\", \"high\", and \"medium\" check boxes.\nSelect \"OK\".\nIn the \"Vulnerability Protection Profile\" window, select the configured rule, then select \"OK\".\n\nAdd a second rule that  alerts on low and informational threats.\nApply the Vulnerability Protection Profile to the Security Policy Rules permitting traffic to the databases.\nGo to Policies >> Security\nSelect an existing policy rule or select \"Add\" to create a new one.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Vulnerability Protection\" field, select the configured Vulnerability Protection Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002346"]},{"vulnId":"V-228857","ruleId":"SV-228857r831597_rule","severity":"medium","ruleTitle":"To protect against data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.","description":"Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information.\n\nInjection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. These attacks include buffer overrun, XML, JavaScript, and HTML injections.\n\nMost current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database.  The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.","checkContent":"Go to  Objects >> Security Profiles >> Vulnerability Protection\nIf there are no Vulnerability Protection Profiles configured, this is a finding.\n\nAsk the Administrator which Vulnerability Protection Profile is used to protect application assets by blocking and alerting on attacks.\nView the configured Vulnerability Protection Profile; check the \"Severity\" and \"Action\" columns.\nIf the Vulnerability Protection Profile used for database protection does not block all critical, high, and medium threats, this is a finding.\n\nIf the Vulnerability Protection Profile used for database protection does not alert on low and informational threats, this is a finding.\n\nAsk the Administrator which Security Policy is used to protect application assets:\nGo to Policies >> Security\nView the configured Security Policy; view the \"Profile\" column.\nIf the \"Profile\" column does not display the \"Vulnerability Protection Profile\" symbol, this is a finding.\n\nMoving the cursor over the symbol will list the exact Vulnerability Protection Profiles applied.\n\nIf the specific Vulnerability Protection Profile is not listed, this is a finding.","fixText":"Create and apply a Vulnerability Protection Profile to protect application assets by blocking and alerting on attacks. This profile has two rules; the first blocks critical, high, and medium threats, and the second alerts on low and informational threats.\nGo to Objects >> Security Profiles >> Vulnerability Protection\nSelect \"Add\".\nIn the \"Vulnerability Protection Profile\" window, complete the required fields.\nIn the \"Name\" field, enter the name of the Vulnerability Protection Profile.\nIn the \"Description\" field, enter the description of the Vulnerability Protection Profile.\nIn the \"Rules\" tab, select \"Add\".\nIn the \"Vulnerability Protection Rule\" window, \nIn the \"Rule Name\" field, enter the Rule name,\nIn the \"Threat Name\" field, select \"any\",\nIn the \"Action\" field, select \"block\".\nIn the \"Host type\" field, select \"server\".\nSelect the check boxes above the \"CVE\" and \"Vendor ID\" boxes. \nIn the \"Severity\" section, select the \"critical\", \"high\", and \"medium\" check boxes.\nSelect \"OK\".\nIn the \"Vulnerability Protection Profile\" window, select the configured rule, then select \"OK\".\nAdd a second rule that  alerts on low and informational threats.\nApply the Vulnerability Protection Profile to the Security Policy Rules permitting traffic to the applications.\nGo to Policies >> Security\nSelect an existing policy rule or select \"Add\" to create a new one.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Vulnerability Protection\" field, select the configured Vulnerability Protection Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002346"]},{"vulnId":"V-228858","ruleId":"SV-228858r831598_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited.","description":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nThis does not apply to audit logs generated on behalf of the device itself (management).","checkContent":"To view a syslog server profile:\nGo to Device >> Server Profiles >> Syslog\nIf there are no Syslog Server Profiles present, this is a finding.\n\nSelect each Syslog Server Profile; if no server is configured, this is a finding.\n\nView the log-forwarding profile to determine which logs are forwarded to the syslog server:\nGo to Objects >> Log forwarding\nIf no Log Forwarding Profile is present, this is a finding.\n\nThe \"Log Forwarding Profile\" window has five columns.\nIf there are no Syslog Server Profiles present in the Syslog column for the Traffic Log Type, this is a finding.\n\nIf there are no Syslog Server Profiles present for each of the severity levels of the Threat Log Type, this is a finding.\n\nGo to Device >> Log Settings >> System\nThe list of Severity levels is displayed.\nIf any of the Severity levels does not have a configured Syslog Profile, this is a finding.\nGo to Device >> Log Settings >> Config\nIf the \"Syslog\" field is blank, this is a finding.\n\nNote: Any one failure of a check results in a finding, but failing more than one still results in only one finding.  There cannot be multiple findings for a single requirement.","fixText":"Create a syslog server profile:\nGo to Device >> Server Profiles >> Syslog\nSelect \"Add\". \nIn the Syslog Server Profile, enter the name of the profile.\nSelect \"Add\".\nIn the \"Servers\" tab, enter the required information.\nName: Name of the syslog server\nServer: Server IP address where the logs will be forwarded to\nPort: Default port 514\nFacility: Select from the drop-down list.\nSelect the \"OK\" button.\n\nAfter the Server Profiles are created that define where to send the logs, enable log forwarding. \nThe way forwarding is enabled depends on the log type:\nTraffic Logs-Enable forwarding of Traffic logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) and adding it to the security policies you want to trigger the log forwarding. Only traffic that matches a specific rule within the security policy will be logged and forwarded.\nConfigure the log-forwarding profile to select the logs to be forwarded to syslog server.\nGo to Objects >> Log forwarding\nThe \"Log Forwarding Profile\" window appears.  Note that it has five columns.\nIn the \"Syslog\" column, select the syslog server profile for forwarding threat logs to the configured server(s).\nSelect the \"OK\" button.\n\nWhen the \"Log Forwarding Profile\" window disappears, the screen will show the configured log-forwarding profile.\nThreat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels you want to forward and then adding it to the security policies for which you want to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection).\nConfigure the log-forwarding profile to select the logs to be forwarded to syslog server.\nGo to Objects >> Log forwarding\nThe \"Log Forwarding Profile\" window appears.  Note that it has five columns.  In the \"Syslog\" column, select the syslog server profile for forwarding threat logs to the configured server(s).\nSelect the \"OK\" button.\n\nWhen the Log Forwarding Profile window disappears, the screen will show the configured log-forwarding profile.\nSystem Logs-Enable forwarding of System logs by specifying a Server Profile in the log settings configuration.\nGo to Device >> Log Settings >> System\nThe list of severity levels is displayed.\nYou must select a Server Profile for each severity level you want to forward.  \nSelect each severity level in turn; with each selection, the Log \"Systems - Setting\" window will appear.  \nIn the \"Log Systems - Setting\" window, in the \"Syslog\" drop-down box, select the configured Server Profile.\nSelect the \"OK\" button.\n\nConfig Logs-Enable forwarding of Config logs by specifying a Server Profile in the log settings configuration:\nGo to Device >> Log Settings >> Config\nSelect the \"Edit\" icon (the gear symbol in the upper-right corner of the pane).\nIn the \"Log Settings Config\" window, in the \"Syslog\" drop-down box, select the configured Server Profile.\nSelect the \"OK\" button.\n\nFor Traffic Logs and Threat Logs, use the log forwarding profile in the security rules:\nGo to Policies >> Security Rule\nSelect the rule for which the log forwarding needs to be applied. Apply the security profiles to the rule.\nGo to Actions >> Log forwarding\nSelect the log forwarding profile from drop-down list.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001851"]},{"vulnId":"V-228859","ruleId":"SV-228859r831599_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform being used for TLS/SSL decryption using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certificate Authorities (CAs) for the establishment of protected sessions.","description":"Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place that are sufficient for DoD systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users.\n\nThe authoritative list of DoD-approved PKIs is published at http://iase.disa.mil/pki-pke/interoperability. DoD-approved PKI CAs may include Category I, II, and III certificates. Category I DoD-Approved External PKIs are PIV issuers. Category II DoD-Approved External PKIs are Non-Federal Agency PKIs cross certified with the Federal Bridge Certification Authority (FBCA). Category III DoD-Approved External PKIs are Foreign, Allied, or Coalition Partner PKIs.\n\nDeploying the ALG with TLS enabled will require the installation of DoD and/or DoD-Approved CA certificates in the trusted root certificate store of each proxy to be used for TLS traffic. If the Palo Alto Networks security platform is  used for TLS/SSL decryption, configure the Palo Alto Networks security platform to only accept end entity certificates issued by DoD PKI or DoD-approved PKI CAs for the establishment of protected sessions.","checkContent":"If the Palo Alto Networks security platform is not used for TLS/SSL decryption, this is not applicable.\n\nIf the Palo Alto Networks security platform accepts non-DoD approved PKI end entity certificates, this is a finding.","fixText":"Import the intermediate CA certificates.\n\nTo load a CA certificate on the Palo Alto Networks firewall:\nGo to Device >> Certificate Management >> Certificates\nOn the \"Device Certificate\" tab, select \"Import\".\nIn the \"Import Certificate\" window, complete the required information.\nIn the \"Certificate Name\" field, enter the name of the certificate.\nIn the \"Certificate File\" field, select \"Browse\", then browse to and select the appropriate file.\nIn the \"File Format\"  field, select \"Base64 Encoded Certificate (PEM)\".\nSelect \"OK\".\n\nCreate a Client Certificate Profile:\nGo to Device >>Certificate Management>> Certificate Profile\nSelect \"Add\".\nIn the Certificate Profile, complete the required fields.\nIn the \"Name\" field, enter the name of the Certificate Profile.\nIn the \"Username\" field, select \"Subject\".\nNote: The adjacent field will contain common-name.\nAdd all of the DoD Intermediate Certificates.\nSelect the \"Use OCSP\" check box.\nSelect the \"Block session if certificate status is unknown\" check box.\nSelect the \"Block session if certificate status cannot be retrieved within timeout\".\n\nCreate an Authentication Profile:\nGo to Device >> Authentication Profile\nSelect, \"Add\".\nIn the \"Authentication Profile\" window, complete the required fields.\nIn the \"Authentication\" field, add either \"RADIUS\" or \"LDAP\" based on the local requirements. \nIn the Server Profile filed, select the server profile for the authentication server.","ccis":["CCI-002470"]},{"vulnId":"V-228860","ruleId":"SV-228860r1084264_rule","severity":"high","ruleTitle":"The Palo Alto Networks security platform must protect against denial-of-service (DoS) attacks from external sources.","description":"If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users. Installation of content filtering gateways and application-layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type.\n\nDetection components that use rate-based behavior analysis can detect attacks when signatures for the attack do not exist or are not installed. These attacks include zero-day attacks that are new attacks for which vendors have not yet developed signatures. Rate-based behavior analysis can detect sophisticated, Distributed DoS (DDoS) attacks by correlating traffic information from multiple network segments or components.\n\nPAN-OS can use either Zone-Based Protection or End Host Protection to mitigate DoS attacks. Zone-Based Protection protects against most common floods, reconnaissance attacks, and other packet-based attacks and is applied to any zone. End Host Protection is specific to defined end hosts. Zone Protections are always applied on the ingress interface, so to protect against floods or scans from the internet, apply the profile on the zone containing the untrusted internet interface. Security administrators wishing to harden their networks even further can apply Zone Protections to both internal and external interfaces to ensure that protective measures are being applied across the entire environment.\n\nIt is important to set the Flood Protection parameters that are suitable for the enclave or system. The administrator should perform a traffic baseline to tune these parameters. Refer to https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVkCAK.","checkContent":"View the site's Security Protection Plan (SSP). Verify if Zone-based protection, DoS protection, or both are required by the SSP. There may be more than one configured inbound policy.\n\nIf the SSP requires one or more Zone protection policies:\n1. Navigate to Network >> Network Profiles >> Zone Protection.\n2. Navigate to Network >> Zones and view the \"Zone Protection Profile\", which should not be blank.\n3. If a Zone Protection Profile is not configured, has a blank \"Zone Protection Profile\" column, or is incorrectly identified, this is a finding.\n\nIf the SSP requires one or more DoS protection policies:\n1. Navigate to Objects >> Security Profiles >> DoS Protection.\n2. Navigate to Policies >> DoS Protection.\n\nIf neither a Zone Protection Profile nor a DoS Protection policy is configured to protect each ingress interface, this is a finding.","fixText":"Configure either a Zone-Based protection policy or a DoS protection policy. Zone protections are, at a minimum, applied on each ingress interface.\n\nTo configure a Zone-Based protection policy, perform the following:\n1. Navigate to Network >> Network Profiles >> Zone Protection and select \"Add\".\n2. In the \"Zone Protection Profile\" window, complete the required fields.\n3. In the \"General\" tab, complete the \"Name\" and \"Description\" fields.\n4. Configure Flood Protection:\na. In the \"Flood Protection\" tab, select the \"Syn\" check box, in the \"Action\" field, select either \"Random Early Drop\" (preferred in this case) or \"SYN Cookie\"; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \nb. In the \"Flood Protection\" tab, select the \"ICMP\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \nc. In the \"Flood Protection\" tab, select the \"ICMPv6\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \nd. In the \"Flood Protection\" tab, select the \"Other IP\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields. \ne. In the \"Flood Protection\" tab, select the \"UDP\" check box; complete the \"Alert\", \"Activate\", and \"Maximum\" fields.\nf. For each of the \"Alert\", \"Activate\", and \"Maximum\" fields, the appropriate values depends on the expected traffic of the system. \n5. Configure Reconnaissance Protection:\na. In the \"Reconnaissance Protection\" tab, select the \"TCP Port Scan\", \"Host Sweep\", and \"UDP Port Scan\" rows.\nb. Select the action of Block IP.\nc. The Interval and Threshold values can either remain as the default values or they can be changed based on the specific traffic conditions of the network.\n6. Configure Packet Based Attack Protection settings:\na. Select the \"Packet Based Attack Protection\" tab and select the following at a minimum.\nb. IP Drop tab: Select the \"Spoofed IP address\", \"Strict Source Routing\", \"Loose Source Routing\", \"Unknown\", and \"Malformed\".\nc. TCP Drop tab: Select \"Mismatched overlapping TCP segment\" and \"TCP Timestamp\", and for the \"Reject Non-SYN TCP\" field, select \"yes\". For the \"Asymmetric Path\" field, select \"bypass\".\nd. ICMP Drop tab: Select the \"ICMP Ping ID 0, ICMP Fragment\", and \"ICMP Large Packet(>1024)\" check-boxes. The \"Suppress ICMP TTL Expired Error\" and \"Suppress ICMP Frag Needed\" check-boxes can remain unchecked unless this profile will be applied to an internal or DMZ.\ne. IPv6 Drop tab: Select the \"Type 0 Routing Header\", \"IPv4 compatible address\", \"Anycast source address\", \"Needless fragment header\", \"MTU in ICMPv6 'Packet Too Big' less than 1280 bytes\", \"Hop-by-Hop extension\", \"Routing extension\", \"Destination extension\", \"Invalid IPv6 options in extension header\", and \"Non-zero reserved field\" check-boxes.\nf. In the \"ICMPv6\" tab, select the \"ICMPv6 destination unreachable\", \"ICMPv6 packet too big\", \"ICMPv6 time exceeded\", \"ICMPv6 parameter problem\", and \"ICMPv6 redirect\" check-boxes.\ng. Click \"OK\".\n7. Apply the Zone Protection Profile to any zone that includes ingress interfaces to external networks:\na. Select Network >> Zones and select the ingress zone.\nb. In the \"Zone\" window, in the \"Zone Protection Profile\" window, select the configured Zone Protection Profile.\nc. Click \"OK\".\nd. Select Network >> Zones and select the DMZ zone.\ne. In the \"Zone\" window, in the \"Zone Protection Profile\" window, select the configured Zone Protection Profile.\nf. Click \"OK\".\n8. Commit the changes.\n\nTo configure a DoS Protection policy:\n1. Navigate to Objects >> Security Profiles >> DoS Protection.\n2. Select \"Add\" to create a new profile.\n3. In the \"DoS Protection Profile\" window, complete the required fields. For the \"Type\", select \"Classified\".\n4. Configure Flood Protection by enabling each type of flood protection and configuring the following at a minimum:\na. SYN Flood tab: Select \"SYN Cookie\" as the action.\nb. UDP Flood tab: Select \"UDP Flood and complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields.\nc. ICMP Flood tab: Select \"ICMP Flood\" and complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields.\nd. ICMPv6 Flood tab: Select \"ICMPv6 Flood\" and complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields. \ne. Other IP Flood tab: Select \"Other IP Flood\" check box and complete the \"Alarm Rate\", \"Activate Rate\", \"Max Rate\", and \"Block Duration\" fields. \n5. Configure Resources Protection in the Resources Protection tab with the following settings:\na. Select \"Maximum Concurrent Sessions\".\nb. Complete the \"Max Concurrent Sessions\" field. If the DoS profile type is aggregate, this limit applies to the entire traffic hitting the DoS rule on which the DoS profile is applied.\nc. Click \"OK\", and then click \"Commit\".\n6. Create a DoS protection policy.\na. Navigate to Policies >> DoS Protection and select \"Add\" to create a new policy.\nb. In the \"DoS Rule\" Window, complete the required fields.\nc. In the \"General\" tab, complete the \"Name\" and \"Description\" fields.\nd. In the \"Source\" tab, for \"Zone\", select the \"External zone\", and for \"Source Address\", select \"Any\".\ne. In the \"Destination\" tab, \"Zone\", select \"Internal zone\", and for \"Destination Address\", select \"Any\".\nf. In the \"Option/Protection\" tab, for \"Service\", select \"Any\", and for \"Action\", select \"Protect\".\ng. Select the \"Classified\" check-box.\nh. In the \"Profile\" field, select the configured DoS Protection profile for the inbound traffic.\ni. In the \"Address\" field, select destination-ip-only.\nj. Click \"OK\", and then click \"Commit\".","ccis":["CCI-002385","CCI-004866"]},{"vulnId":"V-228861","ruleId":"SV-228861r831603_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.","description":"If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users. \n\nInstallation of content filtering gateways and application-layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume, type, or protocol usage.","checkContent":"Go to Objects >> Security Profiles >> Vulnerability Protection\nIf there are no Vulnerability Protection Profiles configured, this is a finding.\n\nAsk the Administrator which Vulnerability Protection Profile is used for interzone traffic.\nView the configured Vulnerability Protection Profiles.\nCheck the \"Severity\" and \"Action\" columns.\nIf the Vulnerability Protection Profile used for interzone traffic does not block all critical, high, and medium threats, this is a finding.\n\nGo to Policies >> Security\nReview each of the configured security policies in turn.\nFor any Security Policy that affects traffic between Zones (interzone), view the \"Profile\" column.\nIf the \"Profile\" column does not display the  \"Vulnerability Protection Profile\" symbol, this is a finding.","fixText":"To add a Vulnerability Protection Profile:\nGo to Objects >> Security Profiles >> Vulnerability Protection\nSelect \"Add\".\nIn the \"Vulnerability Protection Profile\" window, complete the required fields.\nIn the \"Name\" field, enter the name of the Vulnerability Protection Profile.\nIn the \"Description\" field, enter the description of the Vulnerability Protection Profile.\nIn the \"Rules\" tab, select \"Add\".\nIn the \"Vulnerability Protection Rule\" window, \nIn the \"Rule Name\" field, enter the Rule name,\nIn the \"Threat Name\" field, enter \"any\" (this will match all signatures),\nIn the \"Action\" field, select \"block\".\nIn the \"Host type\" field, select \"any\",\nSelect the checkboxes above the \"CVE\" and \"Vendor ID\" boxes. \nIn the \"Severity\" section, select the \"critical\", \"high\", and \"medium\" check boxes.\nSelect \"OK\".\n\nIn the \"Vulnerability Protection Profile\" window, select the configured rule, then select \"OK\".\nUse the Profile in a Security Policy:\nGo to Policies >> Security\nSelect an existing policy rule or select \"Add\" to create a new one.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Vulnerability Protection\" field, select the configured Vulnerability Protection Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002385"]},{"vulnId":"V-228862","ruleId":"SV-228862r997601_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.","description":"Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.\n\nAccess control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application-level firewalls and web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate.\n\nSecurity policies on the Palo Alto Networks security platform match source, destination, application and a service. The application and service columns specify what applications can be identified on a defined set of ports, or on all available ports. The service column allows administrator to define one of the following:\nApplication-default - The service application-default sets security policy to allow the application on the standard ports associated with the application.\nPre-defined service “service-http” and “service-https” - The pre-defined services use TCP ports 80 and 8080 for HTTP, and TCP port 443 for HTTPS. Use this security policy if you want to restrict web browsing and HTTPS to these ports.\nAny - Use this service to deny applications.\nCustom service - Use this to define TCP/UDP port numbers to restrict applications to specific ports.","checkContent":"Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification or Accreditation Package.\nGo to Policies >> Security; review each of the configured security policies in turn.\nIf any of the policies allows traffic that is not part of the authorized sources and destinations list, this is a finding.","fixText":"To create or edit a Security Policy:\nGo to Policies >> Security.\nSelect \"Add\" to create a new security policy, or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002403","CCI-004891"]},{"vulnId":"V-228863","ruleId":"SV-228863r831605_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must identify and log internal users associated with prohibited outgoing communications traffic.","description":"Without identifying the users who initiated the traffic, it would be difficult to identify those responsible for the prohibited communications. This requirement applies to those network elements that perform Data Leakage Prevention (DLP) (e.g., ALGs, proxies, or application-level firewalls).  \n\nThe Palo Alto Networks Security Platform uses User-ID to map a user's identity to an IP address.  This allows Administrators to configure and enforce firewall policies based on users and user groups in addition to network zones and addresses. If the user changes devices or the device is assigned a different IP address, User-ID tracks those changes and maintains the user to IP address mapping information.  This supports non-repudiation. \n\nBefore a security policy can be written for groups of users, the relationships between the users and the groups they are members of must be established. This information can be retrieved from an LDAP directory, such as Active Directory or eDirectory.","checkContent":"Log into device Command Line Interface.\nEnter the command \"show user ip-user-mapping all\".\nIf the output is blank, this is a finding.\n\nAn alternate means to verify that User-ID is properly configured, view the URL Filtering and Traffic logs is to view the logs.\nTo view the URL Filtering logs:\nGo to Monitor >> Logs >> URL Filtering\n\nTo view the  Traffic logs:\nGo to Monitor >> Logs >> Traffic\n\nUser traffic originating from a trusted zone contains a username in the \"Source User\" column.\nIf the \"Source User\" column is blank, this is a finding.\n\nAlternatively, verify that usernames are displayed in reports.\nGo to Monitor >> Reports\nSelect the \"Denied Applications Report\".\nIf the \"Source User\" fields are empty, this is a finding.","fixText":"User-ID can integrate with the enclave's systems using different methods; therefore, the exact configuration is dependent on the method chosen.  \nDetermine which method User-ID will use to integrate with the enclave's systems - Server Monitoring, Client Probing, Syslog User-ID Agent, Terminal Services Agent, or Captive Portal. \nConfigure how groups and users are retrieved from the directory and which users groups are to be included in policies.\nConfigure the Security Policies that controls traffic from client hosts in the trust zone to the untrust zone.\nGo to Policies >> Security\nSelect \"Add\" to create a new policy or select the Name of the Policy to edit it.\nIn the \"Security Policy Rule\" window, complete the required fields.\nIn the \"General\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" fields.  \nIn the \"User\" tab, select \"any\".\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" fields. \nIn the \"Applications\" tab, select the authorized applications.\nIn the \"Service/URL Category\" tab, select \"application-default\".\nTo add a service, select the \"Service\" check box, select \"Add\" and select a listed service or add a new service or service group.\nIn the \"Actions\" tab, select either \"Deny\" or \"Allow (as required)\" as the resulting action.\nSelect the required Log Setting and Profile Settings as necessary.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002400"]},{"vulnId":"V-228864","ruleId":"SV-228864r831606_rule","severity":"low","ruleTitle":"The Palo Alto Networks security platform must be configured to integrate with a system-wide intrusion detection system.","description":"Without coordinated reporting between separate devices, it is not possible to identify the true scale and possible target of an attack.\n\nIntegration of the Palo Alto Networks security platform with a system-wide intrusion detection system supports continuous monitoring and incident response programs. This requirement applies to monitoring at internal boundaries using TLS gateways, web content filters, email gateways, and other types of ALGs. The Palo Alto Networks security platform can work as part of the network monitoring capabilities to off-load inspection functions from the external boundary IDPS by performing more granular content inspection of protocols at the upper layers of the OSI reference model.\n\nNetFlow is an industry-standard protocol that enables the firewall to record statistics on the IP traffic that traverses its interfaces. The  Palo Alto Networks security platform can export the statistics as NetFlow fields to a NetFlow collector. The NetFlow collector is a server you use to analyze network traffic for security, administration, accounting and troubleshooting purposes.","checkContent":"Go to Device >> Server Profiles >> NetFlow\nIf no NetFlow Server Profiles are configured, this is a finding.\n\nThis step assumes that it is one of the Ethernet interfaces that is being monitored.\nThe verification is the same for Ethernet, VLAN, Loopback and Tunnel interfaces.\nAsk the administrator which interface is being monitored; there may be more than one.\nGo to Network >> Interfaces >> Ethernet\nSelect the interface that is being monitored.\nIf the \"Netflow Profile\" field is \"None\", this is a finding.","fixText":"To create a NetFlow Server Profile:\nGo to Device >> Server Profiles >> NetFlow\nSelect \"Add\".\nIn the \"NetFlow Server Profile\" window, complete the required fields.\nIn the \"Name\" field, enter the name of the NetFlow Server Profile.\nIn the \"Minutes\" field, enter the number of minutes after which the NetFlow template is refreshed. \nIn the \"Packets\" field, enter the number of packets after which the NetFlow template is refreshed.\nIn the \"Active Timeout\" field, enter the frequency (in minutes) the device exports records.\nSelect the \"PAN-OS Field Types\" check box to export \"App-ID\" and \"User-ID\" fields.\nSelect \"Add\" to add a NetFlow collector.\nIn the \"Name\" field, enter the name of the server.\nIn the \"NetFlow Server\" field, enter the hostname or IP address of the server.\nIn the \"Port\" field enter the port used by the NetFlow collector (default 2055).\nSelect \"OK\".\n\nAssign the NetFlow server profile to the interfaces that carry the traffic to be analyzed.  These steps assume that it is one of the Ethernet interfaces.  The configuration is the same for Ethernet, VLAN, Loopback, and Tunnel interfaces.\nGo to Network >> Interfaces >> Ethernet\nSelect the interface that the traffic traverses.\nIn the \"Ethernet Interface\" window, in the \"Netflow Profile\" field, select the configured Netflow Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002656"]},{"vulnId":"V-228865","ruleId":"SV-228865r831607_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must detect use of network services that have not been authorized or approved by the ISSM and ISSO, at a minimum.","description":"Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services.\n\nExamples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.","checkContent":"Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO.\nFor each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic.\n\nIf there is no list of unauthorized network services, this is a finding.\n\nIf there are no configured security policies that specifically match the list of unauthorized network services, this is a finding.\n\nIf the security policies do not deny the traffic associated with the unauthorized network services, this is a finding.","fixText":"To create or edit a Security Policy:\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy, or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002683"]},{"vulnId":"V-228866","ruleId":"SV-228866r831608_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must generate a log record when unauthorized network services are detected.","description":"Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services.\n\nExamples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.","checkContent":"Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO.\nFor each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic.\n \nTo verify if a Security Policy logs denied traffic:\nGo to Policies >> Security\nSelect the name of the security policy to view it.\nIn the \"Actions\" tab, in the \"Log Setting\" section, if neither the \"Log at Session Start\" nor the \"Log at Session End\" check boxes are checked, this is a finding.","fixText":"To configure a Security Policy to log denied traffic:\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy, or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nIn the \"Actions\" tab, select the Log forwarding profile and select \"Log at Session End\".\n\"Log at Session Start\" may be selected under specific circumstances, but \"Log at Session End\" is preferred.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002684"]},{"vulnId":"V-228867","ruleId":"SV-228867r831609_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when unauthorized network services are detected.","description":"Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services.\n\nAutomated mechanisms can be used to send automatic alerts or notifications. Such automatic alerts or notifications can be conveyed in a variety of ways (e.g., telephonically, via electronic mail, via text message, or via websites). The Palo Alto Networks security platform must either send the alert to an SNMP or Syslog console that is actively monitored by authorized personnel (including the ISSO and ISSM) or use e-mail to send the alert directly to designated personnel.","checkContent":"Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO.  For each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic. \nAsk the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).\nView the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.\n\nView the Log Forwarding Profiles:\nGo to Objects >> Log Forwarding\nDetermine which Server Profile is associated with each Log Forwarding Profile.\nView the Security Policies that are used to block unauthorized network services.\nGo to Policies >> Security\nSelect the name of the security policy to view it. \nIn the \"Actions\" tab, in the \"Log Setting\" section, view the Log Forwarding Profile.\nIf there is no Log Forwarding Profile, this is a finding.","fixText":"Configure a Server Profile for use with Log Forwarding Profile(s);  if email is used, the ISSO and ISSM must be recipients.\n   \nTo create an email server profile:\nGo to Device >> Server Profiles >> Email\nSelect \"Add\". \nIn the Email Server Profile, enter the name of the profile.\nSelect \"Add\".\nIn the \"Servers\" tab, enter the required information:\nIn the \"Name\" field, enter the name of the Email server\nIn the \"Email Display Name\" field, enter the name shown in the \"From\" field of the email.\nIn the \"From\" field, enter the From email address.\nIn the \"To\" field, enter the email address of the recipient.\nIn the \"Additional Recipient\" field, enter the email address of another recipient. Only one additional recipient can be added. To add multiple recipients, add the email address of a distribution list.\nIn the \"Gateway\" field, enter the \"IP address\" or \"host name\" of the Simple Mail Transport Protocol (SMTP) server used to send the email.\nSelect the \"OK\" button.\n\nConfigure a Log Forwarding Profile:\nGo to Objects >> Log Forwarding\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nIn the \"Actions\" tab, select the Log forwarding profile and select \"Log at Session End\".\n\"Log at Session Start\" may be selected under specific circumstances, but \"Log at Session End\" is preferred.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002684"]},{"vulnId":"V-228868","ruleId":"SV-228868r831610_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must continuously monitor inbound communications traffic crossing internal security boundaries.","description":"If inbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs.\n\nInternal monitoring includes the observation of events occurring on the network crosses internal boundaries at managed interfaces such as web content filters. Depending on the type of ALG, organizations can monitor information systems by monitoring audit activities, application access patterns, characteristics of access, content filtering, or unauthorized exporting of information across boundaries. Unusual/unauthorized activities or conditions may include large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses.\n\nMost current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database.  The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.","checkContent":"Obtain the network architecture diagrams and identify where traffic crosses from one internal zone to another and review the configuration of the Palo Alto Networks security platform.  \nThe specific security policy is based on the authorized endpoints, applications, and protocols.\n\nIf it does not monitor traffic passing between zones, this is a finding.","fixText":"The network architecture diagrams must identify where traffic crosses from one internal zone to another. The specific security policy is based on the authorized endpoints, applications, and protocols.\n\nTo create or edit a Security Policy:\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy, or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002661"]},{"vulnId":"V-228869","ruleId":"SV-228869r831611_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must continuously monitor outbound communications traffic crossing internal security boundaries.","description":"If outbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs.\n\nInternal monitoring includes the observation of events occurring on the network crosses internal boundaries at managed interfaces such as web content filters. Depending on the type of ALG, organizations can monitor information systems by monitoring audit activities, application access patterns, characteristics of access, content filtering, or unauthorized exporting of information across boundaries. Unusual/unauthorized activities or conditions may include large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses.\n\nMost current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database.  The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.","checkContent":"Obtain the network architecture diagrams and identify where traffic crosses from one internal zone to another and review the configuration of the Palo Alto Networks security platform.\n\nIf it does not monitor traffic passing between zones, this is a finding.","fixText":"The network architecture diagrams must identify where traffic crosses from one internal zone to another.  The specific security policy is based on the authorized endpoints, applications, and protocols.\n\nTo create or edit a Security Policy:\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002662"]},{"vulnId":"V-228870","ruleId":"SV-228870r971533_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when threats identified by authoritative sources (e.g., IAVMs or CTOs) are detected.","description":"Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.\n\nThe device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.\n\nAlerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.\n\nCurrent USSTRATCOM warning and tactical directives/orders include Fragmentary Order (FRAGO), Communications Tasking Orders (CTOs), IA Vulnerability Notices, Network Defense Tasking Message (NDTM), DOD GIG Tasking Message (DGTM), and Operations Order (OPORD).","checkContent":"Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).\n\nView the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.\n \nView the Log Forwarding Profiles; this is under Objects >> Log Forwarding.  Determine which Server Profile is associated with each Log Forwarding Profile.\nView the Security Policies that are used to enforce policies issued by authoritative sources.\nGo to Policies >> Security; select the name of the security policy to view it. \nIn the Actions tab, in the Log Setting section, view the Log Forwarding Profile.  If there is no Log Forwarding Profile, this is a finding.","fixText":"Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.\n   \nTo create an email server profile:\nGo to Device >> Server Profiles >> Email\nSelect \"Add\". \nIn the Email Server Profile, enter the name of the profile.\nSelect \"Add\".\nIn the \"Servers\" tab, enter the required information:\nIn the \"Name\" field, enter the name of the Email server\nIn the \"Email Display Name\" field, enter the name shown in the From field of the email.\nIn the \"From\" field, enter the From email address.\nIn the \"To\" field, enter the email address of the recipient.\nIn the \"Additional Recipient\" field, enter the email address of another recipient. Only one additional recipient can be added. To add multiple recipients, add the email address of a distribution list.\nIn the \"Gateway\" field, enter the IP address or host name of the Simple Mail Transport Protocol (SMTP) server used to send the email.\nSelect the \"OK\" button.\n\nConfigure a Log Forwarding Profile:\nGo to Objects >> Log Forwarding\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy or select the name of the security policy to edit it. \nConfigure the specific parameters of the policy by completing the required information in the fields of each tab.\nIn the \"Actions\" tab, select the Log forwarding profile and select \"Log at Session End\".  \"Log at Session Start\" may be selected under specific circumstances, but \"Log at Session End\" is preferred.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002664"]},{"vulnId":"V-228871","ruleId":"SV-228871r971533_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when rootkits or other malicious software which allows unauthorized privileged access is detected.","description":"Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.\n\nThe Palo Alto Networks security platform generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.\n\nSince these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.\n\nCJCSM 6510.01B, \"Cyber Incident Handling Program\", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.\n\nCategory 1; Root Level Intrusion (Incident)-Unauthorized privileged access to an IS.\nCategory 4; Malicious Logic (Incident)-Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user.\n\nAlerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.","checkContent":"Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).\nView the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.\n\nView the Log Forwarding Profiles:\nGo to Objects >> Log Forwarding\nDetermine which Server Profile is associated with each Log Forwarding Profile.\nView the Security Policies that are used to filter traffic into the Internal or DMZ zones.\n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.\nIf the \"Profile\" column does not display the \"Vulnerability Protection Profile\" symbol, this is a finding.\nIf the \"Profile\" column does not display the \"Anti-spyware\" symbol (which looks like a magnifying glass on a shield), this is a finding.\nIf the \"Options\" column does not display the \"Log Forwarding Profile\" symbol, this is a finding.","fixText":"This requires the use of an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile.\nConfigure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.\n\nConfigure a Log Forwarding Profile:\nGo to Objects >> Log Forwarding\nConfigure an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile in turn.  Note: A custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile.  The selected Anti-spyware Profile must use the block action at the critical, high, and medium severity threat levels.  \nUse the Antivirus Profile, Anti-spyware Profile, and the Vulnerability Protection Profile in a Security Policy that filters traffic to Internal and DMZ zones;\nGo to Policies >> Security\nSelect an existing policy rule or select \"Add\" to create a new one.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Antivirus\" field, select the configured Antivirus Profile.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Anti-spyware\" field, select the configured or Strict Anti-spyware Profile.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Vulnerability Protection\" field, select the configured Vulnerability Protection Profile.\nIn the \"Actions\" tab in the \"Log Setting\" section, select \"Log At Session End\".  This generates a traffic log entry for the end of a session and logs drop and deny entries.  \nIn the \"Actions\" tab in the \"Log Setting\" section; in the \"Log Forwarding field\", select the log forwarding profile from drop-down list.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002664"]},{"vulnId":"V-228872","ruleId":"SV-228872r1056123_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when rootkits or other malicious software that allows unauthorized nonprivileged access is detected.","description":"Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.\n\nThe device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.\n\nSince these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.\n\nCJCSM 6510.01B, \"Cyber Incident Handling Program\", lists nine Cyber Incident and Reportable Event Categories. DOD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.\n\nAlerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.","checkContent":"Ask the Administrator how the ISSO and ISSM are receiving alerts (email, SNMP Trap, or Syslog).\n\nView the configured Server Profile. If there is no Server Profile for the method explained, this is a finding.\n\nView the Log Forwarding Profiles:\n1. Go to Objects >> Log Forwarding.\n2. Determine which Server Profile is associated with each Log Forwarding Profile.\n3. View the Security Policies that are used to filter traffic into the Internal or DMZ zones.\n4. Verify the \"Profile\" column displays the \"Antivirus Profile\" symbol, the \"Vulnerability Protection Profile\" symbol, and the \"Anti-spyware\" symbol (which looks like a magnifying glass on a shield).\n\nIf the \"Profile\" column does not display the symbols noted above, this is a finding.\n\nAlternatively, verify an Antivirus, an Anti-spyware, and a Vulnerability Protection Profile are included in the actively used profile group that is referenced by the Security policy rule. \n\nIf the required profiles are not configured, this is a finding.","fixText":"This requires the use of an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile.\n1. Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.\n2. Configure a Log Forwarding Profile:\nGo to Objects >> Log Forwarding.\n3. Configure an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile in turn.\n\nNote: A custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. The selected Anti-spyware Profile must use the block action at the critical, high, and medium severity threat levels.\n\nUse the Antivirus Profile, Anti-spyware Profile, and Vulnerability Protection Profile in a Security Policy that filters traffic to Internal and DMZ zones:\n1. Go to Policies >> Security.\n2. Select an existing policy rule or select \"Add\" to create a new one.\n3. In the \"Actions\" tab in the \"Profile Setting\" section, in the \"Profile Type\" field, select \"Profiles\". The window will change to display the different categories of Profiles.\n4. In the \"Actions\" tab in the \"Profile Setting\" section, in the \"Antivirus\" field, select the configured Antivirus Profile.\n5. In the \"Actions\" tab in the \"Profile Setting\" section, in the \"Anti-spyware\" field, select the configured or Strict Anti-spyware Profile.\n6. In the \"Actions\" tab in the \"Profile Setting\" section, in the \"Vulnerability Protection\" field, select the configured Vulnerability Protection Profile.\n7. In the \"Actions\" tab in the \"Log Setting\" section, select \"Log At Session End\". This generates a traffic log entry for the end of a session and logs drop and deny entries.\n8. In the \"Actions\" tab in the \"Log Setting\" section, in the \"Log Forwarding\" field, select the log forwarding profile from the drop-down list.\n9. Select \"OK\".\n10. Commit changes by selecting \"Commit\" in the upper-right corner of the screen.\n11. Select \"OK\" when the confirmation dialog appears.","ccis":["CCI-002664"]},{"vulnId":"V-228873","ruleId":"SV-228873r1028365_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must generate a log record that can be used to send an alert to, at a minimum, the information system security officer (ISSO) and information system security manager (ISSM) when denial-of-service (DoS) incidents are detected.","description":"Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.\n\nCJCSM 6510.01B, \"Cyber Incident Handling Program\", lists nine Cyber Incident and Reportable Event Categories. DOD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.\n\nAlerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel. Configure a Server Profile for use with Log Forwarding Profile(s);if email is used, the ISSO and ISSM must be recipients.\n\nSome sites have discovered that, when configuring Zone Protection, if the \"Log Setting\" is not configured for the zones where Zone Protection is applied (i.e., Log Setting is set to \"None\"), then the \"Log Setting\" column will show blank for those zone under Network >> Zones, and alerts for Zone Protection events will not be sent. Thus, alternative mitigations have been provided to meet this requirement.","checkContent":"Ask the Administrator how the ISSO and ISSM are receiving alerts (email, SNMP Trap, or Syslog).\nView the configured Server Profile:\nGo to Device >> Server Profile.\nIf there is no Server Profile for the method explained, this is a finding.\n\nView the Log Forwarding Profiles:\nGo to Objects >> Log Forwarding.\nDetermine which Server Profile is associated with each Log Forwarding Profile.\nIf there are no Log Forwarding Profiles configured, this is a finding.\nGo to Policies >> DoS Protection.\nIf there are no DoS Protection Policies, this is a finding. There may be more than one configured DoS Protection Policy.\nIf there is no such DoS Protection Policy, this is a finding.\nIn the \"Log Forwarding\" field, if there is no configured Log Forwarding Profile, this is a finding.\n\nAlternately, a Zone Protection Profile can be used either instead of, or in addition to, a DoS Protection Policy.\nAsk the Administrator how the ISSO and ISSM are receiving alerts (e-mail, SNMP Trap, or Syslog).\nView the configured Server Profile. If there is no Server Profile for the method explained, this is a finding.\n\nView the Log Forwarding Profiles:\nGo to Objects >> Log Forwarding.\nDetermine which Server Profile is associated with each Log Forwarding Profile.\nIf there are no Log Forwarding Profiles configured, this is a finding.\n\nNavigate to Network >> Zones.\nIf the \"Zone Protection Profile\" column for all zones is blank, this is a finding.\n\nFor each zone with the \"Zone Protection Profile\" column configured, if the \"Log Setting\" column is blank, this is a finding.","fixText":"Configure a Log Forwarding Profile:\nGo to Objects >> Log Forwarding.\nGo to Policies >> DoS Protection.\nSelect \"Add\" to create a new policy or select the Name of the Policy to edit it.\nIn the \"DoS Rule\" Window, complete the required fields.\nIn the \"Option/Protection\" tab, in the \"Log Forwarding\" field, select the configured Log Forwarding Profile.\nSelect \"OK\".\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.\n\nAlternately, a Zone Protection Profile can be used either instead of or in addition to a DoS Protection Policy.\nGo to Network>>Zone.\nSelect “Add” or select an existing Zone.\nIn the Zone window, in the Zone Protection Profile field, select or create a Zone Protection Profile.\nConfigure the applicable fields in the Flood Protection, Reconnaissance Protection, and Packet Based Attack Protection as needed.\nIn the Zone window, in the Log Setting field, select a configured log forwarding profile.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002664"]},{"vulnId":"V-228874","ruleId":"SV-228874r971533_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must generate an alert to, at a minimum, the ISSO and ISSM when new active propagation of malware infecting DoD systems or malicious code adversely affecting the operations and/or security of DoD systems is detected.","description":"Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.\n\nThe device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.\nSince these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.\n\nCJCSM 6510.01B, \"Cyber Incident Handling Program\", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.\n\nAlerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.","checkContent":"Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).\n\nView the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.\n\nView the Log Forwarding Profiles:\nGo to Objects >> Log Forwarding\nDetermine which Server Profile is associated with each Log Forwarding Profile.\nView the Security Policies that are used to filter traffic between zones or subnets.\n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.\n\nIf the \"Options\" column does not display the \"Log Forwarding Profile\" symbol, this is a finding.","fixText":"Configure a Server Profile for use with Log Forwarding Profile(s);  if email is used, the ISSO and ISSM must be recipients.\n   \nConfigure a Log Forwarding Profile:\nGo to Objects >> Log Forwarding\nGo to Objects >> Security Profiles >> Antivirus\nSelect \"Add\" to create a new Antivirus Profile or select the name of the profile to edit it.\n\nUse the Antivirus Profile in a Security Policy:\nGo to Policies >> Security\nSelect an existing policy rule or select \"Add\" to create a new one.\nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Antivirus\" field, select the configured Antivirus Profile.\nSelect \"OK\".\n\nIn the \"Actions\" tab in the \"Log Setting\" section, select \"Log At Session End\".  \nIn the \"Actions\" tab in the \"Log Setting\" section; in the \"Log Forwarding\" field, select the log forwarding profile from drop-down list.\nSelect \"OK\".\n\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-002664"]},{"vulnId":"V-228875","ruleId":"SV-228875r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must block traceroutes and ICMP probes originating from untrusted networks (e.g., ISP and other non-DoD networks).","description":"Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can give configuration details about the network element.\n\nThe traceroute utility will display routes and trip times on an IP network.  An attacker can use traceroute responses to create a map of the subnets and hosts behind the boundary.  The traditional traceroute relies on TTL - time exceeded responses from network elements along the path and an ICMP port-unreachable message from the target host. In some Operating Systems such as UNIX, trace route will use UDP port 33400 and increment ports on each response.  Since blocking these UDP ports alone will not block trace route capabilities along with blocking potentially legitimate traffic on a network, it's unnecessary to block them explicitly.  Because traceroutes typically rely on ICMP Type 11 - Time exceeded message, the time exceeded message will be the target for implicitly or explicitly blocking outbound from the trusted network.","checkContent":"Ask the Administrator which Security Policy blocks traceroutes and ICMP probes.\n\nGo to Policies >> Security\nView the identified Security Policy.\n\nIf the \"Source Zone\" field is not external and the \"Source Address\" field is not any, this is a finding.\n\nIf the \"Destination Zone\" fields do not include the internal and DMZ zones and the \"Destination Address\" field is not any, this is a finding.\n\nNote: The exact number and name of zones is specific to the network.\n\nIf the \"Application\" fields do not include \"icmp\", \"ipv6-icmp\", and \"traceroute\", this is a finding.\n\nIf the \"Actions\" field does not show \"Deny\" as the resulting action, this is a finding.","fixText":"Although the default inter-zone Security Policy will deny this traffic, a specific Security Policy should be used.\n\nTo configure the security policy:\nGo to Policies >> Security\nSelect \"Add\".\nIn the \"Security Policy Rule\" window, complete the required fields.\nIn the \"General\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" fields.\nFor the \"Source Zone\" field, select \"external\". \nFor the \"Source Address\" field, select \"any\".\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" fields. \nFor the \"Destination Zone\" field, select the internal and DMZ zones.  Note: The exact number and name of zones are specific to the network.\nFor the \"Destination Address\" field, select \"any\".\nIn the \"Applications\" tab, select \"icmp\", \"ipv6-icmp\", \"traceroute\".\nIn the \"Actions tab\", select \"Deny\" as the resulting action.  Select the required Log Setting and Profile Settings as necessary.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001314"]},{"vulnId":"V-228876","ruleId":"SV-228876r831617_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes.","description":"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.","checkContent":"If the Palo Alto Networks security platform does not provide encryption intermediary services (e.g., HTTPS or TLS), this is not applicable.\n\nUse the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command \"show fips-mode\" or the command show fips-cc (for more recent releases).\n\nIf fips-mode or fips-cc is set to off, this is a finding.","fixText":"Power off the device by unplugging it from the electrical outlet.\n \nConnect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.\n \nThe serial parameters are \"9600 baud\", \"8 data bits\", \"no parity\", and \"1 stop bit\".\n \nA USB to serial adapter will be necessary if the computer does not have a serial port.\n\nDuring the boot sequence, this message will appear:\n\nAutoboot to default partition in 5 seconds.\n\nEnter \"maint\" to boot to \"maint\" partition.\n\nEnter \"maint\" to enter maintenance mode.\n\nPress \"Enter\", and the \"Maintenance Recovery tool\" menu will appear.\n\nSelect \"Set FIPS Mode\" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode.\n\nNote: This will remove all installed licenses and disable the serial port.","ccis":["CCI-002450"]},{"vulnId":"V-228877","ruleId":"SV-228877r831618_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform, if used for TLS/SSL decryption, must use NIST FIPS-validated cryptography to implement encryption.","description":"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.","checkContent":"If the Palo Alto Networks security platform is not used for TLS/SSL decryption, this is not applicable.\n\nUse the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command \"show fips-mode\" or the command show fips-cc (for more recent releases).\n\nIf fips mode is set to off, this is a finding.","fixText":"Power off the device by unplugging it from the electrical outlet.\n \nConnect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.\n \nThe serial parameters are \"9600 baud\", \"8 data bits\", \"no parity\", and \"1 stop bit\".\n \nA USB to serial adapter will be necessary if the computer does not have a serial port.\n\nDuring the boot sequence, this message will appear:\n\nAutoboot to default partition in 5 seconds.\n\nEnter \"maint\" to boot to \"maint\" partition.\n\nEnter \"maint\" to enter maintenance mode.\n\nPress \"Enter\", and the \"Maintenance Recovery tool\" menu will appear.\n\nSelect \"Set FIPS Mode\" (or fips-cc for later versions) from the menu; once the device has finished rebooting, it will be in FIPS mode.\n\nNote: This will remove all installed licenses and disable the serial port.","ccis":["CCI-002450"]},{"vulnId":"V-228878","ruleId":"SV-228878r831619_rule","severity":"low","ruleTitle":"The Palo Alto Networks security platform must, at a minimum, off-load threat and traffic log records onto a centralized log server in real time.","description":"Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised.\n\nOff-loading is a common process in information systems with limited audit storage capacity. The audit storage on the Palo Alto Networks security platform is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time, which indicates that the time from event detection to off-loading is seconds or less. For the purposes of this requirement, the terms \"real time\" and \"near-real time\" are equivalent.\n\nThis does not apply to audit logs generated on behalf of the device itself (management).","checkContent":"To view a syslog server profile:\nGo to Device >> Server Profiles >> Syslog\n\nIf there are no Syslog Server Profiles present, this is a finding.\n\nSelect each Syslog Server Profile; if no server is configured, this is a finding.\n\nView the log-forwarding profile to determine which logs are forwarded to the syslog server.\nGo to Objects >> Log forwarding\n\nIf no Log Forwarding Profile is present, this is a finding.\n\nThe  \"Log Forwarding Profile\" window has five columns.  If there are no Syslog Server Profiles present in the \"Syslog\" column for the Traffic Log Type, this is a finding.\n\nIf there are no Syslog Server Profiles present for each of the severity levels of the Threat Log Type, this is a finding.\n\nGo to Device >> Log Settings >> System Logs\nThe list of Severity levels is displayed.\n\nIf any of the Severity levels does not have a configured Syslog Profile, this is a finding.\n\nGo to Device >> Log Settings >> Config Logs\n\nIf the \"Syslog field\" is blank, this is a finding.","fixText":"To create a syslog server profile:\nGo to Device >> Server Profiles >> Syslog\nSelect \"Add\". \nIn the Syslog Server Profile, enter the name of the profile.\nSelect \"Add\".\nIn the \"Servers\" tab, enter the required information.\nName: Name of the syslog server\nServer: Server IP address where the logs will be forwarded to\nPort: Default port 514\nFacility: Select from the drop-down list.\nSelect the \"OK\" button.\n\nAfter you create the Server Profiles that define where to send the logs, log forwarding must be enabled. \nThe way forwarding is enabled depends on the log type:\nTraffic Logs-Enable forwarding of Traffic logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) and adding it to the security policies to trigger the log forwarding. Only traffic that matches a specific rule within the security policy will be logged and forwarded.\n\nConfigure the log-forwarding profile to select the logs to be forwarded to syslog server.\nGo to Objects >> Log forwarding\nThe \"Log Forwarding Profile\" window appears.  Note that it has five columns.\nIn the \"Syslog\" column, select the syslog server profile for forwarding threat logs to the configured server(s).\nSelect the \"OK\" button.\n\nWhen the \"Log Forwarding Profile\" window disappears, the screen will show the configured log-forwarding profile.\nThreat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels to forward and then adding it to the security policies for which to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection).\n\nConfigure the log-forwarding profile to select the logs to be forwarded to syslog server.\nGo to Objects >> Log forwarding\nThe \"Log Forwarding Profile\" window appears.  Note that it has five columns.\nIn the \"Syslog\" column, select the syslog server profile for forwarding threat logs to the configured server(s).\nSelect the \"OK\" button.\n\nWhen the \"Log Forwarding Profile\" window disappears, the screen will show the configured log-forwarding profile.\nFor Traffic Logs and Threat Logs, use the log forwarding profile in the security rules.\nGo to Policies >> Security Rule\nSelect the rule for which the log forwarding needs to be applied. Apply the security profiles to the rule.\nGo to Actions >> Log forwarding\nSelect the log forwarding profile from drop-down list.\nCommit changes by selecting \"Commit\" in the upper-right corner of the screen.\nSelect \"OK\" when the confirmation dialog appears.","ccis":["CCI-001851"]},{"vulnId":"V-228879","ruleId":"SV-228879r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must inspect inbound and outbound SMTP and Extended SMTP communications traffic (if authorized) for protocol compliance and protocol anomalies.","description":"Application protocol anomaly detection examines application layer protocols such as SMTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound SMTP and Extended SMTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.","checkContent":"If SMTP or ESMTP is authorized, ask the Administrator which Security Policy inspects authorized SMTP and ESMTP traffic.\nGo to Policies >> Security\nSelect the identified Security Policy.\n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.\n\nIf the \"Profile\" column does not display the \"Vulnerability Protection Profile\" symbol, this is a finding.","fixText":"If SMTP or ESMTP is authorized, configure a security policy to allow it and inspect it.\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy or select the name of the security policy to edit it.\nIn the \"Security Policy Rule\" window, complete the required fields.\nIn the \"Name\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" fields.\nIn the \"User\" tab, complete the \"Source User\" and \"HIP Profile\" fields.\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" fields.\nIn the \"Applications\" tab, either select the \"Any\" check box or add SMTP.  Configured filters and groups can be selected if the group includes SMTP.\nIn the \"Actions\" tab, select \"allow\".  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Profile Setting\" section; in each of the \"Profile\" fields, select the configured Profile.\nNote: An Antivirus Profile and an Antispyware Profile are required.","ccis":["CCI-001125","CCI-000366"]},{"vulnId":"V-228880","ruleId":"SV-228880r864182_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must inspect inbound and outbound FTP and FTPS communications traffic (if authorized) for protocol compliance and protocol anomalies.","description":"Application protocol anomaly detection examines application layer protocols such as FTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound FTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.","checkContent":"If the protocol is not used in the implementation, this is not a finding.\n\nGo to Policies >> Decryption\nIf there are no configured Decryption Policies, this is a finding.\n\nAsk the Administrator which Security Policy inspects authorized FTP traffic.\nGo to Policies >> Security\nSelect the identified Security Policy.\n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.\n\nIf the \"Profile\" column does not display the \"Vulnerability Protection Profile\" symbol, this is a finding.","fixText":"If FTP and FTPS is authorized for use in the site's System Security Plan (SSP), configure a security policy to allow it and inspect it.\n\nSince Secure File Transfer Protocol is a form of FTP that adds TLS and SSL cryptographic protocols, it is necessary to decrypt TLS in order for the device to inspect the FTP stream.\nGo to Policies >> Decryption\nSelect \"Add\".\nIn the \"Decryption Policy Rule\" window, complete the required fields.\nIn the \"Name\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" or \"Source User\" fields.\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" or \"Destination User\" fields.\nIn the \"Option\" tab, select \"Decrypt\" as the Action.  Select the decryption profile.\nIn the \"Type\" field, there are three options; \nSelect \"SSL Forward Proxy to decrypt and inspect SSL/TLS traffic from internal users to outside networks\".\nSelect \"SSH Proxy to decrypt inbound and outbound SSH connections passing through the device\".\nSelect \"SSL Inbound Inspection to decrypt and inspect incoming SSL traffic\".  Note: This decryption mode can only work if you have control on the internal server certificate to import the Key Pair on Palo Alto Networks Device.\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy or select the name of the security policy to edit it.\nIn the \"Security Policy Rule\" window, complete the required fields.\nIn the \"Name\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" fields.\nIn the \"User\" tab, complete the \"Source User\" and \"HIP Profile\" fields.\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" fields.\nIn the \"Applications\" tab, either select the \"Any\" check box or add \"ftp\", \"tftp\", and \"gridftp\".  Configured filters and groups can be selected if the group includes these protocols.\nIn the \"Actions\" tab, select \"allow\".  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Profile Setting\" section; in each of the Profile fields, select the configured Profile.\nNote: An Antivirus Profile and an Antispyware Profile are required.","ccis":["CCI-001125","CCI-000366"]},{"vulnId":"V-228881","ruleId":"SV-228881r557387_rule","severity":"medium","ruleTitle":"The Palo Alto Networks security platform must inspect inbound and outbound HTTP traffic (if authorized) for protocol compliance and protocol anomalies.","description":"Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound HTTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.\n\nAll inbound and outbound traffic, including HTTPS, must be inspected. However, the intention of this policy is not to mandate HTTPS inspection by the device. Typically, HTTPS traffic is inspected either at the source, destination, and/or is directed for inspection by an organization-defined network termination point.","checkContent":"Ask the Administrator which Security Policy inspects authorized HTTP traffic.\nGo to Policies >> Security\nSelect the identified Security Policy.\n\nIf the \"Profile\" column does not display the \"Antivirus Profile\" symbol, this is a finding.\n\nIf the \"Profile\" column does not display the \"Vulnerability Protection Profile\" symbol, this is a finding.","fixText":"If HTTP is authorized, configure a security policy to allow it and inspect it.\nGo to Policies >> Security\nSelect \"Add\" to create a new security policy or select the name of the security policy to edit it.\nIn the \"Security Policy Rule\" window, complete the required fields.\nIn the \"Name\" tab, complete the \"Name\" and \"Description\" fields.\nIn the \"Source\" tab, complete the \"Source Zone\" and \"Source Address\" fields.\nIn the \"User\" tab, complete the \"Source User\" and \"HIP Profile\" fields.\nIn the \"Destination\" tab, complete the \"Destination Zone\" and \"Destination Address\" fields.\nIn the \"Applications\" tab, either select the \"Any\" check box or add web-browsing.  Configured filters and groups can be selected if the group includes web-browsing.\nIn the \"Actions\" tab, select \"allow\".  \nIn the \"Actions\" tab in the \"Profile Setting\" section; in the \"Profile Type\" field, select \"Profiles\".  The window will change to display the different categories of Profiles.  \nIn the \"Profile Setting\" section; in each of the Profile fields, select the configured Profile.\nNote: An Antivirus Profile and an Antispyware Profile are required.","ccis":["CCI-000366","CCI-001125"]}]}