Month: April 2016

We’ve just announced the newest release of our operating system, PAN-OS 7.1. You can read all of the details about this new release but, for our government customers, I wanted to highlight a few particular things that you have been talking about and deploying.

1. Extending Our VM-Series Private Cloud Support to Hyper-V and Azure

Our government customers are using a breadth of hypervisors within their virtualized data centers, or private clouds. With the release of PAN-OS 7.1, we extend our cloud support to include all major virtualization environments, including VMware, KVM/OpenStack, Amazon Web Services (AWS) and Microsoft with our VM-Series. In fact, a large Western military organization recently chose one of these hypervisor environments for its network, taking full advantage of Palo Alto Networks support for Hyper-V. Other large Western civilian governments have chosen Palo Alto Networks to secure their Microsoft Azure environments.

2. Full Visibility for PFS/SSL Encrypted Communications

Are you thinking about the many encrypted communications that could bring threats into your environments? Hopefully by now you’ve got a plan to decrypt those communications with our onboard SSL decryption (you can read more about how we support SSL decryption for governments in our Uncover SSL-Encrypted Attacks in Government Networks white paper). With this new release, we’re providing PFS/SSL decryption for ECDSA for SSL Forward Proxy. For U.S. and U.K. government customers, this adds yet another capability to the many we support for Suite B crypto ciphers.

3. Five-Minute Signatures and Dynamic Blocking for Highly Targeted Government Networks

The rate at which our government networks are attacked is staggering. So government agencies appreciate that Palo Alto Networks already highly automates the prevention of threats across their networks. Civilian agencies and military services tell us every day how better-protected they are when they turn on their Palo Alto Networks Next-Generation Security Platform. With PAN-OS 7.1, we’ve further reduced the time WildFire takes to identify and prevent zero-day threats to five minutes. In addition, WildFire can analyze Mac OS binaries, so malware that targets Apple products can be prevented. And newly discovered phishing websites are now categorized within 30 minutes. WildFire analyzes email links for indicators of phishing, such as spoofed URLs and credential-seeking form fields, and updates PAN-DB within 30 minutes. For URLs and DNS, we’ve added more block lists. In addition to the block lists based on IP addresses, you can now have URL and DNS block lists.

Note that if you’re attending Ignite 2016, we hope you’ll be participating in Cyber Range. Cyber Range participants will get real, hands-on experience with WildFire as the teams compete to mitigate actual single-vector and multi-vector attacks. If you didn’t get a seat at Cyber Range this year, don’t worry. Ignite 2016 attendees can still observe the teams as they compete to see who can prevent threats the fastest.

4. Deploying on Ships, Tanks, and Elsewhere? Offline NSX Registration

There are numerous examples of how Palo Alto Networks platforms are supporting these tactical deployments. With this release, you can now complete NSX registration offline, which our customers told us is important for their tactical environments.

5. Consolidating Your Insights on IOCs: Consolidated Log Viewer

And speaking of all of those threats hitting government networks today, we’ve consolidated threat, traffic and WildFire logs for you into a single view. We hope you’re already using AutoFocus for your threat intelligence analysis. Now you can query from within AutoFocus across all of our threat insights to simplify the task of tracking an IOC or IP address. You also can query all of your appliances across the network for potential artifacts.

6. Certifications for Government: FIPS 140 and Common Criteria

With PAN-OS 7.1, our government customers are getting FIPS-140 certifications for Panorama, Log Collector and Offline PAN-DB. You’ll also appreciate our compliance with the VPN Gateway Extended Package and the IPsec VPN Gateway Security Characteristics. Finally, for those U.S. agencies having to comply with the DISA Security Technical Implementation Guides (STIGs) for information assurance, you’re getting last login time, last unsuccessful login, accept login banner verification, and classification banners.

Want to learn more? We hope to see you at Ignite 2016, where you’ll learn more about all of these new features in PAN-OS 7.1. But don’t worry if you can’t make it. If you’re a U.S. government agency, we’ll see you at our annual Federal Forum in Washington, D.C. This year’s Federal Forum will be held July 16 at the Newseum. See you there!

For more information, please visit our Technical Documentation page or any of the following resources:

• Azure
• Hyper-V
• PFS
• 5 minutes

Pamela Warren

[Palo Alto Networks Research Center]

You all knew we were just getting warmed up, right?

Tuesday at Ignite 2016 kicked into high gear with dazzling performances of dance and rap – complete with high-energy choreography and glow-in-the-dark lights. In between came the all-star succession of general session headliners, including our own Mark McLaughlin and Lee Klarich.

Following their presentations came a fireside chat between CSI TV franchise creator Anthony Zuiker and actor and former White House official Kal Penn. There were plenty of laughs and a few lighter moments when it came to how cybersecurity gets the “Hollywood treatment,” but Zuiker and Penn also took a few minutes to highlight the importance of cybersecurity education for children – paramount for a generation that grew up with the Internet as a given. They were all followed by the inimitable Nir Zuk, keying in on the importance of prevention and the power of the Next-Generation Security Platform.

Check out the video recap of today’s Ignite action, including highlights from the general session, what resonated with members of our live audience of more than 3,000 security professionals and partners, and the winners of the first of our Cyber Range exercise. And read on for details of the general session and the day’s announcements.

What We Mean By Prevention 

As Mark, Lee and Nir noted, a cybersecurity mindset of detection and remediation is futile in the face of advanced attackers who get ever more creative in the ways they can successfully breach networks and steal critical information. As Mark noted, preventing breaches is in many ways a math problem: figuring out how to interdict the attack lifecycle at each of its stages.

What that means for the industry, as Lee explained, is a true platform that can provide complete visibility, reduce the attack surface area, prevent all known threats, and prevent new threats. And not only do those four things, but in such a way that capabilities are natively integrated to work together, are applied consistently to all users, applications and locations, and offer automated discovery and reprogramming of both the network and endpoint to prevent known and unknown threats.

Hence: the Palo Alto Networks Next-Generation Security Platform – updates to which we announced today in the form of PAN-OS 7.1 and which Lee described in detail. (Watch this space for a lot more on PAN-OS 7.1 in the coming days.)

Today’s Announcements:

• Announcing PAN-OS 7.1: Extending Breach Prevention to the Cloud

Coming Up Tomorrow:

• Our second Cyber Range exercise, sponsored by The Economist. Join us in the exhibit hall for all the action or follow along at #IgniteRanger!
• A final day of training and breakout sessions, including our track intended for CISOs and C-level executives managing cyber risk
• PCNSE6, PCNSE7 and PSE: Platform Professional exams in Brera 3, 4 and 5

Stay Social!

Follow @Ignite_Conf and use #igniteconf16 for the latest from today’s sessions and to get a look ahead to our final day. Keep an eye on our Facebook gallery for new photos. And have a look at what people here at Ignite 2016 are saying about their experiences:

Chad Berndtson

[Palo Alto Networks Research Center]

The demand for business to be more agile to meet customer demands and stay competitive is driving a change in the way applications are developed, deployed and adopted. Applications, workloads, and the data that go with them are becoming more distributed among varying environments, including physical networks, virtual private clouds, migrations to public clouds as hybrid deployments or dedicated public clouds, and Software as a Service applications (SaaS). Each type of environment brings its own unique agility benefits – and security issues.

The challenge has become balancing the agility needs of the business with improving the security of the applications and, more importantly, the security of the data as it moves between the various clouds. Gaining visibility and preventing attackers from getting access to data, both from an external location and through a lateral attack, becomes imperative across all of the locations where the applications and data reside. And it has to be done without adding additional complexity or cost to the business.

Today, we’re announcing PAN-OS 7.1 with a set of important advancements to the Palo Alto Networks Next-Generation Security Platform that are designed to extend the breach prevention capabilities of the platform and address the security needs of businesses working with cloud-based environments and SaaS applications. Read on to find out what’s new in PAN-OS 7.1. 

Securing Any Cloud

PAN-OS 7.1 adds even greater public cloud capabilities for the VM-Series with Microsoft Azure support. When combined with the physical firewalls and Aperture SaaS security, the addition of support for Azure enables the most complete security portfolio for Microsoft environments. Private cloud deployments are also expanded with support for Microsoft Hyper-V, enhancements to VMware NSX such as multi-tenancy, and OpenStack controller integration.

This breadth of cloud support enables you to move toward a hybrid environment with workloads that can be securely deployed in a private cloud, or an on-premise data center with the public cloud.

Enable SaaS Applications, Such as Office 365

Palo Alto Networks now adds to its extensive SaaS application capabilities with the release of PAN-OS 7.1, and the newest update to Aperture, to fully enable secure Office 365 deployments. Through App-ID, we’ve added the ability to identify Office 365 applications and how they are being used, even if they are encrypted, as well as the ability to decrypt Office 365 flows to inspect even deeper within the files being exchanged to look for threats. Aperture adds the ability to protect data from exposure and threats in the Office 365 cloud itself, stopping them at the source before they have a chance to move to the network or mobile devices.

Accelerated Threat Intelligence

The common need across all application deployments, no matter their location, is the ability to provide real-time threat protection and visibility. With PAN-OS 7.1, new capabilities supported in WildFire and AutoFocus greatly improve the speed of detection and remediation and improve IT’s ability to respond quickly to those threats.

WildFire malware analysis can now identify and prevent zero-day threats much faster than before – in as quickly as five minutes. Threat analysis has been enhanced with new machine-learning algorithms to instantly stop variations of known malware – even if they have never been seen by WildFire – and reduce analysis time for Portable Executable (PE) variants of known malware. This changes unknown threats into instantly stopped known threats.

New AutoFocus integration with PAN-OS 7.1 and Panorama brings advanced threat context to the entire IT organization, simplifying response efforts for the most critical attacks, in an easy-to-use console. This puts the largest collection of malware data at your fingertips, allowing you to automatically turn analysis efforts for unique, targeted attacks into proactive protections by blocking malicious domains, IP addresses, and URLs with AutoFocus and PAN-OS dynamic block lists. AutoFocus also adds the ability to bring threat intelligence into your existing security operations workflows with an improved API and support for the STIX information sharing standard.

Prevent Breaches with Secure User Credentials

Additionally, among the new features of PAN-OS 7.1 are advancements that help protect user credentials and make them unusable if they are stolen.

Credential theft is a growing concern among many organizations because of an attacker’s ability to bypass security controls and gain full access to the networks and cloud applications once authenticated. These credentials can be obtained in a number of ways, such as a phishing attack, a key logger on an endpoint, a packet sniffer on a network, or breaching a user database.

Once credential theft occurs, an attacker can impersonate the user and gain access to networks, applications and data. Then, once authenticated, further damage occurs from unauthorized access as the attacker initiates lateral movement to compromise other machines or exfiltrate data.

With the new features in PAN-OS 7.1, organizations can deliver protection against credential theft and phishing at all times, no matter where the user goes, and make credentials useless even if they are stolen.

That’s Just the Beginning

There are more than 50 new enhancements in the 7.1 release that are designed to extend the breach prevention capabilities of the platform. For more information on the new capabilities in PAN-OS 7.1, head over to our resources page.

Chris Morosco

[Palo Alto Networks Research Center]