Category: #IT/CYBER/TECHNOLOGY

Posted on

PAN-OS 8.0: Three New Features in Panorama That Will Make Your Job Easier

Network security management tools should make your life easier. Panorama network security management is intelligent, fast, and plugs into your security ecosystem via application programming interfaces (APIs). It does the heavy lifting of correlating indicators of compromise across millions of log lines obtained from next-generation firewalls and endpoints; takes automated actions that you have pre-programmed; and ultimately gives you the information you need to act upon.

Introducing Panorama 8.0

As part of our recent PAN-OS 8.0 release, there are three new features introduced in our latest version of Panorama that will make your job easier.

  1. More data sources for greater visibility. Panorama now ingests logs from the next-generation firewalls, as well as Traps advanced endpoint protection. But what’s the point of more data if it can’t be converted into useful, actionable information? Panorama’s unique automated correlation engine processes all the data that it receives, scrutinizes security events that may appear isolated, and queries the data for specific patterns including ones defined by our Unit 42 threat intelligence team. The analysis provides you with the kind of information you are interested in. For example, by analyzing exploit prevention events on the endpoint with threat information received from WildFire, the correlation engine can tie together disparate indicators of compromise and point out which endpoints are infected, if any.
  2. Automated actions triggered on filtered events. As an administrator, you get inundated with events, events and more events. How do you know what to act on? This onslaught of events lets malicious events go unnoticed. Our approach is different. Panorama can define what kinds of events should be forwarded to specific teams. For example, the Security Operations Team may choose to receive only the high-priority malware and phishing-related events. This personalized event filter lets you analyze and act upon information relevant to your role. And that’s not all. Panorama also allows you to automate tasks. You can program appropriate events to trigger a workflow on any part of your security ecosystem that accepts an HTTP/S call, for example, a ticketing service.
  3. Granular change management for multi-admin teams. Often multiple administrators manage network security. And they need to make changes and commit them independent of other teams. Panorama enables administrators to do this. Let’s say that you are a security administrator and need to make an urgent, high-priority change to the security rules on the firewall. But you realize that the network team is making changes to the firewall’s VPN rules, which they need to test and verify before they roll them out. You can’t wait for them to complete their testing since your time window is much shorter. Panorama allows you to commit and revert your changes independent of other teams. You can commit your changes without affecting the network team’s changes. This frees you up from doing an offline coordination with other teams for commit and revert.

Making You More Secure: A Real-World Example

Let’s say that one of your endpoints, which does not have Traps installed, receives an exploit attempt through a new file that a user just downloaded. Imagine that this is a previously unknown threat, so the file gets sent to WildFire, our threat intelligence cloud. WildFire executes the file in the cloud, then concludes that it is malicious. It immediately creates signatures to catch this new malware and distributes it globally to all Palo Alto Networks Next-Generation Firewalls.

But what about the endpoint that received the exploit attempt? Since the endpoint does not have Traps installed, the file executes and the exploit attempt is successful. The endpoint attempts to make a command-and-control (C2) callback and is blocked by the firewall. When Panorama analyzes logs, the automated correlation engine inspects the data and finds a match between the attempted C2 activity on the endpoint and the malicious behavior that the file showed in WildFire. Based on this match, it now concludes that this is an infected host.

This information alone is extremely valuable to a security administrator. But Panorama goes beyond just highlighting the information. With the 8.0 release, Panorama can look at the source IP address in the log, and auto-tag it with a predefined tag, for example, “Compromised.” The next-generation firewall can be configured to place all IP addresses that are tagged “Compromised” in the appropriate dynamic address group, and apply your chosen policy on the group, for example, to block the traffic or enforce multi-factor authentication for these endpoints. All of this occurs without any manual intervention. As attacks become more and more automated, replacing manual intervention with automated actions is the only way to scale your team to effectively defend against them.

Now if the user at this endpoint is a malicious actor, the multi-factor authentication challenge blocks his attempt to move laterally within your network, which protects your sensitive data. On the other hand, if this is a legitimate user, he or she may get surprised with the multi-factor authentication challenge, and may deny the second factor authentication. If the adversary continues to attempt to move laterally or the user continues to deny the second factor, Panorama can automatically block the IP and log a service ticket. Remember the automatic triggering of actions from Panorama described in point #3 above? This capability comes in handy now. Panorama can use the HTTPS API exposed by your ServiceNow ticketing system to create a ticket so that the Operations team is aware of this action on the endpoint. They can then investigate the incident, remediate the endpoint if needed, and release it from the more stringent security policy.

See Figure 1 below for a depiction of this real-world scenario.

But Wait…Panorama 8.0 Offers Much, Much More

Available either as a dedicated management appliance or as a virtual machine, Panorama 8.0 enables organizations to manage their distributed network of Palo Alto Networks Next-Generation Firewalls from one central location – easily and intelligently. Here’s a complete list of features introduced in Panorama 8.0.

More data sources for greater visibility, plus faster access Improved Visibility
Vastly improved querying and reporting engine ACC enhancements for SaaS visibility and interactivity
Up to 24TB of RAID storage per M-500 ACC customization and collaboration improvements: default tab, share tabs
Up to 48TB storage for an HA-pair VM Visibility for de-capsulated tunneled traffic
Log forwarding from PA-7000 Series to Panorama Other features
Ingestion of Traps logs into Panorama Admin-based commits
Automated actions triggered on filtered events NetFlow support in PA-7000 Series
Filtered log forwarding M-Series expanded multi-interface support
HTTP-based log forwarding to third-party systems Plug-in architecture for external integrations
Auto-tagging of source/destination IPs SNMP MIB for device log forwarding and support for HA2 interface

 

To learn more, check out the following resources:

and

[Palo Alto Networks Research Center]

Posted on

PAN-OS 8.0: Thinking Beyond the Point Channel Strategy

When we launched PAN-OS 8.0 on February 7 (watch replay), it was more than just the largest release in Palo Alto Networks history. It solidified our channel strategy to think beyond the point – beyond point products and beyond the initial customer pain point.

Success as a channel partner in the security market has evolved and is now about being a next-generation security innovator, an expert at enhancing an integrated and automated security platform that empowers innovation and delivers business gains.

This announcement underscores the market-changing differentiation of our Next-Generation Security Platform and inspires us to continue to evolve how we engage with and enable you, our partners, to think beyond the point and become next-generation security innovators.

In the simplest of terms, PAN-OS 8.0 delivers better performance, protection and prevention. With more than 70 advancements that significantly enhance our Next-Generation Security Platform, together we can deliver a new level of security performance from the endpoint, across the network and to the cloud.

This unprecedented level of innovation represents a massive opportunity and one we have been preparing you for months to capitalize on. Partners who embraced becoming next-generation security innovators early have the coveted first-mover advantage because they have already invested in:

  • Selling the Next-Generation Security Platform.
  • Being more self-sufficient in leading customer engagements.
  • Learning how to complement the platform by adding their own professional services.
  • Creating larger deals by integrating complimentary technologies and services from NextWave Technology Partners.
  • Offering alternative purchasing options, such as a pay-as-you-grow managed services or pay-per-use cloud services.

We are far from done. We are redefining the security market, making the once impossible, possible. But, we can’t do it alone. We need you to join us on the journey to become next-generation security innovators.

There has never been a better time to be a Palo Alto Networks partner.

If you haven’t already, check out some of our new channel resources, including:

[Palo Alto Networks Research Center]

Posted on

Steps To Kick-Start Your Technical Skill Development Plan Now

Senior IT Auditor, Fortune 500 global manufacturing organization: “I joined a Big 4 firm advisory practice out of college, did two years, and then moved over to IT Internal Audit a year ago. Information security is my next goal. When I look at information security job postings, they all seem more technical than my current skill set, which is heavily ITGC focused. What should I do to build skills that will be marketable to information security?”

IT Audit Director, large financial services company: “Can you please help us find a technical Senior IT Auditor with 3-5 years of experience who has application auditing skills at the level where they can do code review? Some programming skills would be very helpful. We also need mainframe, cyber security, cloud, IoT, and data analytics experience – from an audit project perspective. We need actual experience with IT operational audits – not just ITGC / SOX experience.”

CISO, global eCommerce company: “I’ve met a number of auditors lately (from audits that have hit us), that can’t understand why something is NOT a high risk. They are just following a check list and it is really frustrating. Maybe that is something you call “mind-set”?  These auditors just want to go through the motions, without really understanding either technology and/or the risk it really represents.”

These comments are real. More importantly, they are BIG signals that point to the critical career directions for IT audit professionals in 2017:

  • Deeper technical skills;
  • More knowledge of the business, especially IT;
  • The move away from checklist thinking to a better understanding of risk.

IT audit functions are quickly becoming more focused on technical audits. There is a huge drive for value-added that can be gained from operational IT audits and advisory projects performed by IT internal auditors. Concurrently, information security, IT risk, and data analytics continue to grow, presenting more job opportunities for IT auditors—if they are adequately technical, and develop the thought process needed to join info sec and IT risk teams.

The CISO quoted above provided additional insight into the perspective that career-mobile IT audit professionals need to cultivate: “The advent of cloud computing and the concept of DevOps is challenging the controls that traditional IT auditors have grown comfortable with. For example, cloud represents a way to do infrastructure in a quick and non-structural way (think creating an entire data center by coding/scripting it), while DevOps breaks the segregation of duty model, which makes auditors uncomfortable.  But what the auditor does not see is that DevOps is a way that we have developed to ensure we still have ‘control’ in an agile development cycle.”

Beyond mindset and a change in perspective, the problem for hiring managers and practitioners is that the on-the-job experience that many IT auditors have received is in the ITGC space. In the end, both sides of the equation depend on professionals gaining more technical skills.

For the IT auditors, staff through light manager, the task to immediately jump on is a skills gap assessment. What hot skills do you need to acquire to become more marketable internally and externally? If you are in IT internal audit, the annual plan is your guide. For a broader perspective, review professional journals and job descriptions; both will provide clues.

Next, create your road map to your next role. Are you looking to deepen your skills for a step-up promotion within your team, or are you looking to take your skills to an information security or IT risk team? Plot the timeline for skill attainment, which will come from a combination of hands-on work, internal/external training, post-grad coursework, or certification.

Todd Miller, who has led IT audit functions at two global Fortune 500 companies, suggests a 70-20-10 model: 70% on-the-job training; 20% mentoring; 10% formal classroom work.

Let’s start with on-the-job-training through project work.

Determine a technical area that interests you and is feasible within the scope of projects done within your department. Let’s say you want to become more fluent with networks and network security. Explain your plan to your manager and lobby to participate on the upcoming network audit.

Do your homework for the project so you can ramp up quickly and are able to build good rapport with the network team. Once you’ve done a project, and your skills and knowledge deepen, you might see if you can do a stint as a guest resource on a project for the network security team.

Ed Dudek, an IT audit manager at a Fortune 100 company who gained expertise in SAP by moving out of audit into an SAP team before moving back to audit, stresses the need for mentoring. To this end, you’ll want to foster dialogue with the network team members who you have now met on that technical audit you just completed. Get to know team members over lunch or coffee. Ask interesting questions and share what you have been reading, learning. Your goal is to demonstrate intelligence, intellectual curiosity and readiness to learn.

Through this interaction, you’ll be able to identify people on the team who are knowledgeable and might be good mentors. By the same token, various team members will get to know you, and may be receptive to being mentors. Mentoring relationships are developed step-by-step. It takes time.

The goal with mentoring is also to eventually build such trust and mutual respect that the mentor becomes a sponsor. A sponsor will talk up your skills and interest. Through mentors and sponsors, you have the chance to be tapped for an internal opening when it comes along.

At some point in the process, you will need to add coursework, training, or certification to the mix – the final 10% of the 70-20-10 plan. If your employer will pay for training, communicate your plan to your manager and get buy-in. If your company will not pay for the training you want, determine a cost-effective way to get it on your own. It is your career in the end, and investing in your skills is one of the smartest things you can do to create long-term career sustainability.

To cement the concept that a focused action plan for technical skill development really works, here’s the story shared by the head of IT audit and data analytics for a global airline. He explained that he had developed a passion for data analytics when he was a senior IT auditor at a company running SAP. He joined the local ACL users group, studied on his own, and got a data analytics certification. He was then recruited by another company that wanted to build out a new data analytics function within audit.

Once on board, he took post-grad courses in data analytics at a local university to gain additional skills in Structured Query Language (SQL) and Statistical Analysis System (SAS). The build-out of the data analytics program at his company was successful, and this was the stepping stone to a data analytics management role with a Big 4 firm. From there, he was recruited to lead the IT audit function by his current employer.

As a recruiter and career coach, I see similar career planning and skill attainment in the candidates who land the best jobs. Your career is your opportunity to direct a mission-critical project and bring it to fruition.

Technical skill development is the best thing you can do for your career this year and for the foreseeable future. No time like the present: Develop your 70-20-10 plan, and start executing!

Candor McGaw, President and Chief Recruiting Officer, Candor McGaw Inc.

[ISACA Now Blog]

Posted on

The Growth of Macs in the Enterprise Is Challenging the PC’s Dominance

The PC has long been the default choice for business computers, but perhaps not for much longer. The growth of Macs in the enterprise has been exponential in recent years, as illustrated by the infographic below.

For context on why Macs are growing in popularity in the workplace, look at some of the big-name companies embracing the platform. Once a sworn enemy of Macintosh, IBM has become a high-profile proponent of Macs for its own workforce. Cisco allows its employees to choose between iOS and Windows devices, and now has 35,000 Macs in use. At SAP, the company believes that “offering Mac is key for any modern enterprise.”

Mac usage lowers IT costs
Simpler IT support for Macs and a high level of user self-service drive the bulk of this cost savings. IBM reports that just 3.5 percent of its Mac users currently call the help desk, compared to 25 percent of its PC users. Media company Buzzfeed maintains only a small IT staff for its thousands of employees–only 30-35 employees use Windows machines, while the rest operate on Macs.

User preference—not business value—still drives most Mac adoption
IT cost savings aren’t the only thing driving Mac adoption among big names in business tech. Security and productivity are also driving Mac adoption. Deloitte says iOS is “the most secure platform for business” and states that “Apple’s products are essential to the modern workforce.” Cisco stated it believes Apple devices accelerate productivity. Basic user satisfaction is another important factor. IBM reports a 91 percent satisfaction rate among Mac users and says its pro-Mac policies help the company attract and retain top talent.

While IBM and others put total cost of ownership, security and productivity as top reasons for Mac adoption, a survey conducted by Code42 shows user preference continues to be the main reason that enterprises are embracing Macs today.

Top reasons for Mac adoption

1. Happier end users (37%)
2. Fewer help desk tickets (14%)
3. Better OS security (12%)

Top IT challenges are Macs’ top strengths
Macs also offer advantages in areas that are typically sources of major challenges for IT. According to our survey, the most time-consuming tasks for IT are tech refresh and help desk tickets, followed by malware and ransomware. These are actually areas where Macs excel. Macs traditionally enable a much higher level of self-service, and Code42 enables user-driven tech refresh for Mac users (and PC users, too). This level of self-service produces the kind of IT cost savings IBM has seen with its dramatically reduced help desk tickets.

Jeremy Zoss, Managing Editor, Code42

[Cloud Security Alliance Blog]

Posted on

The Cyber Threat Alliance: How Far We’ve Come and Where We’re Going

In 2015, I published a blog post about the completion of a 90-day proof-of-concept experiment, called Project Redstone. The experiment, conducted by the Cyber Threat Alliance (CTA), tested the theory that, if cybersecurity vendors collaborated in their efforts to combat cyberattacks, they’d be more effective as a group than as individual companies.

In that post, I listed four capability gaps that the CTA needed to address to be successful. They included:

  1. How do we convert large volumes of indicators of compromise into prevention controls?
  2. How do we measure alliance member contributions with more granularity?
  3. What is the common set of success metrics for deployed security controls across Alliance membership?
  4. What is the right sharing architecture that works at scale?

We knew that, if the CTA were to be successful, these four gaps had to be closed. Frankly, there are numerous threat intelligence sharing platforms, and other cybersecurity groups are actively promoting industry collaboration on cybersecurity issues. What makes the CTA different?

It’s a fair question. The tech landscape is littered with industry groups promoting one standard over another or advocating for industry collaboration, and many cybersecurity veterans are quick to dismiss yet another one as a marketing program that’s long on promises, short on results.

I believe those same veterans will be pleasantly surprised to learn about the fantastic progress the Cyber Threat Alliance has made. While that progress was detailed in a press release the CTA issued yesterday, and a blog post from our CEO Mark McLaughlin, I’d like to spend a moment focusing on three characteristics of the CTA that address the capability gaps mentioned above to demonstrate that the CTA’s approach to threat intelligence sharing works.

1. Everyone Contributes

The ability of a threat intel platform to successfully identify and stop new threats is directly related to the quality and quantity of its intel. This is problematic for many threat intel sharing agreements as the larger companies end up contributing the majority of the intel, because they have the resources to gather it, while the smaller members consume more intel than they provide. It’s a lopsided arrangement that can lead to resentment between members and a less robust intel sharing platform. The CTA requires all members to actively contribute to the threat intel pool on a daily basis and holds each member accountable. If a company doesn’t contribute, they can’t remain in the CTA. This ensures the CTA will collectively have access to the best intel available at the time.

2. Exchanges Adversary Playbooks, not one-off Indicators of Compromise

The problem with many threat intel exchanges today is context. While these exchanges can push hundreds of thousands of newly discovered cyberthreats out to members every week, if the threats aren’t put in the proper context (Who is attacking? What is their motivation? Are they targeting specific types of organizations? etc.), it’s difficult for security teams to determine which present the most risk to their network. Without that context, they have to assume all threats are a significant risk, and very few teams can scale to address the thousands of cyberthreats to which their threat intel platforms alert them every day.

This is why the CTA focuses on adversary playbooks. Adversary playbooks speed up analysis and enable defenders to focus more easily on the real goal: protecting against attackers and the various tools and tactics they use. Adversary playbooks integrate individual indicators of compromise (IoCs) in the cyberattack lifecycle into discrete, actionable threat intelligence that CTA members use to build detection and prevention controls for each of our own products. The end result: no matter which cyberattackers are trying to get onto the network or which CTA member’s technology is protecting the network, if they’re accessing the target network using methods already identified in the adversary playbooks, they can be stopped at any point in the attack lifecycle.

Let me use a sports analogy to explain. In football, when two teams prepare for a game, the coaches prepare both defensive and offensive playbooks. It is the same in cyberspace. Network defenders prepare the defensive playbook – how to respond to an ongoing incident for example – and the cyber adversaries prepare an offensive playbook – how to navigate through each phase of the cyberattack lifecycle. We know that cyber adversaries do not invent new attack sequences on the fly for every new victim. They reuse attack sequences that have been successful in the past in the attack lifecycle until the network defenders figure out how to defeat them. Those attack sequences are the cyber adversary’s playbook.

The idea behind sharing adversary playbooks with Alliance members then is that the act exponentially increases the odds that a network defender can actually stop an attack. Instead of sharing one-off IoCs with little or no context, as most sharing organizations do, we share the entire adversary playbook. If the cyber adversaries manage to find a way around one of the network defender’s prevention controls, they will immediately run into the next prevention control in-line in the attack lifecycle. The Alliance aims not to simply prevent a piece of the adversary’s attack sequence – it aims to defeat the entire playbook.

3. Automates the Last Mile for Threat Intel

Realizing that the volume of threats inundating organizations can be hard to keep up with, the CTA is the only sharing organization that can automate the delivery and configuration of prevention controls to its members’ products and platforms. It’s a tremendous help to the CTA members’ customers as it relieves them of the burden of analyzing every new threat and installing the appropriate fix on the network or endpoint. The CTA threat intel platform does this automatically, freeing security teams from the tedium of doing it themselves and letting them focus on their real purpose: identifying and preventing more advanced threats that are likely to go undetected.

Even in well-run sharing organizations, like many of the ISACs, members still have to receive the intelligence, decide that it applies to their network, decide what to do about it, and then do it. For many organizations, this takes days to weeks to accomplish, if it happens at all. I call that crossing the last mile with intelligence.

Because Alliance members are security vendors and already have automated mechanisms to install new prevention and detection controls to their products deployed in the field, the Alliance is perhaps the only organization that has the ability to automatically cross the last mile for its collective customer base without the network defender having to do anything. Already, we’ve seen the CTA Platform succeed in this. In one example, a single shared sample allowed a member to build protections before its customers were targeted, preventing successful attacks against 29 organizations. In another example, shared data allowed a member to identify a targeted attack against its customer and release additional indicators to defend that organization. Further, many of the members find that 40-50 percent of shared data is brand-new to them, and most of that is directly actionable. These are early successes, but it’s clear that things will only get better as the CTA grows.

Like Mark said in his own post, I also believe that, as we continue to expand the CTA, we are stronger together, and I look forward to updating you in the future on the Alliance’s continued progress and successes in helping to protect customers.

[Palo Alto Networks Research Center]

English
English
Exit mobile version