Category: Palo Alto Networks

Posted on

PAN-OS 8.0: Thinking Beyond the Point Channel Strategy

When we launched PAN-OS 8.0 on February 7 (watch replay), it was more than just the largest release in Palo Alto Networks history. It solidified our channel strategy to think beyond the point – beyond point products and beyond the initial customer pain point.

Success as a channel partner in the security market has evolved and is now about being a next-generation security innovator, an expert at enhancing an integrated and automated security platform that empowers innovation and delivers business gains.

This announcement underscores the market-changing differentiation of our Next-Generation Security Platform and inspires us to continue to evolve how we engage with and enable you, our partners, to think beyond the point and become next-generation security innovators.

In the simplest of terms, PAN-OS 8.0 delivers better performance, protection and prevention. With more than 70 advancements that significantly enhance our Next-Generation Security Platform, together we can deliver a new level of security performance from the endpoint, across the network and to the cloud.

This unprecedented level of innovation represents a massive opportunity and one we have been preparing you for months to capitalize on. Partners who embraced becoming next-generation security innovators early have the coveted first-mover advantage because they have already invested in:

  • Selling the Next-Generation Security Platform.
  • Being more self-sufficient in leading customer engagements.
  • Learning how to complement the platform by adding their own professional services.
  • Creating larger deals by integrating complimentary technologies and services from NextWave Technology Partners.
  • Offering alternative purchasing options, such as a pay-as-you-grow managed services or pay-per-use cloud services.

We are far from done. We are redefining the security market, making the once impossible, possible. But, we can’t do it alone. We need you to join us on the journey to become next-generation security innovators.

There has never been a better time to be a Palo Alto Networks partner.

If you haven’t already, check out some of our new channel resources, including:

[Palo Alto Networks Research Center]

Posted on

The Cyber Threat Alliance: How Far We’ve Come and Where We’re Going

In 2015, I published a blog post about the completion of a 90-day proof-of-concept experiment, called Project Redstone. The experiment, conducted by the Cyber Threat Alliance (CTA), tested the theory that, if cybersecurity vendors collaborated in their efforts to combat cyberattacks, they’d be more effective as a group than as individual companies.

In that post, I listed four capability gaps that the CTA needed to address to be successful. They included:

  1. How do we convert large volumes of indicators of compromise into prevention controls?
  2. How do we measure alliance member contributions with more granularity?
  3. What is the common set of success metrics for deployed security controls across Alliance membership?
  4. What is the right sharing architecture that works at scale?

We knew that, if the CTA were to be successful, these four gaps had to be closed. Frankly, there are numerous threat intelligence sharing platforms, and other cybersecurity groups are actively promoting industry collaboration on cybersecurity issues. What makes the CTA different?

It’s a fair question. The tech landscape is littered with industry groups promoting one standard over another or advocating for industry collaboration, and many cybersecurity veterans are quick to dismiss yet another one as a marketing program that’s long on promises, short on results.

I believe those same veterans will be pleasantly surprised to learn about the fantastic progress the Cyber Threat Alliance has made. While that progress was detailed in a press release the CTA issued yesterday, and a blog post from our CEO Mark McLaughlin, I’d like to spend a moment focusing on three characteristics of the CTA that address the capability gaps mentioned above to demonstrate that the CTA’s approach to threat intelligence sharing works.

1. Everyone Contributes

The ability of a threat intel platform to successfully identify and stop new threats is directly related to the quality and quantity of its intel. This is problematic for many threat intel sharing agreements as the larger companies end up contributing the majority of the intel, because they have the resources to gather it, while the smaller members consume more intel than they provide. It’s a lopsided arrangement that can lead to resentment between members and a less robust intel sharing platform. The CTA requires all members to actively contribute to the threat intel pool on a daily basis and holds each member accountable. If a company doesn’t contribute, they can’t remain in the CTA. This ensures the CTA will collectively have access to the best intel available at the time.

2. Exchanges Adversary Playbooks, not one-off Indicators of Compromise

The problem with many threat intel exchanges today is context. While these exchanges can push hundreds of thousands of newly discovered cyberthreats out to members every week, if the threats aren’t put in the proper context (Who is attacking? What is their motivation? Are they targeting specific types of organizations? etc.), it’s difficult for security teams to determine which present the most risk to their network. Without that context, they have to assume all threats are a significant risk, and very few teams can scale to address the thousands of cyberthreats to which their threat intel platforms alert them every day.

This is why the CTA focuses on adversary playbooks. Adversary playbooks speed up analysis and enable defenders to focus more easily on the real goal: protecting against attackers and the various tools and tactics they use. Adversary playbooks integrate individual indicators of compromise (IoCs) in the cyberattack lifecycle into discrete, actionable threat intelligence that CTA members use to build detection and prevention controls for each of our own products. The end result: no matter which cyberattackers are trying to get onto the network or which CTA member’s technology is protecting the network, if they’re accessing the target network using methods already identified in the adversary playbooks, they can be stopped at any point in the attack lifecycle.

Let me use a sports analogy to explain. In football, when two teams prepare for a game, the coaches prepare both defensive and offensive playbooks. It is the same in cyberspace. Network defenders prepare the defensive playbook – how to respond to an ongoing incident for example – and the cyber adversaries prepare an offensive playbook – how to navigate through each phase of the cyberattack lifecycle. We know that cyber adversaries do not invent new attack sequences on the fly for every new victim. They reuse attack sequences that have been successful in the past in the attack lifecycle until the network defenders figure out how to defeat them. Those attack sequences are the cyber adversary’s playbook.

The idea behind sharing adversary playbooks with Alliance members then is that the act exponentially increases the odds that a network defender can actually stop an attack. Instead of sharing one-off IoCs with little or no context, as most sharing organizations do, we share the entire adversary playbook. If the cyber adversaries manage to find a way around one of the network defender’s prevention controls, they will immediately run into the next prevention control in-line in the attack lifecycle. The Alliance aims not to simply prevent a piece of the adversary’s attack sequence – it aims to defeat the entire playbook.

3. Automates the Last Mile for Threat Intel

Realizing that the volume of threats inundating organizations can be hard to keep up with, the CTA is the only sharing organization that can automate the delivery and configuration of prevention controls to its members’ products and platforms. It’s a tremendous help to the CTA members’ customers as it relieves them of the burden of analyzing every new threat and installing the appropriate fix on the network or endpoint. The CTA threat intel platform does this automatically, freeing security teams from the tedium of doing it themselves and letting them focus on their real purpose: identifying and preventing more advanced threats that are likely to go undetected.

Even in well-run sharing organizations, like many of the ISACs, members still have to receive the intelligence, decide that it applies to their network, decide what to do about it, and then do it. For many organizations, this takes days to weeks to accomplish, if it happens at all. I call that crossing the last mile with intelligence.

Because Alliance members are security vendors and already have automated mechanisms to install new prevention and detection controls to their products deployed in the field, the Alliance is perhaps the only organization that has the ability to automatically cross the last mile for its collective customer base without the network defender having to do anything. Already, we’ve seen the CTA Platform succeed in this. In one example, a single shared sample allowed a member to build protections before its customers were targeted, preventing successful attacks against 29 organizations. In another example, shared data allowed a member to identify a targeted attack against its customer and release additional indicators to defend that organization. Further, many of the members find that 40-50 percent of shared data is brand-new to them, and most of that is directly actionable. These are early successes, but it’s clear that things will only get better as the CTA grows.

Like Mark said in his own post, I also believe that, as we continue to expand the CTA, we are stronger together, and I look forward to updating you in the future on the Alliance’s continued progress and successes in helping to protect customers.

[Palo Alto Networks Research Center]

Posted on

PAN-OS 8.0: Empowering the Financial Sector to Prevent Advanced Threats

Our recently released PAN-OS 8.0 offers scalable prevention through automation, speed and accuracy. It builds on the powerful capabilities of the Palo Alto Networks Next-Generation Security Platform and empowers financial institutions to prevent today’s advanced threats with better integration and information sharing across the network, endpoints and cloud. This is achieved through automated workflows and security with fast and precise protections that are generated and shared globally.

PAN-OS 8.0 has a number of specific enhancements that security and risk professionals within the financial services industry may find particularly interesting.

Phishing Attack Prevention

Phishing continues to be a highly effective technique to steal user credentials for illicit purposes. Specific to the financial services industry, the theft and subsequent use of these credentials has been reported as a key factor in the fraudulent transfers perpetuated at a number of SWIFT (Society for Worldwide Interbank Financial Telecommunications) member institutions over the past 18 months. Similarly, credential theft likely played a role in the delivery of ATM malware via the internal networks of multiple banks across Asia and Europe over the past year. Consequently, the prevention of phishing attacks and the protection of user credentials are key priorities for security professionals.

  • Palo Alto Networks next-generation security appliances can block users from submitting their corporate credentials to untrusted (external) websites based on their URL categorization. This keeps these logins and passwords from falling into the hands of malicious actors, even when well-crafted phishing sites are used.
  • Additionally, we now offer the ability to detect and categorize previously unknown phishing sites and update our global customer base of URL categories within five minutes. These timely and frequent updates ensure the next-generation security appliances have the most current information to detect and block access to malicious and phishing sites.
  • New authentication policies on our next-generation security appliances may be used to enforce multi-factor authentication (MFA) before users access sensitive, internal resources. In this capacity, our security appliances function as MFA gateways at the network level for disparate applications or resources – even where MFA is not natively supported.

With these additional capabilities in PAN-OS 8.0, financial institutions can better protect their critical and sensitive resources from account takeover (ATO) attacks that use compromised simple or single-factor authentication credentials.

Prevention of Advanced Persistent Threats

Advanced attackers are increasingly using stealthy, persistent methods to evade traditional security measures. Such advanced persistent threats (APT) typically target specific users and/or vulnerable versions of applications. Designed to be inconspicuous, APTs often go unnoticed for long periods before they’re even identified.

Palo Alto Networks prevents APTs by providing up-to-date protections through various stages of the attack. The SWIFT-related and ATM attacks mentioned earlier are examples of multi-stage attacks, where phishing and the introduction of malware likely occurred in the earlier phases.

As part of PAN-OS 8.0, Palo Alto Networks has improved its ability to detect and prevent even the most evasive unknown malware and zero-day exploits. This is accomplished by WildFire automated threat analysis, which:

  • Counteracts malware capable of sandbox evasion by using a custom new virtual environment and bare-metal analysis for detonation. These advancements outsmart malware that detects virtual machines used in traditional sandboxing solutions.
  • Detects and prevents command-and-control (C2) traffic with new machine learning for accurate and timely automated C2 signature generation, to address rapidly changing host or URL names. This allows continued control of C2 traffic despite arbitrary changes by the attacker to evade detection.
  • Provides a more complete perspective on threats targeting your network with the automatic submission of even blocked files to WildFire for analysis. This additional information will improve the efficiency of incident response and threat research.

WildFire does these things and then creates and publishes protections against newly identified malware to all Palo Alto Networks next-generation security appliances in as little as five minutes.

Securing Branch Networks

Many financial institutions continue to be under pressure to reduce expenses. A network of remote offices (e.g., retail branches, back-office sites) contributes to this expense base. In addition to the reduction and/or consolidation of such offices, there has been a movement to adopt broadband internet as a lower-cost WAN (Wide Area Network) transport. In parallel, the growing dependency of remote offices on the internet and SaaS applications demands more efficient solutions than internet access via corporate data centers only. Factoring in the growing SD-WAN (software-defined WAN) market that seamlessly aggregates traditional WAN with internet and even 4G/LTE services, an even greater need to secure remote offices has emerged.

Network segmentation of remote sites from the data center is a good idea and can be done centrally. However, if these offices have their own internet connections – especially with local breakout, then a next-generation security appliance at the remote site is warranted. In addition to securing the internet connection, capabilities such as URL filtering, intrusion prevention, and policies to control branch-to-branch traffic are possible.

As part of the PAN-OS 8.0 announcement, we also introduced two new products that are suitable for remote office deployments. These offer the same next-generation security that is available for data centers, where your critical information resides, to the smallest branch offices serving your end users. They are:

  • PA-220: This appliance provides up to 250 Mbps of throughput, and is suitable for rack or wall-mounting.
  • VM-50: This virtual form factor appliance provides up to 200 Mbps of throughput. As a part of our VM-Series family, it can run directly on SD-WAN appliances from certain vendors as well.

Learn more about PAN OS 8.0 and the latest product announcements from Palo Alto Networks.

[Palo Alto Networks Research Center]

Posted on

Cyber Threat Alliance Expands: Working Together to Prevent Cyber Breaches

Yesterday, I stepped on a stage in San Francisco with CEOs and leaders from five other cybersecurity companies – Check Point, Cisco, Fortinet, Intel Security and Symantec – to announce the revamped, bigger and now-independent Cyber Threat Alliance.

Normally, we are competitors. However, the Cyber Threat Alliance brings us all together in good faith to share threat information for the purpose of improving defenses against advanced cyber adversaries across member organizations and our respective customers.

Our company mission is to maintain trust in today’s digital world, and the collective intelligence from the Cyber Threat Alliance ecosystem – the output of which will be delivered through our Next-Generation Security Platform – furthers our ability to enable our customers to successfully prevent cyber breaches. We six founding members now also agree that this expanded and independent Cyber Threat Alliance is key to advancing that mission.

To make the Cyber Threat Alliance a more effective and powerful force, we announced the:

  • Establishment of the Cyber Threat Alliance as its own, truly independent organization with a president, board of directors, and governance structure.
  • Appointment of Michael Daniel as the first president of the Cyber Threat Alliance. Michael was formerly special assistant to the president and cybersecurity coordinator for the White House and brings unique and valuable expertise to this position.
  • Addition of Check Point and Cisco to this powerful group of founding members, and additional affiliate and contributing members (e.g., InSights, RSA and Rapid7).
  • Unveiling of the Cyber Threat Alliance Platform for Threat Intelligence Sharing, which is now fully operational and actively sharing tens of thousands of samples and pieces of active threat intelligence each week.

Ultimately, the vision of the Cyber Threat Alliance and its members is threefold:

  1. To share threat information in order to improve defenses against advanced cyber adversaries across member organizations and their customers.
  2. To advance the cybersecurity of critical information technology infrastructures.
  3. To increase the security, availability, integrity and efficiency of information systems.

With yesterday’s announcement, we made a bold step forward on our first vision item. As a founding Cyber Threat Alliance member and consistent driver of automated threat intelligence sharing, Palo Alto Networks is pleased with the continued forward momentum toward collectively improving the industry’s defenses against advanced cyber adversaries.

Next comes our work on the second and third vision items while we continue to improve the Cyber Threat Alliance Platform and add new members. We believe that by expanding the Cyber Threat Alliance, we are stronger together and can overcome some of the inherent challenges in isolated approaches to cybersecurity.

For us here at Palo Alto Networks, the Cyber Threat Alliance is another way that we show our longstanding and fundamental commitment to the importance of threat information sharing. We have said for years that the industry and the public sector must operationalize threat information sharing; that’s the best way to shift the balance of power against cyber adversaries. The Cyber Threat Alliance and its new operational platform is a realization of that belief. As a founding member, we have been involved in the Cyber Threat Alliance since it started in 2014, and yesterday’s announcements are a realization of the goals and vision we had when this all began.

We are committed to strong, continued support and participation in the Cyber Threat Alliance. I look forward to updating you in the future on the Cyber Threat Alliance’s progress in our shared vision.

[Palo Alto Networks Research Center]

Posted on

PAN-OS 8.0: Protecting Industrial Automation and Control Systems by Securing the Network

Our recent announcement of PAN-OS 8.0 provides scalable prevention through automation, speed and accuracy – three areas by which all cybersecurity deployments should be measured.

Traditional security implementations require too much manual intervention, fail to stop attacks in time, and hinder business with numerous false positives. To address these shortcomings, Palo Alto Networks spearheaded the concept of prevention with the fully integrated and increasingly automated Next-Generation Security Platform to prevent successful cyberattacks. Thanks to the enhanced features available in PAN-OS 8.0, security teams responsible for IT/OT can now scale their capabilities, automate security enforcement, and prevent user identities from being compromised. This can be done quickly and accurately, and without unnecessary manual intervention, allowing your organization to be more secure in all locations.

Tactics Used to Attack ICS

Over the last several years, there have been several successful phishing attacks against industrial controls infrastructures. Most of these attacks obtained valid corporate credentials to the enterprise network, which has proven to be a common factor in the success of these phishing attacks.

Typically, ICS/SCADA are not directly connected to the internet, although there are sometimes exceptions. In most instances, the organization’s enterprise networks sit in front of the production environments. They are providing mission-critical services, the most valuable being network security, from both the internet and intranet, to and from the ICS.

Obtaining valid credentials allows attackers to circumvent enterprise network security solutions without arousing suspicions. This allows the attackers the time to learn and exploit the attached industrial control systems. Sometimes the attacks were just hacktivists working to bring awareness of the vulnerable state of these systems to public attention; for example, the attack on the Water & Sewer Department in Texas, back in November 2011.

Let’s take, for another example, an act of cybercrime, like the incident reported by F-Secure in which CryptoWall, a variant of CryptoLocker, infected a concrete manufacturer in April 2015. A further example was the direct act of cyber terrorism on the Ukrainian power grid later that year in December. It is becoming clear that hacktivists, cybercriminals and cyberterrorists have developed an interest in industrial automation and control systems (IACS).

After Stuxnet, there were significant breaches of companies’ control environments: the Kemuri Water Company (2016) and the German Steel Mill (2014). These breaches were accomplished by pivoting through the enterprise network by way of some form of phishing attack. Credential theft is one of the leading vectors to a data breach. One reason is the majority of organizations continue to use password-based credentials as the primary means of securing user access. It is much easier for an attacker to steal passwords than it is to find and hack a vulnerable system. Thus, password-stealing techniques are used by a broad spectrum of attackers to breach organizations, compromise their networks, and steal critical data from internal data centers and the cloud. In instances where the company happens to own and operate industrial control and SCADA systems, this lack of detection affords the adversary the time and opportunity needed to find, learn, disable or destroy operational infrastructure.

Because attacks of this nature are increasing, companies and their users must remain vigilant and aware and they must defend against the many forms of phishing attacks launched against them.

The attacks may be as simple as luring a user to a fake enterprise login on a similar-looking domain, a tactic known as “deceptive phishing,” or standing up fake Outlook Web Access (OWA) or single sign-on authentication pages, using the more personalized “spear phishing” technique. The objective is the same either way: to trick the user into clicking the malicious attachment or URL and willingly hand over personal data.

Now that industries have become more mindful of these deceptive practices, attackers have begun developing and deploying tactics that are more obfuscated, like “pharming,” a form of domain name system (DNS) cache poisoning. In this type of phishing attack, instead of baiting a potential victim with an email or attachment, they are redirected to a phony website and asked to supply necessary login information.

Another tactic with significant obfuscation is to craft attack emails directed to an identified cloud-based services company and its users, like Dropbox or Google Docs. In all instances of Dropbox and Google Docs phishing attacks, attempts were made to lure users to enter their login credentials on fake sign-in pages hosted by these services providers – a clever tactic even the most diligent security practitioner could fall prey to, since the certificates and SSL connections are being provided by the service being exploited.

The 2016 Verizon Data Breach Investigation Report stated both the frequency and level of sophistication of phishing attacks are increasing and pose a significant threat to all organizations, especially those operating with critical infrastructures.

An obvious, yet not so simple, first step in securing the ICS ecosystem is to secure the business network.

Phishing Attack Prevention

The most damaging breaches related to ICS/SCADA involved the use of stolen enterprise credentials at some stage of the attack. Attackers consistently find that it is easier to move throughout the network as a valid user than it is to find and exploit vulnerable systems.  Passwords have remained one of the weakest links in security for years. It is easier than ever to phish for passwords, and multi-factor authentication’s cost and complexity has limited its footprint in the organization. Additionally, the use of multi-factor authentication technology is currently not an ideal fit with IACS.

Prevent Phishing Site Access, Five-Minute Updates

PAN-OS 8.0 brings a robust new defense against credential theft by identifying and blocking password phishing attacks as they are attempted. The firewall analyzes login actions to identify valid corporate credentials being sent to illegitimate websites and prevents the attacker from obtaining credentials that can be used to enter or move throughout the network. Newly discovered phishing sites are then categorized by PAN-DB within five minutes, blocking access to these malicious sites entirely.

Authentication Gateway

In the event the adversary is already in possession of stolen credentials or already has a presence within the network, PAN-OS 8.0 neutralizes the attacker by requiring secure multi-factor authentication before granting access to sensitive resources. Enforcing policy-based multi-factor authentication at the network layer applies strong authentication requirements for all sensitive applications, including those that cannot natively integrate with third-party authentication services, like many found within a process controls network. Enabling this feature limits an attacker’s ability to move freely throughout the network without having to secure each application individually.

These new capabilities work together to neutralize the problem of credential theft and abuse by preventing the adversary from phishing for credentials and using stolen credentials to move laterally throughout the network. This, in turn, helps to secure ICS/SCADA environments.

To learn more about PAN-OS 8.0 and other enhancements made to the Next-Generation Security Platform, visit the What’s New in PAN-OS 8.0 page or contact your Sales Account Manager for details.

[Palo Alto Networks Research Center]

English
English
Exit mobile version