Category: Palo Alto Networks

Today, with a plenary vote in the European Parliament, the EU took the near-final step in enacting its groundbreaking cybersecurity legislation, the Network and Information Security (NIS) Directive. This is the result of more than three years of effort by the European Commission, Council and Parliament, working with stakeholders from Europe and around the world. Proposed in response to growing concerns about cyberthreats, and in an attempt to raise the cybersecurity and resilience of network and information systems in EU member states, this is the first time the EU has legislated specifically on cybersecurity. Notably, the Directive frames cybersecurity in an economic and societal context, observing its importance in underpinning economic activities and growth as well as user confidence in online activities, and thus also in facilitating the internal EU market. The Directive will soon be published in the Official Journal of the European Union and will come into force 20 days after that. EU member states will then have 21 months to transpose it into national laws.

With implications for both industry and member states, the Directive establishes security and incident notification requirements for “operators of essential services” (e.g., providers of energy, transportation, healthcare services) and, to a less stringent extent, “digital service providers” (online marketplaces, online search engines, and cloud service providers). It requires member states to adopt national NIS strategies; to designate national competent authorities; and to have “well-functioning” computer security incident response teams (CSIRTs) to detect, prevent, and respond to cyber incidents and risks. It emphasizes coordination among member states, setting up a CSIRT network (also to include CERT-EU) to promote swift and effective operational cooperation, and a “cooperation group” to support and facilitate strategic cooperation and information exchange.

Although today’s vote is a milestone, the next steps matter more. In turning the Directive’s prose into action through national implementation, member states must prioritize consistency. Operators of essential services and digital service providers need a sense of regulatory predictability. Under the Directive, member states determine which entities meet the criteria for “operators of essential services.” The Directive provides a common methodology to do so and directs member states to consult with each other when looking at companies serving multiple EU markets, which so many do. This is key—disparate methodologies or divergent views of what constitutes an “operator of essential service” could lead to confusion and possible misallocation of security resources. The same goes for member states’ authority to further define the security and incident notification requirements for operators of essential services: despite the flexible implementation allowed for by the Directive, consistency should be the goal.

Harmonized approaches to cybersecurity are an essential ingredient in improving cybersecurity worldwide. Cybersecurity resources are scarce in both government and industry and any redundant or inconsistent activities or requirements could divert resources from where security is needed and from the ability to develop responses to constantly evolving cybersecurity threats. Coordination is needed not just within the EU. We urge member states, the Commission, Parliament, and the EU Agency for Network and Information Security (ENISA) to continue to engage with governments and industry outside of Europe to ensure maximum alignment as the NIS Directive is fleshed out.

Many actions EU member states must take in terms of their own strategies and activities would, if implemented and resourced sufficiently, have great potential in raising the cybersecurity bar. For example, the CSIRT network is an important addition to the international CSIRT (CERT) community. Palo Alto Networks works with many CSIRTs across the EU and NATO. We look forward to working with others as they get up and running and to helping them start off strongly. Significantly, the Directive encourages member states’ CSIRTS to participate in international cooperation networks in addition to the CSIRT network established in the Directive. Cybersecurity threats are global, and cooperation among CSIRTs around the world helps pool knowledge and resources to address these common threats. In another example, the Directive requires member states to have national NIS strategies that include cyber education and raising awareness, which plays an important role in helping companies to assess and manage their cyber risks and citizens to better protect themselves when online.

The Directive instructs member states to ensure competent authorities have adequate technical, financial, and human resources to carry out their tasks effectively and efficiently. Cybersecurity resources are tight for governments everywhere, but we hope member states allocate what they can. To this end, partnerships are key. The Directive gives ENISA a variety of roles, such as, if needed, helping member states develop their strategies and establish CSIRTs. If member states also take advantage of the considerable industry expertise that exists, we can all improve cybersecurity more quickly.

We commend European policymakers for taking steps to put cybersecurity front and center. Moving forward, member states’ activities to implement the Directive will vary, given their different levels of preparedness. Some, notably Germany, France and the Netherlands, have worked on cybersecurity for years and introduced or passed their own cybersecurity laws in advance of the NIS Directive. They may need only to make small adjustments to align with the Directive’s minimum requirements, if at all. Other member states will benefit more substantively from the Directive’s guidance. Ultimately, the more all EU member states can raise the collective bar the more the global digital infrastructure will benefit.

Danielle Kriz

[Palo Alto Networks Research Center]

It’s exciting when we’re recognized in the market as the security vendor customers can count on to protect their users and their data. Now, we have a third-party report that publicly corroborates whatour customers have been saying: that Palo Alto Networks is effective when it comes to protecting the data center.

Today, NSS Labs published results from their 2016 Data Center Intrusion Prevention Systems (DCIPS) group test, and granted Palo Alto Networks their “recommended” rating. Most notable within our results report:

• 100% effectiveness rating against all evasion techniques tested
• 94.2% overall exploit block rate
• Only 3 false positive triggers

I invite you to read through our report, and more importantly, look through the configurations used during this test.

NSS Labs’ test rules allow vendors to configure their devices before the test but not during, which means that vendors must configure products to account for both performance and security, as this is the typical balance most customers must make when deploying security products in the data center. We configured our PA-7050 for this test using the defaults that a large portion of our customers use every day to protect their applications, users, and data. We encourage you to review our test configurations so you can see for yourself how our PA-7050 managed to achieve 94.2 percent security effectiveness and 30 Gbps, and compare them to the test configurations of other vendors who participated for complete context behind the comparative results of this test.

Protecting the data center is not new for us – we’ve been protecting data centers around the world from threats for the better part of a decade by addressing multiple stages within the attack lifecycle. Today we have the PA-7000 Series NGFW: two massive chassis that address the increased traffic throughput requirements of large data centers and service providers without sacrificing security.

How do we accomplish this? We take advantage of every opportunity to identify and stop an attack in as few traffic scans as possible.

Exploitation makes up one stage of the attack lifecycle. As our security score shows, we do a great job blocking exploits at the network level. But we’re also excellent at blocking subsequent attack stages, such as malware installation and command-and-control (C2). What you may not know is that anti-malware and C2 protection is grouped in with our platform’s IPS capabilities, so our performance results on this test are indicative of security beyond the exploit stage against which it was tested. Along with exploits, our platform blocks malware and C2 communication without additional performance degradation, software, or appliances. This approach has been one of the driving forces behind Palo Alto Networks success in protecting the data center.

Attack surface reduction through complete visibility into the applications that comprise data center traffic and the ability to granularly control which applications you want to allow and what kind of content they’re allowed to bring into and out of the data center is critical in keeping threats at bay. When you combine this with identifiable users – not just IP addresses, but actual user names – you further limit the opportunity attackers have to infiltrate your data center by allowing only certain users and user groups to access certain data via certain applications. While the focus of this particular test is on our IPS’s ability to block known exploits – which we clearly do well – and not on attack surface reduction, Palo Alto Networks has long known that reducing the attack surface through these mechanisms is the first step in effectively securing data center assets.

This latest NSS Labs DCIPS test report validates not only that blocking attacks at the exploit stage is an important tactic in preventing them, but also that our prevention technology stands up tall against data center threats and traffic loads. We hope that in sharing our test configurations, we can provide valuable information to practitioners that will help them achieve a similarly strong preventive stance against evasions and exploits in their data centers.

Read the full NSS Labs DCIPS test report.

Lee Klarich

[Palo Alto Networks Research Center]

Congratulations to those who solved an introductory challenge hidden in our initial LabyREnth announcement!

If you decode the binary in the Palo Alto Networks logo on http://labyrenth.com, you get the following ascii message:

“For reals yall. Has anyone really been far as decided to use XOR even go want to do look more like? You’ve got to even have been kidding me with this PAN. I’ve been further even more decided to use even go need to do look more as anyone can for Rules and even more than Prizes have been the Overviews. Can you really be far from Ordering even as decided half as much to use Digits go wish for that?”

This message gives you a clue about how to decode the rest of the binary code. If you notice, certain words are capitalized: XOR PAN Rules Prizes Overviews Ordering and Digits. If you take the binary from the digits in the countdown clock, in order from 0 through 9, and XOR them with the key PAN, you’ll get the URL for the Overview, Rules, and Prizes pages.

• Overview: http://labyrenth.com/1_d0nt_kn0w_wh3r3_1m_g01ng.html
• Rules: http://labyrenth.com/8ut_1_pr0m1s3.html 
• Prizes: http://labyrenth.com/1t_w0nt_83_80r1ng.html

As you can see, we’ll be giving away $16,000 in cash prizes, and participation prizes for anyone that finishes a track or all of the challenges. We hope you enjoy the LabyREnth challenge!

The challenge will start on Friday July 15, 2016, at 4pm PST and will run until August 14, 2016, at 11:59pm PST.

Follow the countdown at LabyREnth, and check out the overview of the challenge. Information about the rules and prizes are also there, if you are clever enough to find them! We’ll announce updates here on the blog and through Twitter: @unit42_intel, @wartortell, and #labyrenth.

Richard Wartell

[Palo Alto Networks Research Center]

Discover which applications and threats are exposing vulnerabilities in your security posture using our Security Lifecycle Review (SLR). Learn how you can benefit from our comprehensive SLR report in this video by Scott Simkin, Senior Threat Intelligence Manager.

Additional Resources

• Whitepaper: Top Recommendations to Prevent Ransomware
• At a Glance Automated Correlation Engine
• Safely Enable SaaS
• Whitepaper: Securing System & Application Vulnerabilities on the Network
• Whitepaper: Top 3 Security Considerations for the Cloud

[Palo Alto Networks Research Center]

On June 21st our CEO, Mark McLaughlin, spoke in front of President Obama’s Commission on Enhancing National Cybersecurity. The Commission is holding open meetings around the country to hear from cybersecurity experts and gather input for a set of recommendations they are expected to announce in December. Mark was one of a handful of CEOs and technology officials from the Bay Area to present to the Commission at its conference focused on “Innovation for the Future of the Digital Economy.”

This Commission has its work cut out for them. Enhancing national cybersecurity is a massive challenge, and there are no simple, quick-fix solutions. Yet, it is a challenge that must be undertaken—and one that can be successful.

At the heart of the current cybersecurity battle is a math problem. Unfortunately, today, this math problem overwhelmingly favors our adversaries. Here’s why: The cost of computing power required for malicious actors to launch successful cyberattacks has been decreasing dramatically for decades. Coupled with the widespread availability of black market malware and exploits, our adversaries are able to conduct increasingly automated, successful attacks at little to no cost.

In the face of this automated onslaught, the network defender is generally relying on decades-old security technologies, often cobbled together as multiple layers of point products that are not designed to communicate with each other. This lack of automation and interoperability has become increasingly problematic as networks grow in complexity due to macro technology trends like the adoption of virtualization, software as a service (SaaS) technologies, cloud computing, mobility, and the internet of things. This increased complexity of enterprise architecture and independent security controls creates a dependence on one of the least scalable resources organizations have—people—to manually fight automated, machine-generated attacks. As defenders, we are simply losing the economics of the cybersecurity problem.

That’s why cybersecurity innovation must be focused on prevention.

Prevention means significantly decreasing the likelihood—and increasing the cost—of malicious actors launching a successful attack. We should not assume that attacks are going away or that all attacks can be stopped. The outcome we should strive for isn’t to eliminate all risk but to change the economics by making it more expensive in terms of resources, time and personal impact to launch a successful attack.

Innovative approaches—effectively applied to people, process and technology—can be one of the key principles in regaining leverage against our adversaries and achieving prevention.

First, we must develop technologies that work together seamlessly to enhance the security of individuals, enterprises, and the broader ecosystem. Simplification and automation are essential for making networks adequately defensible. Security technologies must be leveraged as part of natively integrated platforms, and capable of automatic reprogramming based on new threat information, to prevent threats across all stages of the attack lifecycle—on the network, in the cloud, and at the endpoint.

For example, Palo Alto Networks next-generation firewall customers around the world receive new preventive measures every five minutes – these average 1.1 MILLION new preventive measures week – based on the automated discoveries made by our WildFire advanced persistent threat detection capabilities. There is no way that people could manually generate this volume of prevention to keep up with the evolving threats seen across our base of 30,000+ customers.

To build upon such a platform, security technologies need to be fully integrated as part of a larger, global ecosystem. More specifically, this ecosystem must incentivize information sharing, leverage open source integration APIs, and develop interoperable technologies capable of automated security—including through partnership with complementary technologies from third-party companies.

We also need to ensure that our workforce is trained and leveraged with the right mix of automation. If we build our workforce development plans on a foundation of automated technology, we can ensure that we are recruiting and training people in a more targeted way for only those jobs that require a human’s sophistication and critical thinking. Absent automated defense, we are left with the impossible task of staffing every organization’s security operation’s center with tens of thousands of people simply responding to alerts of successful attacks. As our adversaries become increasingly automated, it is simply unscalable as a defense model to manually combat functions that could be more effectively addressed by automated technology.

Finally, we need to start educating children at the earliest possible age so that cybersecurity is fundamental. We must ensure that hands-on training with innovative security technologies is ingrained in educational curriculum. And we must leverage innovative technologies, like those that enable long-distance virtualized learning, to educate more people, and faster.

We applaud the tremendous work being done by the new Commission, and, as a company, were honored to be part of their deliberations. We hope if they only remembered one word from Mark’s presentation that it was “prevention.”

Ryan Gillis

[Palo Alto Networks Research Center]