STIGQter: STIG Summary: Palo Alto Networks ALG Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Palo Alto Networks security platform must block phone home traffic.

DISA Rule

SV-228843r557387_rule

Vulnerability Number

V-228843

Group Title

SRG-NET-000192-ALG-000121

Rule Version

PANW-AG-000049

Severity

CAT II

CCI(s)

• CCI-001094 - The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.

Weight

10

Fix Recommendation

Go to Objects >> Security Profiles >> Anti-Spyware
Select the name of a configured Anti-Spyware Profile or select "Add" to create a new one.
In the "Anti-Spyware Profile" window, in the "DNS Signatures" tab, in the Action on "DNS queries" field, select "block" or "sinkhole".
If "sinkhole" is selected, complete the "Sinkhole IPv4" and "Sinkhole IPv6" fields.

Note: If DNS Sinkholing is used, the device and network must be configured to support it.

If this is a new Anti-Spyware Profile, complete the required fields in all tabs.
Select "OK".
Use the Anti-Spyware Profile in a Security Policy;
Edit the Security Policy Rule that allows traffic from client hosts in the trust zone to the untrust zone to include the sinkhole zone as a destination and attach the Anti-spyware Profile. Select or configure a rule that allows traffic from the client host zone to the untrust zone.

Go to Policies >> Security
Select the appropriate existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Anti-Spyware" field, select the configured Anti-Spyware Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

Check Contents

Ask the Administrator which Anti-Spyware profile is used:
Go to Objects >> Security Profiles >> Anti-Spyware
Select the Anti-Spyware Profile.
In the "Anti-Spyware Profile" window, in the "DNS Signatures" tab, in the Action on "DNS queries" field, if either "block" or "sinkhole" is not selected, this is a finding.

Ask the Administrator which Security Policy Rule allows traffic from client hosts in the trust zone to the untrust zone:
Go to Policies >> Security
Select the identified policy rule.
View the "Security Policy Rule" window.
Select the "Actions" tab.
In the "Profile Setting" section, in the "Anti-Spyware" field, if there is no Anti-Spyware Profile or the Anti-Spyware Profile is not the correct one, this is a finding.

Vulnerability Number

V-228843

Documentable

False

Rule Version

PANW-AG-000049

Severity Override Guidance

Ask the Administrator which Anti-Spyware profile is used:
Go to Objects >> Security Profiles >> Anti-Spyware
Select the Anti-Spyware Profile.
In the "Anti-Spyware Profile" window, in the "DNS Signatures" tab, in the Action on "DNS queries" field, if either "block" or "sinkhole" is not selected, this is a finding.

Ask the Administrator which Security Policy Rule allows traffic from client hosts in the trust zone to the untrust zone:
Go to Policies >> Security
Select the identified policy rule.
View the "Security Policy Rule" window.
Select the "Actions" tab.
In the "Profile Setting" section, in the "Anti-Spyware" field, if there is no Anti-Spyware Profile or the Anti-Spyware Profile is not the correct one, this is a finding.

Check Content Reference

M

Target Key

4233

Comments