STIGQter: STIG Summary: Palo Alto Networks ALG Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.

DISA Rule

SV-228861r557387_rule

Vulnerability Number

V-228861

Group Title

SRG-NET-000362-ALG-000126

Rule Version

PANW-AG-000105

Severity

CAT II

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

To add a Vulnerability Protection Profile:
Go to Objects >> Security Profiles >> Vulnerability Protection
Select "Add".
In the "Vulnerability Protection Profile" window, complete the required fields.
In the "Name" field, enter the name of the Vulnerability Protection Profile.
In the "Description" field, enter the description of the Vulnerability Protection Profile.
In the "Rules" tab, select "Add".
In the "Vulnerability Protection Rule" window,
In the "Rule Name" field, enter the Rule name,
In the "Threat Name" field, enter "any" (this will match all signatures),
In the "Action" field, select "block".
In the "Host type" field, select "any",
Select the checkboxes above the "CVE" and "Vendor ID" boxes.
In the "Severity" section, select the "critical", "high", and "medium" check boxes.
Select "OK".

In the "Vulnerability Protection Profile" window, select the configured rule, then select "OK".
Use the Profile in a Security Policy:
Go to Policies >> Security
Select an existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

Check Contents

Go to Objects >> Security Profiles >> Vulnerability Protection
If there are no Vulnerability Protection Profiles configured, this is a finding.

Ask the Administrator which Vulnerability Protection Profile is used for interzone traffic.
View the configured Vulnerability Protection Profiles.
Check the "Severity" and "Action" columns.
If the Vulnerability Protection Profile used for interzone traffic does not block all critical, high, and medium threats, this is a finding.

Go to Policies >> Security
Review each of the configured security policies in turn.
For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column.
If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Vulnerability Number

V-228861

Documentable

False

Rule Version

PANW-AG-000105

Severity Override Guidance

Go to Objects >> Security Profiles >> Vulnerability Protection
If there are no Vulnerability Protection Profiles configured, this is a finding.

Ask the Administrator which Vulnerability Protection Profile is used for interzone traffic.
View the configured Vulnerability Protection Profiles.
Check the "Severity" and "Action" columns.
If the Vulnerability Protection Profile used for interzone traffic does not block all critical, high, and medium threats, this is a finding.

Go to Policies >> Security
Review each of the configured security policies in turn.
For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column.
If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Check Content Reference

M

Target Key

4233

Comments