STIGQter: STIG Summary: Palo Alto Networks NDM Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 24 Jan 2020:

The Palo Alto Networks security platform must use DoD-approved PKI rather than proprietary or self-signed device certificates.

DISA Rule

SV-77267r1_rule

Vulnerability Number

V-62777

Group Title

SRG-APP-000516-NDM-000344

Rule Version

PANW-NM-000141

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-001159 - The organization issues public key certificates under an organization-defined certificate policy or obtains public key certificates from an approved service provider.

Weight

10

Fix Recommendation

Obtain a Device Certificate from the DoD PKI or from a DoD-approved PKI:
Go to Device >> Certificate Management >> Certificates
Select "Import" (at the bottom of the pane).
In the "Import Certificate" pane, complete each field.
Select "OK".

Check Contents

Go to Device >> Certificate Management >> Certificates
Installed Certificates are listed in the "Device Certificates" tab.
If any of the have the name or identifier of a non-approved source in the "Issuer" field, this is a finding.

Vulnerability Number

V-62777

Documentable

False

Rule Version

PANW-NM-000141

Severity Override Guidance

Go to Device >> Certificate Management >> Certificates
Installed Certificates are listed in the "Device Certificates" tab.
If any of the have the name or identifier of a non-approved source in the "Issuer" field, this is a finding.

Check Content Reference

M

Target Key

2811

Comments