Home
Security Hardening
DISA STIG Palo Alto Alg V2R2

DISA STIG Palo Alto Alg V2R2

DISA_STIG_Palo_Alto_Networks_ALG_STIG_v2r2.audit from DISA Palo Alto Networks ALG v2r2 STIG
See Also https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_PAN_Y21M07_STIG.zip This control applies to the following type of system Palo_Alto. Source Tenable.com/audits
PANW-AG-000015 – The Palo Alto Networks security platform, if used to provide intermediary services for remote access communications traffic (TLS or SSL decryption), must ensure inbound and outbound traffic is monitored for compliance with remote access security policies – TLS/SSL must monitor traffic.
Details Automated monitoring of remote access traffic allows organizations to detect cyber attacks and also ensure ongoing compliance with remote...
PANW-AG-000016 – The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
Details Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Encryption provides...
PANW-AG-000017 – The Palo Alto Networks security platform that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.
Details Private key data is used to prove that the entity presenting a public key certificate is the certificate’s rightful...
PANW-AG-000020 – The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
Details Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the...
PANW-AG-000052 – The Palo Alto Networks security platform must terminate communications sessions after 15 minutes of inactivity.
Details Idle sessions can accumulate, leading to an exhaustion of memory in network elements processing traffic flows. Note that the...
PANW-AG-000060 – The Palo Alto Networks security platform must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.
Details In order to minimize any potential negative impact to the organization caused by malicious code, malicious code must be...
PANW-AG-000062 – The Palo Alto Networks security platform must drop malicious code upon detection – Antivirus Profiles.
Details Malicious code is designed to compromise information systems; therefore, it must be prevented from being transferred to uninfected hosts....
PANW-AG-000062 – The Palo Alto Networks security platform must drop malicious code upon detection – Antivirus Services.
Details Malicious code is designed to compromise information systems; therefore, it must be prevented from being transferred to uninfected hosts....
PANW-AG-000063 – The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection – Antivirus Profiles
Details Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of this code on the...

DISA STIG Palo Alto Alg V2R2

DISA_STIG_Palo_Alto_Networks_ALG_STIG_v2r2.audit from DISA Palo Alto Networks ALG v2r2 STIG

PANW-AG-000016 – The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.

PANW-AG-000017 – The Palo Alto Networks security platform that stores secret or private keys must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys.

PANW-AG-000020 – The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.

PANW-AG-000052 – The Palo Alto Networks security platform must terminate communications sessions after 15 minutes of inactivity.

PANW-AG-000060 – The Palo Alto Networks security platform must update malicious code protection mechanisms and signature definitions whenever new releases are available in accordance with organizational configuration management policy and procedures.

PANW-AG-000062 – The Palo Alto Networks security platform must drop malicious code upon detection – Antivirus Profiles.

PANW-AG-000062 – The Palo Alto Networks security platform must drop malicious code upon detection – Antivirus Services.

PANW-AG-000063 – The Palo Alto Networks security platform must delete or quarantine malicious code in response to malicious code detection – Antivirus Profiles