Home
Security Hardening
DISA STIG Palo Alto Alg V2R2

DISA STIG Palo Alto Alg V2R2

PANW-AG-000044 – The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.
Details A certificate’s certification path is the path from the end entity certificate to a trusted root certification authority (CA)....
PANW-AG-000047 – The Palo Alto Networks security platform must protect against the use of internal systems from launching Denial of Service (DoS) attacks against other networks or endpoints.
Details DoS attacks can take multiple forms but have the common objective of overloading or blocking a network or host...
PANW-AG-000049 – The Palo Alto Networks security platform must block phone home traffic.
Details A variety of Distributed Denial of Service (DDoS) attacks and other attacks use ‘botnets’ as an attack vector. A...
PANW-AG-000050 – The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.
Details A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber...
PANW-AG-000051 – The Palo Alto Networks security platform must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
Details A deny-all, permit-by-exception network communications traffic policy ensures that only those connections that are essential and approved are allowed....
PANW-AG-000080 – To protect against data mining, the Palo Alto Networks security platform must detect and prevent SQL and other code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.
Details Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering....
PANW-AG-000081 – To protect against data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.
Details Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering....
PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – Config Logs
Details Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process...
PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – Log Forwarding
Details Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process...
PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – Syslog
Details Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process...

Prev Next

DISA STIG Palo Alto Alg V2R2

PANW-AG-000044 – The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

PANW-AG-000047 – The Palo Alto Networks security platform must protect against the use of internal systems from launching Denial of Service (DoS) attacks against other networks or endpoints.

PANW-AG-000049 – The Palo Alto Networks security platform must block phone home traffic.

PANW-AG-000050 – The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.

PANW-AG-000051 – The Palo Alto Networks security platform must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

PANW-AG-000080 – To protect against data mining, the Palo Alto Networks security platform must detect and prevent SQL and other code injection attacks launched against data storage objects, including, at a minimum, databases, database records, queries, and fields.

PANW-AG-000081 – To protect against data mining, the Palo Alto Networks security platform must detect and prevent code injection attacks launched against application objects including, at a minimum, application URLs and application code.

PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – Config Logs

PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – Log Forwarding

PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – Syslog