Home
Security Hardening
DISA STIG Palo Alto Alg V2R2

DISA STIG Palo Alto Alg V2R2

PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – System Logs
Details Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process...
PANW-AG-000101 – The Palo Alto Networks security platform being used for TLS/SSL decryption using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certificate Authorities (CAs) for the establishment of protected sessions.
Details Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in...
PANW-AG-000102 – The Palo Alto Networks security platform must protect against Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds).
Details If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users. Installation of...
PANW-AG-000105 – The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.
Details If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users. Installation of...
PANW-AG-000107 – The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.
Details Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally,...
PANW-AG-000073 – The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code – Antivirus Actions
Details Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and...
PANW-AG-000109 – The Palo Alto Networks security platform must identify and log internal users associated with prohibited outgoing communications traffic.
Details Without identifying the users who initiated the traffic, it would be difficult to identify those responsible for the prohibited...
PANW-AG-000073 – The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code – Antivirus Policies
Details Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and...
PANW-AG-000111 – The Palo Alto Networks security platform must be configured to integrate with a system-wide intrusion detection system.
Details Without coordinated reporting between separate devices, it is not possible to identify the true scale and possible target of...
PANW-AG-000074 – The Palo Alto Networks security platform must prevent the download of prohibited mobile code – Antivirus Profiles
Details MMobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and...

Prev Next

DISA STIG Palo Alto Alg V2R2

PANW-AG-000094 – The Palo Alto Networks security platform must off-load audit records onto a different system or media than the system being audited – System Logs

PANW-AG-000101 – The Palo Alto Networks security platform being used for TLS/SSL decryption using PKI-based user authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certificate Authorities (CAs) for the establishment of protected sessions.

PANW-AG-000102 – The Palo Alto Networks security platform must protect against Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis (traffic thresholds).

PANW-AG-000105 – The Palo Alto Networks security platform must use a Vulnerability Protection Profile that blocks any critical, high, or medium threats.

PANW-AG-000107 – The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.

PANW-AG-000073 – The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code – Antivirus Actions

PANW-AG-000109 – The Palo Alto Networks security platform must identify and log internal users associated with prohibited outgoing communications traffic.

PANW-AG-000073 – The Palo Alto Networks security platform must deny or restrict detected prohibited mobile code – Antivirus Policies

PANW-AG-000111 – The Palo Alto Networks security platform must be configured to integrate with a system-wide intrusion detection system.

PANW-AG-000074 – The Palo Alto Networks security platform must prevent the download of prohibited mobile code – Antivirus Profiles