1. Complete visibility
You can’t prevent what you can’t see. Full visibility into the (mobile, network & cloud) environment across all traffic (encrypted or not) is essential. Your Palo Alto firewall analyses all traffic to provide that visibility with its Single Pass architecture allowing for predictable performance. This extends to all mobile devices with the GlobalProtect feature. The IoT security is providing full visibility on all connected devices on your network.

2. Reduce attack surface
Use a positive enforcement model to reduce the attack surface. This means only letting traffic through that is allowed by the policy, including granting access to the required function of an application and denying everything else. Furthermore, you should enforce multi-factor authentication where needed or if identity theft is suspected. DNS security is reducing the risk of malware abusing the DNS protocol. IoT security can provide behavioral learning of IoT devices and providing

security policies on the Palo Alto Networks Firewall.

3. Prevent known threats
You can’t let a known piece of malware or spyware traverse your environment or make your endpoints communicate with known-malicious sites. Palo Alto Networks’ Threat Prevention and URL-Filtering feature provide those prevention capabilities. Palo Alto Networks’ MineMeld allows extending that knowledge to third party feeds.

4. Prevent unknown threats
You must stop new threats as quickly as possible. You must find the unknown threat, reveal it, make it known, and stop it everywhere through automated updates. The Palo Alto Networks’ Wildfire feature provides that prevention capability for files. On the DNS side the DNS security reveals when DNS is misused to tunnel data, by malware to communicated with the control server.

Palo Alto Networks provides multiple protection features to cope with threats on each of the four levels mentioned above:

1.     Palo Alto Networks’ Threat Prevention Feature

The Threat Prevention subscription protects the network from advanced threats by identifying and scanning all traffic – applications, users, and content – across all ports and protocols with predictable performance.

It includes a full-featured IPS allowing to define vulnerability matching rules within a next-generation policy, and you can add anti-malware scanning when and where required. Furthermore, Threat Prevention provides command-and-control protection through pattern definition of known botnets. Analysis of DNS queries for botnet patterns and sinkholing technology prevent that traffic from getting through.

2.     Palo Alto Networks’ URL-Filtering Feature

You can enforce web browsing policies (per device subscription for unlimited users) with Palo Alto Networks’ URL-Filtering subscription. This subscription enables the enforcement of an acceptable use policy,

the blocking of threats sites, e.g., known malware, phishing or proxy-avoiding sites.

Palo Alto Networks’ Firewall enables the definition of policies which allow a positive security paradigm. This means only allowing access to data through authorized applications for authorized users and only for the required content type. This can be combined with the decryption policy which leaves privacy-sensitive categories encrypted.

3.     Palo Alto Networks’ Wildfire Feature

Protection from previously unknown threats (Zero-Day threats, APT) can be provided through the Wildfire feature. WildFire is a cloud-based advanced threat intelligence service that identifies unknown malware, Zero-Day exploits, and advanced persistent threats (APTs) through static and dynamic analysis in a scalable, virtual environment. Through updates, WildFire automatically generates malware, URL and DNS signatures and distributes them in seconds to all global, WildFire-subscribed Palo Alto Networks platforms. For PE files (exe, dll, PowerShell) the static analysis with ML based technology is done on the firewalls, no need to upload to the cloud, to lower the risk of a patient zero on your network.

The Palo Alto Networks’ Wildfire file analysis includes the following steps: