The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.
From Palo Alto Networks ALG Security Technical Implementation Guide
Part of SRG-NET-000364-ALG-000122
Associated with:
CCI-002403
SV-77095r1_rule
The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.
Vulnerability discussion
Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application-level firewalls and Web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate.Security policies on the Palo Alto Networks security platform match source, destination, application and a service. The application and service columns specify what applications can be identified on a defined set of ports, or on all available ports. The service column allows administrator to define one of the following:Application-default - The service application-default sets security policy to allow the application on the standard ports associated with the application.Pre-defined service “service-http” and “service-https” - The pre-defined services use TCP ports 80 and 8080 for HTTP, and TCP port 443 for HTTPS. Use this security policy if you want to restrict web browsing and HTTPS to these ports.Any - Use this service to deny applications.Custom service - Use this to define TCP/UDP port numbers to restrict applications to specific ports.
Check content
Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification or Accreditation Package.
Go to Policies >> Security; review each of the configured security policies in turn.
If any of the policies allows traffic that is not part of the authorized sources and destinations list, this is a finding.
Fix text
To create or edit a Security Policy,
Go to Policies >> Security
Select "Add" to create a new security policy, or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
Pro Tips
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer