Transcription
Next-Generation CyberRisk ManagementPalo Alto Networks Support for the NISTCybersecurity FrameworkThe national and economic security of the United States increasingly dependson the reliable function of cyber-dependent critical infrastructure. In 2013, thepresident issued Executive Order 13636, directing the US National Instituteof Standards and Technology (NIST) to develop a voluntary CybersecurityFramework (CSF) based on existing standards, guidelines, and practices forreducing cyber risk to critical infrastructure. Since the release of CSF 1.0 inFebruary 2014, organizations worldwide have implemented the frameworkto help them better understand and manage cyber risk. To stay current withevolving threats and risk mitigation strategies an updated framework, CSFversion 1.1 was released in April 2018. This update provides additional guidanceon authentication and identity, self-assessing cybersecurity risk, managingcybersecurity within the supply chain, and addressing vulnerability disclosure.Palo Alto Networks Next-Generation Cyber Risk Management Brief1
Why Use the CybersecurityFramework?How Palo Alto NetworksSupports the CSFThe CSF can be applied to businesses of all sizes, across regionsand industries, and is being incorporated into national riskframeworks around the globe. Given its proven ability to aidin risk management and reduction, some industries have even begun to mandate its implementation. The White House issuedan executive order in May 2017 requiring all federal agencies toimmediately begin using the CSF to assess and manage cyberrisk to protect critical infrastructure in their enterprises.Palo Alto networks aligns with the CSF’s primary directive ofenabling critical infrastructure operations to effectively identify, manage, and reduce cyber risk. Rooted in prevention, thePalo Alto Networks product portfolio is natively integratedto counter cyberattacks before they manifest in an organization’s environment. With full visibility into traffic across theirnetworks, endpoints, and clouds, organizations can preventcyberattacks based on how or where applications and datareside or are being used. This allows critical infrastructureorganizations to identify the most serious ongoing threats tokey operations and reduce overall cybersecurity risk.Designed to foster positive and productive risk and cybersecurity management dialogue among internal and externalbusiness stakeholders, the CSF provides a common languagefor all appropriate teams, spanning IT, operations, security,finance, the C-suite, and boards of directors. Based on thisopen dialogue, organizations can more effectively quantifyrisk and prioritize investments to mitigate it.Reducing cyber risk requires having integrated, automated, andeffective controls in place to detect and prevent threats, bothknown and unknown, at every stage of the attack lifecycle. PaloAlto Networks provides key capabilities to enable the prevention of successful cyberattacks while empowering enterpriseswith best-in-class detection, investigation, automation, andresponse capabilities, as indicated in figure 1. Platform components offer core functionalities that support the five pillars ofthe CSF: Identify, Protect, Detect, Respond, and Recover. ThePalo Alto Networks product portfolio maps to 19 of the 23 CSFversion 1.1 categories.Figure 1: Pillars of the Security Operating PlatformNext-Generation Cyber Risk Management Brief2
Palo Alto Networks Mapping to the NIST Cybersecurity FrameworkTable 1: Identify (ID)CategoryAsset Management (ID.AM): The data, personnel,devices, systems, andfacilities that enable theorganization to achievebusiness purposes areidentified and managedconsistent with theirrelative importance toorganizational objectivesand the organization’srisk strategy.Business Environment(ID.BE): The organization’s mission, objectives, stakeholders, andactivities are understoodand prioritized; thisinformation is used to inform cybersecurity roles,responsibilities, and riskmanagement decisions.Governance (ID.GV): Thepolicies, procedures, andprocesses to manage andmonitor the organization’s regulatory, legal,risk, environmental, andoperational requirementsare understood and inform the management ofcybersecurity risk.SubcategoryPalo Alto NetworksProducts andSubscriptionsID.AM-2: Software platforms andapplications withinthe organization areinventoriedPalo Alto Networks can support this requirement with ournative App-ID technology. Multiple identification techniques are used to determine the exact identity of applicationstraversing your network. Applications using encryption or thatattempt to masquerade as legitimate traffic are also correctlyidentified, assisting with the inventory process. In addition,Prisma SaaS is a multi-mode cloud access security broker(CASB) service that allows you to govern sanctioned SaaSapplication usage across all users in your organization andprevent the risk from breaches and isma Access,Prisma SaaSID.AM-3: Organizational communication and data flowsare mappedPalo Alto Networks App-ID enables visibility into the applications on the network, so you can learn how they work andunderstand their behavioral characteristics and their relativerisk. This application knowledge allows you to create andenforce security policy rules to enable, inspect, and shapedesired applications and block unwanted applications. Whenyou define policy rules to allow traffic, App-ID begins toclassify traffic without any additional configuration. Thismapping is key to creating Zero Trust networks.Next-GenerationFirewall,VM-Series,Prisma AccessID.BE-5: Resiliencerequirements tosupport delivery ofcritical services areestablished for alloperating states (e.g.under duress/attack,during recovery,normal operations)Palo Alto Networks provides a redundant and highly available architecture to maintain continuous security for yourorganization’s services and infrastructure. Physical andvirtualized firewalls can be purchased and configured withredundant components and configurations. When PrismaAccess deploys corporate access nodes or security processingnodes in a location, the nodes operate by default in a highavailability active/passive design. You can configure bothservice connections and remote network connections to use asecondary WAN IPsec tunnel, and a second internet connection on your on-premises device to use the secondary WAN.If the primary WAN IPsec tunnel fails, the secondary WANIPsec takes tunnel over as the active tunnel. This design usesan active/passive method.Next-GenerationFirewall,VM-Series,Prisma andCortex clouddeliveredapplications andservicesID.GV-4: Governance and risk management processesaddress cybersecurity risksPalo Alto Networks offers Prisma Cloud, a cloud nativesecurity platform that provides comprehensive visibility,threat prevention, compliance assurance, and data protection in a consistent manner across multi-cloud environments. Prisma SaaS also provides governance for SaaSapplication data and usage regardless of whether the owneris an internal or an external user, or whether they use anorganization’s managed endpoints, a personal device, oran endpoint managed by another organization. Becauseit connects directly to your sanctioned SaaS applicationsthrough the application’s API, Prisma SaaS even providesgovernance to data stored in the application before thedeployment of the service.Prisma Cloud,Prisma SaaSNext-Generation Cyber Risk Management Brief3
Table 1: Identify (ID) (continued)CategorySubcategoryID.RA-1: Assetvulnerabilities areidentified anddocumentedRisk Assessment (ID.RA):The organization understands the cybersecurityrisk to organizationaloperations (includingmission, functions,image, or reputation),organizational assets, andindividuals.Supply Chain RiskManagement (ID.SC):The organization’s priorities, constraints, risk tolerances, and assumptionsare established and usedto support risk decisionsassociated with managing supply chain risk. Theorganization has established and implementedthe processes to identify,assess and manage supplychain risks.Palo Alto NetworksVulnerability Protection Profiles are used to stop attempts toexploit system flaws or gain unauthorized access to systems.All attempts to exploit a vulnerability are documented.Products andSubscriptionsPrisma Cloud,Prisma Access,ThreatPrevention,WildFire,Cortex XDR ProNext-GenerationFirewallCortex XSOAR threat intelligence platform allows the aggregation of intelligence between trusted organizations tosimplify the collection and correlation of intelligence data. Inaddition, the AutoFocus service enables you to easily identifycritical attacks so that you can triage effectively and takeaction without requiring additional security resources. AutoFocus correlates threat data from your network, industry, andglobal intelligence feeds, and surfaces what’s most important.Our FedRAMP-authorized, cloud-delivered malware service,WildFire , enables automated sharing of threat signatures soall stakeholders can benefit from threats discovered across allorganizations and globally.WildFire,AutoFocusID.RA-3: Threats,both internal andexternal, are identified and documentedFeatures of our offering identify and prevent threats acrossthe full attack lifecycle. Threat prevention is accomplished viathe capabilities of our Next-Generation Firewall, includingIPS, malware protection, and URL Filtering, to block knowncommand-and-control traffic. WildFire malware preventionservice identifies zero-day exploits and unknown malwareutilizing our dynamic sandbox analysis environment.Cortex XDR,Cortex Data Lake,Prisma Access,URL Filtering,ThreatPrevention,WildFire,Prisma SaaS,DNS Security,AutoFocusID.SC-1: Cybersupply chain riskmanagement processes are identified, established,assessed, managed,and agreed to byorganizationalstakeholdersOn February 4, 2020, the NIST published its case study on PaloAlto Networks supply chain best practices. See NIST CyberSupply Chain Risk Management (C-SCRM) Publication here.ID.RA-2: Cyberthreat intelligenceis received frominformation sharingforums and sourcesNext-Generation Cyber Risk Management Brief4
Table 2: Protect (PR)CategoryIdentity Management,Authentication andAccess Control (PR.AC):Access to physical andlogical assets and associated facilities is limitedto authorized users, processes, and devices, andis managed consistentwith the assessed risk ofunauthorized access toauthorized activities andtransactions.SubcategoryPalo Alto NetworksProducts andSubscriptionsPR.AC-1: Identitiesand credentials areissued, managed,verified, revoked,and audited forauthorized devices,users and processesPalo Alto Networks supports this requirement with User-ID onour Next-Generation Firewalls and Prisma Access, which canrestrict access to devices for only authorized users and furtherrestrict access to specific applications on those authorizeddevices. In addition, credential phishing prevention works byscanning username and password submissions to websitesand comparing those submissions against valid corporatecredentials.Next-GenerationFirewall, PrismaAccess,VM-SeriesPR.AC-3: Remoteaccess is managedPalo Alto Networks allows remote access to authorized usersand to authorized destinations via the use of Prisma Accessor GlobalProtect network security for endpoints. ThePrisma Access service helps you deliver consistent securityto your remote networks and mobile users. GlobalProtectextends the protection of our Next-Generation Firewallsto your mobile workforce. Security policies and full threatprevention are enforced consistently for remote access withno gap in coverage.Prisma Access,GlobalProtectPR.AC-4: Accesspermissions andauthorizations aremanaged, incorporating the principlesof least privilege andseparation of dutiesPalo Alto Networks supports management-access segmentation to enforce separation by functional or regional areas,as well as administrator-based commits in change controland the ability to revert individual changes as necessary.Panorama,Prisma Access,Next- GenerationFirewallPR.AC-5: Networkintegrity is protected (e.g., network segregation, network segmentation)In addition to securing Trusted Internet Connections (TIC)and data centers, Palo Alto Networks is addressing theincreasingly pervasive nature of lateral attacks and dataexfiltration techniques. Through network segmentation viaour Next-Generation Firewalls, we can further reduce theattack surface with a zone-based Zero Trust approach toprotecting sensitive information.Next-GenerationFirewall,VM- SeriesPR.AC-6: Identitiesare proofed andbound to credentials and asserted ininteractionsUser identity, as opposed to an IP address, is an integralcomponent of an effective security infrastructure. Knowingwho is using each of the applications on your network, andwho may have transmitted a threat or is transferring files,can strengthen security policies and reduce incident responsetimes. User-ID technology, a standard feature on Palo AltoNetworks firewalls, enables you to leverage user informationstored in a wide range of repositories.Next-GenerationFirewall,VM- SeriesPR.AC-7: Users,devices, and other assets are authenticated(e.g., single-factor,multi-factor) commensurate with therisk of the transaction(e.g., individuals’security and privacyrisks and other organizational risks)Palo Alto Networks provides support for MFA vendorsthrough application content updates. MFA vendor API integrations are supported for end-user authentication throughAuthentication Policy. For remote user authentication toGlobalProtect Portals or Gateways, or for administratorauthentication to the PAN-OS or Panorama networksecurity management web interface, you can use MFA vendors supported through RADIUS or SAML. Administratorsauthenticate to access the web interface, CLI, or XML API ofthe firewall and Panorama. End users authenticate throughCaptive Portal or GlobalProtect to access various servicesand applications. You can choose from several authentication services to protect your network and accommodateyour existing security infrastructure while ensuring asmooth user experience. If you have a public key infrastructure, you can deploy certificates to enable authentication without users having to manually respond to loginchallenges (see Certificate Management). Alternatively, orin addition to certificates, you can implement interactiveauthentication, which requires users to authenticate usingone or more methods.Next-GenerationFirewall,VM- Series,Prisma AccessNext-Generation Cyber Risk Management Brief5
Table 2: Protect (PR) (continued)CategorySubcategoryAwareness and Training(PR.AT): The organization’s personnel andpartners are providedcybersecurity awarenesseducation and are trainedto perform their cybersecurity-related duties andresponsibilities consistentwith related policies, procedures, and agreements.Data Security (PR.DS):Information and records(data) are managed consistent with the organization’s risk strategy toprotect the confidentiality,integrity, and availabilityof information.Palo Alto NetworksProducts andSubscriptionsPR.AT-2: Privilegedusers understandtheir roles and responsibilitiesPalo Alto Networks WildFire: U.S. Government cloud is ahigh-security malware analysis platform that is FederalRisk and Authorization Management Program (FedRAMP)authorized. This WildFire cloud environment is intended foruse only by US federal agencies that require a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. WildFiremeets NIST 800-53 rev4 Moderate requirements. PrismaCloud, Cortex XDR , and Cortex Data Lake have reached FedRAMP In Process status.WildFire, CortexXDR, Cortex DataLakePR.AT-3: Third- party stakeholders(e.g., suppliers,customers, partners) understandtheir roles and responsibilitiesThe Palo Alto Networks WildFire: U.S. Government cloud isa high-security malware analysis platform that is FederalRisk and Authorization Management Program (FedRAMP)authorized. This WildFire cloud environment is intended foruse only by US federal agencies that require a standardizedapproach to security assessment, authorization, and continuous monitoring for cloud products and services. WildFiremeets NIST 800-53 rev4 Moderate requirements. PrismaCloud, Cortex XDR, and Cortex Data Lake have reached FedRAMP In Process status.WildFire, CortexXDR, Cortex DataLakePR.DS-1: Data-atrest is protectedPalo Alto Networks can support the protection of data at restusing a Zero Trust approach to restricting access using theApp-ID and User-ID technology features of our Next- Generation Firewalls. Prevention of unauthorized access todata is a primary function of our platform. Additionally, toensure that snapshots and other data at rest are safe, PrismaCloud uses AWS Key Management Service (KMS) to encryptand decrypt the data. Prisma SaaS provides visibility intostored data and historical activities so you can explore andinvestigate them on demand. Because visibility also extendsinto the access logs, you can see who accessed your data andwhen, even if the users were external.Next-GenerationFirewall, PrismaCloud, PrismaSaaSPR.DS-2: Data-in-transit isprotectedPalo Alto Networks protects data in transit as it traverseseither the Trusted Internet Connection (TIC)/Gateways,data center, or network segments protected with ourNext-Generation Firewall using IPsec tunnels, User-ID,App-ID, Content-ID, and zone-based methods. Using ourPrisma Cloud technology, data in transit is also protectedusing a TLS connection at the Elastic Load Balancer (ELB)and secured between components within the data centerusing an internal certificate until it is terminated at the application node. This ensures that data in transit is encryptedusing SSL.Next-GenerationFirewall,VM- Series,Prisma CloudPR.DS-4: Adequatecapacity to ensureavailability is maintainedPR.DS-5: Protections against dataleaks are implementedPalo Alto Networks products may scale elastically in virtualenvironments and cloud infrastructure based upon actualworkload demands.Prisma Cloud,Prisma Access,Prisma SaaS,Cortex XDR,Cortex DataLake,WildFire,AutoFocus,VM-SeriesPalo Alto Networks employs a number of techniques acrosseach stage of the attack lifecycle to help prevent data frombeing exfiltrated from your protected network. In additionto blocking known malware and command-and-controldestinations by DNS or URL, we also inspect and can stoptraffic that violates data and regulatory compliance policies,credential theft due to phishing attempts, or attempts to hidethreats using encryption.Prisma Access,Prisma SaaS,DNS Security,URL ation Cyber Risk Management Brief6
Table 2: Protect (PR) (continued)CategoryData Security (PR.DS):Information and records(data) are managed consistent with the organization’s risk strategy toprotect the confidentiality,integrity, and availabilityof information.Information ProtectionProcesses and Procedures (PR.IP): Securitypolicies (that addresspurpose, scope, roles,responsibilities, management commitment,and coordination amongorganizational entities),processes, and proceduresare maintained and usedto manage protection ofinformation systems andassets.SubcategoryPalo Alto NetworksProducts andSubscriptionsPR.DS-6: Integritychecking mechanisms are used toverify software,firmware, and information integrityPalo Alto Networks provides checksum values (both MD5 andSHA-256) for all software downloads, including dynamicupdates, so that file integrity can be confirmed.Next-GenerationFirewall, PrismaCloud, PrismaSaaSPR.DS-7: The development and testingenvironment(s) areseparate from theproduction environmentPalo Alto Networks supports the requirements to keepdevelopment and testing environments separate using ourNext-Generation Firewall to segment traffic between zonesin order to restrict or completely deny traffic as required.Next-GenerationFirewall,VM- SeriesPR.DS-8: Integritychecking mechanisms are used toverify hardwareintegrityPalo Alto Networks products have been validated againstFIPS 140-2. Palo Alto Networks provides hardware FIPSkits that include tamper-evident seals and opacity shieldsinstalled as indicated in the NIST Security Policy. The multichip standalone modules are production-quality and containstandard passivation. Chip components are protected by anopaque enclosure. Tamper-evident seals are applied to modules by the Crypto Officer to prevent removal of the opaqueenclosure without evidence.See Palo AltoNetworksTechnicalCertificationsPR.IP-1: A baselineconfiguration ofinformation technology/industrialcontrol systems iscreated and maintained incorporatingsecurity principles(e.g. concept of leastfunctionality)Zingbox IoT Guardian automates the IoT lifecycle throughdevice onboarding, provisioning, security, management,and safe device removal. The Panorama management serverprovides centralized monitoring and management of multiple Palo Alto Networks Next-Generation Firewalls, providing a single solution from which you can oversee all IT/OTapplications and devices.Next-GenerationFirewall,VM- Series,Zingbox,PanoramaPR.IP-2: A SystemDevelopment LifeCycle to managesystems is implementedDevOps teams are challenged to deliver solutions as fast aspossible, without compromising on security, compliance,and quality of code. Prisma Cloud’s powerful CI/CD capabilities allow developers to see vulnerability status everytime they run a build, without having to run a separate tool.Security teams can set policies that act as quality controlgates. DevSecOps introduces a security-focused mindset andbest practices into traditional DevOps processes. Securitydecisions become an integral part of the workflow withoutsacrificing speed or slowing down development.Prisma CloudPR.IP-3: Configuration change controlprocesses are inplacePalo Alto Networks supports the implementation of a robustchange control process. Granular role-based administrator-level control and the ability to document and revertindividual changes allow precise control and restrictionof administrator capabilities as necessary to comply withchange control processes.Next-GenerationFirewall,Panorama,Prisma Cloud,Prisma AccessPR.IP-4: Backupsof information areconducted, maintained, and testedPanorama network security management supports the abilityto schedule or manually export up to 100 versions for eachfirewall. Configurations can also have scheduled exports toFTP or SCP servers to ensure backup integrity. Restores caneasily be tested and reverted as needed to comply with policy.PanoramaNext-Generation Cyber Risk Management Brief7
Table 2: Protect (PR) (continued)CategorySubcategoryPalo Alto NetworksPR.IP-7:Protection processesare improvedPalo Alto Networks threat intelligence products and serviceswork with technology partners and customers to automateidentification of known threats for all. Protections against allpreviously unknown advanced persistent threats and zero-dayattacks are automatically distributed to all customers in as fewas five minutes, ensuring that our platform is always learningand improving.Cortex XDR and XSOAR, simplifies deployment and reducesinfrastructure and operational overhead by leveraging AIbased continuous security operations.Information ProtectionProcesses and Procedures (PR.IP): Securitypolicies (that addresspurpose, scope, roles,responsibilities, management commitment,and coordination amongorganizational entities),processes, and proceduresare maintained and usedto manage protection ofinformation systems andassets.Products andSubscriptionsWildFire CortexXDR, AutoFocus,DNS Security,ThreatPrevention,Cortex XSOARPR.IP-8: Effectiveness of protectiontechnologies issharedAutoFocus provides instant access to the massive repositoryof Palo Alto Networks threat intelligence crowd-sourcedfrom the largest footprint of network, endpoint, and cloudintel sources. The combination of Cortex Data Lake andPanorama management delivers an economical, cloudbased logging solution for Palo Alto Networks Next-Generation Firewalls. Also, WildFire (FedRAMP) automaticallystops the latest threats targeting government agencies withreal-time data from the industry’s largest threat sharingcommunity.Cortex XDR,Cortex DataLake,AutoFocus,Panorama,WildFirePR.IP-11: Cybersecurity is included inhuman r esourcespractices (e.g.,deprovisioning, personnel screening)Palo Alto Networks supports the automation of HR activities using built-in features such as User-ID, which leverages account information stored in a range of enterprisedirectories. By taking advantage of security policies basedon individual user or account groups, we can automaticallyrestrict access to network resources based on account andduring HR deprovisioning.Next-GenerationFirewall,VM- SeriesPR.IP-12: A vulnerability managementplan is developedand implementedAs part of a comprehensive vulnerability management plan,Palo Alto Networks can automatically prevent threats usingthe latest threat intelligence. Cortex XDR provides full protection regardless of vulnerabilities by focusing on the exploittechniques today’s attackers use, as opposed to relying onstatic virus definitions that are ineffective against today’sdynamic attacks.As a core element of our cloud-delivered malware preventionservice, WildFire is a large distributed sensor system thatidentifies and prevents unknown threats, with tens of thousands of subscribers contributing to the collective community.With a combination of our NGFW and threat prevention subscription, you’ll be able to defend your network against bothcommodity threats—which are pervasive but not sophisticated—and targeted, advanced threats perpetuated by organizedcyber adversaries.Next-Generation Cyber Risk Management BriefNext-GenerationFirewall, ThreatPrevention,WildFire, CortexXDR8
Table 2: Protect (PR) (continued)CategorySubcategoryMaintenance (PR.MA):Maintenance and repairsof industrial control andinformation system components are performedconsistent with policiesand procedures.Protective Technology(PR.PT): Technical securitysolutions are managed toensure the security andresilience of systems andassets, consistent with related policies, procedures, and agreements.Protective Technology(PR.PT): Technical securitysolutions are managed toensure the security andresilience of systems andassets, consistent with related policies, procedures, and agreements.PR.MA-2: Remotemaintenance oforganizational assetsis approved, logged,and performed in amanner that prevents unauthorizedaccessPalo Alto NetworksThe Panorama management server provides centralizedmonitoring and management of multiple Palo Alto NetworksNext-Generation Firewalls and of WildFire appliances andappliance clusters. It provides a single location from whichyou can oversee all applications, users, and content traversing your network, so you can use this knowledge to createapplication enablement policies that protect and control thenetwork. Using Panorama for centralized policy and firewallmanagement increases operational efficiency in managingand maintaining a distributed network of firewalls.Products andSubscriptionsPanorama,GlobalProtect,Prisma AccessPanorama implements Role-Based Access Control (RBAC)to enable you to specify the privileges and responsibilitiesof administrators. The service supports Local Authentication that the firewall provides or External AuthenticationServices. The authentication also defines options such asKerberos single sign-on (SSO), multi-factor authenticationand SAML 2.0.PR.PT-1: Audit/logrecords are determined, documented,implemented, andreviewed in accordance with policyCortex XDR is the industry’s only prevention, detection, andresponse platform that runs on fully integrated endpoint,network, and cloud data. The combination of Cortex Data Lakeand Panorama delivers an economical, cloud-based loggingsolution for Palo Alto Networks Next-Generation Firewalls.The Log Forwarding app enables you to share your data withthird-party tools like security information and event management (SIEMs) systems to power use cases such as dataarchiving and log retention for compliance.PR.PT-2: Removablemedia is protectedand its use restrictedaccording to policyCortex XDR Pro can protect against removable media by restricting execution of files from such devices.Cortex XDR ProPR.PT-3: The principle of least functionality is incorporatedby configuring systems to provide onlyessential capabilitiesPalo Alto Networks supports this requirement with theNext-Generation Firewall, using zone-based controls toprovide network segmentation. By establishing Zero Trustboundaries that effectively compartmentalize differentsegments of the network, you can protect critical intellectualproperty from unauthorized applications or users, reduce theexposure of vulnerable systems, and prevent the lateral movement of malware throughout your network.Prisma Access,Next-GenerationFirewall,VM- SeriesPR.PT-4: Communications andcontrol networks areprotectedPalo Alto Networks can support the protection of communications and control networks by taking a Zero Trust approachto restricting access, using App-ID and User-ID on ourNext-Generation Firewall. Prevention of unauthorized accessto data and network segmentation are primary functions ofour platform that allow protection and isolation betweennetworks.Next-GenerationFirewall,VM- Series,Prisma AccessPR.PT-5: Mechanisms (e.g., failsafe,load balancing, hotswap) are implemented to achieveresilience requirements in normal andadverse situationsPalo Alto Networks firewalls and Panorama are capable of operating in both active/active and active/passive high availability modes of operation. In either mode, constant synchronization ensures both systems share the same configuration andstate in order to seamlessly continue operation in the eventof a system, link, or network failure. In active/active, bothfirewalls in the pair remai
How Palo Alto Networks Supports the CSF. Palo Alto networks aligns with the CSF's primary directive of enabling critical infrastructure operations to effectively iden-tify, manage, and reduce cyber risk. Rooted in prevention, the Palo Alto Networks product portfolio is natively integrated to counter cyberattacks before they manifest in an .
