{"id":21825,"date":"2016-11-16T09:30:43","date_gmt":"2016-11-16T17:30:43","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=21825"},"modified":"2016-11-16T09:16:47","modified_gmt":"2016-11-16T17:16:47","slug":"setting-expectations-prevention-readiness-measuring-prevention-capabilities","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2016\/11\/setting-expectations-prevention-readiness-measuring-prevention-capabilities\/","title":{"rendered":"Setting Expectations for Prevention Readiness: Measuring Prevention Capabilities"},"content":{"rendered":"

Any organization that\u2019s serious about preventing successful cyberattacks must be able to measure their prevention readiness, and this blog explains how we do that. The metrics ensure that leadership has confidence that the enterprise is operating as intended, with the modern capabilities required to prevent successful attacks.<\/p>\n

The measurements we use are deliberate and intended to meet a rigorous standard, required to know yourself and know the enemy. Let\u2019s review what General Sun Tzu said best in 500 B.C. His words are still true today in the cyber domain.<\/p>\n

\u201cKnow the enemy <\/b>and know yourself<\/b>; in a hundred battles, you will never be defeated. When you are ignorant of the enemy but know yourself, your chances of winning or losing are equal. If ignorant both of your enemy and of yourself, you are sure to be defeated in every battle.\u201d <\/i><\/p>\n

Knowing You Are Properly Configured: Panorama Configuration Heat Maps<\/strong><\/h3>\n

One thing we learned the more we performed our prevention posture assessment<\/a>\u00a0was a need to provide \u201cfactual\u201d data to back up our prevention assessment assertions. For this reason, we created a family of Panorama configuration-parser heat maps intended to do exactly that.<\/p>\n

The following heat maps provide different visual representations of actual prevention capability configurations on the Palo Alto Networks Next-Generation Security Platform. Together, they help us measure the extensible configuration for all areas of architecture we previously explained<\/a>.<\/p>\n

Figure 1 shows a view of capabilities and their configurations based on device group. Notice that we list the prevention platform capabilities across the top. The capability configuration adoption is provided below each capability. All of these configurations are based on \u201cenable allow\u201d rules configured on the platform, along with profiles that are activated on the rules. Don\u2019t be discouraged by the color-coding. \u201cRed\u201d does not mean bad. Our goal with the heat maps is to determine if the IT and security teams configured the platform as intended. The color code can be of your choosing, and we ask customers to change it often to suit their needs.<\/p>\n

This is a high-level heat map because it is limited to the device\u2019s overall configuration without any detailed understanding of individual rules and capability profiles. However, it is still powerful because it helps IT and security professionals collaborate on how they are using the platform to protect and control their perimeter locations and data center locations.<\/p>\n

\"readiness_3_1\"<\/span><\/div><\/a><\/p>\n

Figure 1: Prevention capability adoption by device group example<\/em><\/p>\n

The second heat map, in Figure 2, gets much more granular in the platform configuration by showing specific zones. In fact, we noticed from practice, that most organizations have an intent of providing full protection and control for internet access points, but don\u2019t really consider enabling protection on internal traffic. This trend is clear in the zone example.<\/p>\n

From a prevention readiness perspective, we reiterate that it isn\u2019t enough just to protect perimeter rules. Going through the capabilities using this view allows us to manage expectations with new customers and existing customers about making sure we confirm that the platform is configured and operating as intended in all zones. This builds confidence that customers get the most prevention capability possible from their investment, and it ensures we build continuous operational rigor around reporting prevention readiness.<\/p>\n

\"readiness_3_2\"<\/span><\/div><\/a><\/p>\n

Figure 2: Prevention capability adoption by zone example<\/em><\/p>\n

Our third heat map, in Figure 3, is based on tagging, and this is where things get really interesting. If you use tagging, you\u2019ll like this view as a complement to the other heat maps. If you don\u2019t use tagging, reach out to one of our representatives and work with them to build and implement a tagging strategy. It will be well worth your time to make sure you\u2019re doing all you can to fully use the platform prevention capabilities.<\/p>\n

\"readiness_3_3\"<\/span><\/div><\/a><\/p>\n

Figure 3: Prevention capability adoption by tagging example<\/em><\/p>\n

The configuration heat maps are intended to be simple so we can regularly communicate prevention readiness in a consistent manner. This way, we build confidence that we\u2019re doing everything we can to take away an attacker\u2019s ability to use known vectors, techniques, and tools.<\/p>\n

Metrics to Build IT and Security Leadership Confidence<\/strong><\/h3>\n

Our passion and dedication to prevention is paramount at Palo Alto Networks. As such, we know it is important to build IT and security leaders\u2019 confidence that their enterprise is operating as intended and with a high degree of prevention readiness.<\/p>\n

During our journey, we found some that metrics really hit home as leading indicators for knowing yourself and ensuring the enterprise is operating as intended. In Figure 4, we show these metrics because they are important to understand for a couple of reasons.<\/p>\n

\"readiness_3_4\"<\/span><\/div><\/a><\/p>\n

Figure 4: Building IT and security leadership confidence<\/em><\/p>\n

First, all these indicators focus on the data center, cloud and SaaS area of architecture. This is intentional for the following reasons:<\/p>\n

    \n
  • We reinforce an attitude of inside-out thinking and prioritization.<\/li>\n
  • Every goal we achieve here is extensible to other areas of the architecture.<\/li>\n
  • All these items typically end up on the short list of customer priorities.<\/li>\n
  • It helps us keep things simple and prioritize efforts.<\/li>\n<\/ul>\n

    Second, all of the metrics in Figure 4 are easy for us to measure. Usually, we\u2019ll focus on unknown UDP, unknown TCP, and unexpected applications operating on non-standard ports. In addition, we\u2019ll compile a list of all SaaS applications and check them against your existing governance policy for SaaS. If you don\u2019t have a governance policy, we\u2019ll work with you to establish one.<\/p>\n

    Wrapping Things Up<\/strong><\/h3>\n

    Our representatives and partners are here to make prevention a reality across architecture. Prevention is in our DNA. Be sure to work with our advisors soon. They have tools to get you to the best prevention readiness possible, and we promise to continue to innovate and iterate on these tools in the future. These tools are all complimentary added-value items and part of our commitment to prevent successful attacks.<\/p>\n

    Have you asked for Panorama configuration heat maps yet? If you're an existing Panorama customer, why not? If you're a potential customer, request them soon. The only cost is some time for your team, but it will be time well spent, as professionals and leaders.<\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    Any organization that\u2019s serious about preventing successful cyberattacks must be able to measure their prevention readiness, and this blog explains how we do that. The metrics ensure that leadership has confidence that …<\/p>\n","protected":false},"author":71,"featured_media":21531,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1229],"tags":[2973,3000,613,2994],"coauthors":[705,2970],"class_list":["post-21825","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-platform","tag-it","tag-leadership","tag-panorama","tag-prevention-readiness"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2016\/11\/blog-generic-banner-1.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/21825","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/71"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=21825"}],"version-history":[{"count":2,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/21825\/revisions"}],"predecessor-version":[{"id":21843,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/21825\/revisions\/21843"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/21531"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=21825"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=21825"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=21825"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=21825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}