Palo Alto Networks
TMA-PALOALTO-6.19
Ensure that User Credential Submission uses the action of "block" or "continue" on the URL categories
Deskripsi
Ideally user names and passwords user within an organization are not used with third party sites. Some sanctioned SAS applications may have connections to the corporate domain, in which case they will need to be exempt from the user credential submission policy through a custom URL category.
Cara pemeriksaan
Metode audit: Tinjauan manual
Navigate to Objects > Security Profiles > URL Filtering. Choose the Categories tab. Verify that the User Credential Submitting action on all enabled URL categories is set to either block or continue. Under the User Credential Detection tab ensure the User Credential Detection is set to a value appropriate to your organization, and is not set to Disabled. Verify that the Log Severity value is set to a value appropriate to your organization and your logging or SIEM solution.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Navigate to Objects > Security Profiles > URL Filtering. Choose the Categories tab. Set the User Credential Submitting action on all enabled URL categories is either block or continue, as appropriate to your organization and the category. Under the User Credential Detection tab set the User Credential Detection value to a setting appropriate to your organization, any value except Disabled. Set the Log Severity to a value appropriate to your organization and your logging or SIEM solution.
Properti
- Sistem operasi
- Apa saja
- Tag
- paloaltoauthentication
- Referensi
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 6.19 Ensure that User Credential Submission uses the action of "block" or "continue" on the URL categories