Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone

보통레벨 2수동 검토paloalto

설명

When permitting traffic from an untrusted zone, such as the Internet or guest network, to a more trusted zone, such as a DMZ segment, create security policies specifying which specific applications are allowed. **Enhanced Security Recommendation: ** Require specific application policies when allowing any traffic, regardless of the trust level of a zone. Do not rely solely on port permissions. This may require SSL interception, and may also not be possible in all environments.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Navigate to Policies > Security. For all Security Policies that transit from a less trusted to a more trusted interface, that the appropriate Application and Service values are set. For instance, for a web server exposed to the internet from a DMZ: Source tab: Zone set to OUTSIDE / Address set to Any Destination tab: Zone set to DMZ / Address set to [DMZ Host Object] Application tab: set to web-browsing Service/URL Category tab: set Service to ether: application-default or: service-http and/or service-https **Enhanced Security Recommendation: ** Assess this setting ... (Full steps: CIS 7.1.)

조치 방법

조치 방식: 가이드 또는 인프라 패치

Navigate to Policies > Security. For all Security Policies that transit from a less trusted to a more trusted interface, set the Application and Service values to match the exposed application. For instance, for a web server exposed to the internet from a DMZ: Source tab: Zone set to OUTSIDE / Address set to Any Destination tab: Zone set to DMZ / Address set to [DMZ Host Object] Application tab: set to web-browsing Service/URL Category tab: set Service to ether: application-default or: service-http and/or service-https **Enhanced Security Recommendation: ** Set these values for Policies on all Interfaces, for traffic in all directions. For each Security Policy, set the Application and Service values to match the exposed application.

속성

운영 체제: 모두
태그: paloaltothreat-prevention
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 7.1 Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone