Detections
Analytics

8.1 Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured - Policies

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Configure SSL Forward Proxy for all traffic destined to the Internet. In most organizations, including all categories except financial-services, government and health-and-medicine is recommended.

Rationale:

Without SSL inspection, the firewall cannot apply many of its protection features against encrypted traffic. The amount of encrypted malware traffic continues to rise, and legitimate websites using SSL encryption are hacked or tricked into delivering malware on a frequent basis. As encryption on the Internet continues to grow at a rapid rate, SSL inspection is no longer optional as a practical security measure. If proper decryption is not configured, it follows that the majority of traffic is not being fully inspected for malicious content or policy violations. This is a major exposure, allowing delivery of exploits and payloads direct to user desktops.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Navigate to Policies > Decryption.
Create a Policy for all traffic destined to the Internet. This Policy should include:

Source tab: The Source Zone and/or Source Address should include all target internal networks. Source User should include all target internal users

Destination tab: The Destination Zone should include the untrusted target zone (usually the internet). Destination Address is typically Any for an internet destination.

Service/URL Category tab: all URL Category entries should be included except financial-services, government and health-and-medicine (this list may vary depending on your organization and its policies).

Options tab: Type set to SSL Forward Proxy

Impact:

Failure to decrypt outbound traffic allows attackers to mask attacks, data exfiltration and/or command and control (C2) traffic by simply using standard TLS encryption. Privacy concerns for your organization's users will dictate that some common categories should be exempted from inspection and decryption. Personal banking or healthcare information is almost always exempted, as are interactions with government entities. Exemptions and inclusions to decryption policies should be negotiated internally and governed by published Corporate Policies.

Default Value:

Not Configured

References:

'How to Implement SSL Decryption' - https://live.paloaltonetworks.com/docs/DOC-1412

''PAN-OS Administrator's Guide 9.0 (English) - Decryption (English)' - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/decryption.html#

See Also

https://workbench.cisecurity.org/files/2692

Item Details

References: CSCv6|12, CSCv6|12.5, CSCv7|12, CSCv7|12.9, CSCv7|12.10

Plugin: Palo_Alto

Control ID: dc69e3939b75794811783984ddd816bc46258992e9a85c6e9f7d56b5db7ba838