CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

Home » Palo Alto Networks

Palo Alto Networks

Palo Alto Networks: What Started As A Next Generation Firewall Became A Full Platform

Palo Alto Networks protects thousands of enterprise and governments from cyber threats. The company is widely known as a next generation firewall but has evolved to be much more than that, largely because they have designed in agility and an ability to gather, analyze and take action on intelligence.They rely on a deep expertise and commitment to innovation to continually enhance their game-changing security platform. The Palo Alto Networks security platform natively brings together all key network security functions, including advanced threat protection, firewall, IDS/IPS and URL filtering. Because these functions are natively-built into the platform and share important information across features the Palo Alto approach ensures better threat response.

For a succinct update on one of Palo Alto Network’s capabilities, WildFire, see the video at this link and embedded below:

More from their website:

Our innovative security platform is based on our next-generation firewall which natively classifies all traffic, inclusive of applications, threats and content, then ties that traffic to the user, regardless of location or device type. The application, content, and user –  the core elements that run your business – are then used as the basis of your security policies. This unique ability empowers you to safely enable applications, make informed decisions on network access, and strengthen your network security.

Regardless of where your applications, users, and content may be, they almost always run across the network – which is the logical place to secure them. Deploy our innovative network security products to secure users (e.g., Internet gateways, branch offices, mobile users) as well as services (e.g., virtualized datacenters, virtualized desktop infrastructures, websites). All of your offices, datacenters, and remote users can be protected by the same safe application enablement policies, which simplifies security. Our platform enables you to see and understand everything that happens on your network, so you can focus on real problems.

Also see:

Palo Alto Networks to Acquire Crypsis Group

Fortinet, Palo Alto Networks, McAfee and Symantec Found the Cyber Threat Alliance 

Future Crimes: Everything Is Connected, Everyone Is Vulnerable and What We Can Do About It

Rapid Miner: Aiming for effortless predictive analytics

An Introduction to Recorded Future: An ability to leverage the predictive power of the web

Fighting Cyber Crime with Transparency

 

For more information see PaloAltoNetworks.com

For insights into the emerging world of technology solutions search the CTOvision Solutions Directory:

Artificial Intelligence Companies | Big Data Companies | Business Intelligence Companies | Cybersecurity Companies | Cloud Computing Companies | Collaborative Tool Companies | Infrastructure Companies | IoT Companies | Mobile Companies | Robotics Companies | Services Companies | Tech Titans | VC, PE and Finance Companies

We track security firms in the categories of:

CASB | Cyber Threat Intelligence | Deception | Encryption | Endpoint Detection and Response | Governance, Training, Education, Process | IAM | Managed Services, Outsourced Security | Microsegmentation and Container Security | Network Traffic and Analysis | SDP | Security Scanning And Testing

CTOvision Reviews of Cyber Threat Intelligence Sites:

[wp_show_posts id=”108781″]

Time for Transformational Cybersecurity Part II

The last post, Transformational Cyber Security Part I, discussed exciting inventions that turn cybersecurity upside-down by preventing malware from freeloading CPU instructions in a properly configured software defined data center (SDDC), thereby rendering on-premise cyber attacks null and void.  It also discussed root-of-trust encrypted metavisor technology that protects applications and data operating in the cloud.

Now, the cyber vulnerability challenge becomes adopting these technologies into the massive global IT infrastructure, faster than cyber attacks can debilitate significant elements of our world. This post introduces additional cyber technologies to enable protection against cyber intrusion between customer offices and the cloud. It includes secure cloud data and distributed ledger technologies to protect all transaction activities that intersect with the cloud.

But first it is useful to consider who is responsible for information protection as commercial cloud offerings continue to grow. The IT world is in the middle of a paradigm shift from private data centers, to combinations of private and commercial cloud services that offer the promise of reducing or eliminating IT staffs in favor of IT services delivered to us users anytime, anyplace, and worry-free. This model is similar to the way we enjoy worry-free electric power; at least most of the time.

While first world countries have come to trust that the commercial electricity service and the electric grid moving it are very reliable, many homes, most large businesses, and all of the world’s data centers use backup electric generators to reduce or eliminate crippling losses of electric power. Just as the world cannot long survive without electricity, it now cannot survive without information flow. Consider, for example, that all of civilization’s necessities are now controlled by information systems and processes that enable efficient food flow, water flow, money flow, energy flow, and information flow itself, where 95% of all telco information transits undersea fiber optic cables.

Like electricity, information must be protected from mishandling, data-theft, data alteration, and data-flow interruptions. In this respect, cloud providers do a good job of engineering security into their cloud systems, and provide independent verification of compliance certifications such as HIPPA to protect health records, ISO 27018 to protect personally identifiable information (PII), and Cloud Security Alliance (CSA), to help cloud customers assess how cloud service providers follow and comply with industry best practices, standards, and regulations.

Commercial cloud services have opened amazingly positive low barrier of entry opportunities for new-start companies, plus medium and large businesses alike, but they cannot fully solve the challenge of data liability, which must continue to be the customers responsibility. That responsibility forces all customers to self-protect and backup all sensitive data, including PII, financial, intellectual property, private applications, and company process information.  To do so, cloud customers must be augmented by some form of extra-cloud protection, or use a hybrid private/commercial cloud architecture, similar to the way we use backup generators for our critical electricity needs. We know this because even with cloud providers doing their best to support the protection of customer data, as daily news reports attest, cyber attacks, like ransomware, continues to plague the world.

By protecting the telco connections from a customer to the cloud and then extending additional cybersecurity technologies further up the IT stack, commercial cloud-only, or hybrid-cloud architectures will start to deliver high-reliability cyber protection to cloud users and the clouds they ride. One company* now offers a Software Defined Perimeter (SDP) service that transparently authenticates each user device, followed by authenticating the user and the data center or cloud application that the user is accessing. In this way the SDP is creating a private network enclave similar to the way the DoD divides users across different security enclaves in order to protect classified data. If desired, this SDP can be established with a dedicated network path all the way back to a telco provider.

Another company** has invented a database technology that is capable of searching encrypted data without holding the encryption keys to that data.  The implications of this semi-homomorphic encryption invention is massive. It enables the creation of a zero-trust trust data-layer, thereby eliminating the data-layer cyber threat surface, where data spends 99+% of it’s time. This allows cybersecurity to spend cyber resources focused on the small remaining cyber threat surface.

With this revolutionary data-layer technology, this same company** discovered they could leverage the secure data-layer to create secure immutable distributed ledgers that protect and verify all transaction processes. Secure distributed ledgers is the goal and the hype behind blockchain technology, first introduced by the inventors of the Bitcoin cryptocurrency. Immutable distributed ledgers are desired because they are not vulnerable to a central data location, they cannot be altered without the string of block participants agreeing to the change, and they are transparent for authorized audits without fear of illegal ledger modification. The importance of this company’s technology is that it secures the distributed ledger transaction blocks in zero-trust layers and is massively scalable, unlike the challenge with current blockchain ledgers.

The last company*** in this cyber secure stack is a company that has created a secure distributed artificial intelligence (AI) technology that distributes smart-agents anywhere within an information processing echo-system, like supply-chains, industrial processes, and AI augmented human control processes such as military command and control.  These AI agents operate within a common software support platform and are assigned behaviors using a library of behaviors tailored to the needed automated task.

By increasing the security at each layer of this IT infrastructure stack, as shown in this diagram, cybersecurity is now moved from a high risk profile, hoping that ransomware and other malware will not disrupt operations, to a highly security and reliable IT system, equivalent to military grade cybersecurity.

As the world continues accelerating into the AI future of autonomous car and truck transportation, 3D printing that is revolutionizing manufacturing, and robotics promising Star Wars like helpers, the big elephant in the room is cyber vulnerability. Without solving this challenge, not only will our National infrastructure continue to be at risk, but our software driven government and businesses processes will be unable to adequately compete in this new global landscape!

 

 

 

 

*www.vidder.com*  **www.craxel.com  ***www.cougaarsoftware.com

****AWS Customer Agreement  11. Limitations of Liability.

“WE AND OUR AFFILIATES AND LICENSORS WILL NOT BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES (INCLUDING DAMAGES FOR LOSS OF PROFITS, REVENUES, CUSTOMERS, OPPORTUNITIES, GOODWILL, USE, OR DATA), EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHER…”

How Do I select a Cloud Access Security Brokers (CASB)?

Cloud Access Security Brokers (CASB) have been hot for the last 5 years. But how do you select a CASB?

It has gotten to the point where every firm is either using one, evaluating one, or studying how to use them. This makes sense, since any successful cloud transition strategy should including appropriate attention being placed on how to secure, control and manage corporate use of cloud services.

We believe by 2020, 100% of large firms will use CASB and the majority of mid-sized firms will as well.

Since the market is so hot, the CASB firms themselves are acquisition targets and there has been quite a bit of M&A activity in this space. There is also room for innovation and there are many new entrants into the market, so expect many more changes in offerings available to the enterprise.

CASB products provide capabilities that give control over cloud offerings. They protect data, provide proof of compliance with corporate standards and regulatory requirements, provide visibility into actions being taken by staff and metrics over cloud application use and performance. In short, CASB enable appropriate enterprise-grade governance over cloud services.

CASB provide this governance over both SaaS and IaaS solutions. For example, Salesforce, Microsoft Office 365, Google Apps Suite, CRM, HRIS, ERP, but also social media accounts. CASB can provide control and visibility over AWS and Microsoft Azure use.

If you are evaluating CASB for your enterprise we recommend considering:

We track each of these in our Disruptive IT Directory in the category of Cloud Access Security Brokers (CASB).

Many of the large IT providers have bought CASB capabilities and may have an integrated offering that fits with your legacy approach. They include Oracle (bought Palerra), Microsoft (bought Adallom), Cisco (bought Cloudlock), Symantec (bought Blue Coat, who had bought Perspecsys and Elastica), and as previously mentioned, McAfee (has bought Skyhigh).

There are other CASB related capabilities in platforms like Palo Alto Networks, but we consider those to be more of an add-on. These can be a good option of you are already leveraging a platform and can just add on a capability from an exiting vendor, so one option is to check with your current provider to see if their offerings include capabilities in this space.

If you have questions in CASB, remember, we love to hear from our readers. Use our “Ask The CTO” feature.

For more on the CASB concept see:

 

OASIS Advances Automated Cyber Threat Intelligence Sharing with STIX, TAXII, CybOX

Editor’s note: We saw the press release below from OASIS and wanted to share it with you since it covers some of the most important information sharing standards in the community today, STIX, TAXII and Cybox. These standards are now being advanced through the open standards process of OASIS.
From PRweb

OASIS Advances Automated Cyber Threat Intelligence Sharing with STIX, TAXII, CybOX

Organizations from Around the World Collaborate on International Standards to Prevent and Defend Against Cyber Attack

(PRWEB) JULY 16, 2015
Three foundational cyber security specifications, STIX, TAXII, and CybOX, are now being advanced through the international open standards process at OASIS. In a transition headed by the U.S. Department of Homeland Security, a record number of organizations from around the world have come together in the new OASIS Cyber Threat Intelligence (CTI) Technical Committee to develop and promote adoption of standards that enable cyber threat intelligence to be analyzed and shared among trusted partners and communities. The work will support automated information analysis and sharing for cyber security situational awareness, real-time network defense, and sophisticated threat characterization and response.
CTI Technical Committee members include representatives of Boeing, Check Point, Cisco, Dell, EMC, eSentire, Fortinet, Fujitsu, IBM, iboss, iSIGHT Partners, NEC, New Context, Palo Alto Networks, Resilient, Securonix, Soltra, TELUS, ThreatQuotient, ThreatStream, TruSTAR, US DHS Office of Cybersecurity and Communications, US NIST, ViaSat, and others.

“Security professionals are overwhelmed and simply don’t have time for analyzing data in disparate formats. STIX, TAXII, and CybOX streamline the process, putting the focus of cyber intelligence where it belongs—on prevention, detection, and remediation,” said Jon Oltsik, Senior Principal Analyst at Enterprise Strategy Group. “Using data converted to these standard formats can help security practitioners rapidly identify and access current threats, and determine how they act, who is responsible and what course of action is needed. Threat intelligence standards are also a key building block for fulfilling the vision of ubiquitous threat intelligence sharing.”

STIX, TAXII, and CybOX can work in concert or be implemented separately. STIX (Structured Threat Information Expression) is a language for describing cyber threat information so that it can be analyzed and/or exchanged. STIX makes it possible to explicitly characterize a cyber adversary’s motivations, capabilities, and activities, and in doing so, determine how to best defend against them. TAXII (Trusted Automated Exchange of Indicator Information) defines services and message exchanges that enable organizations to share the information they choose with the partners they choose. CybOX (Cyber Observable Expression) is a language for specifying, capturing, and communicating events or stateful properties that are observable in system and network operations. Together, STIX, TAXII, and CybOX are instrumental in supporting a wide variety of applications including security event management, malware characterization, intrusion detection, incident response, and digital forensics.
“STIX, TAXII, and CybOX have reached a level of maturity where they will benefit from a more formal collaboration guided by a globally recognized standards development process that ensures transparency, international participation, stability, reciprocity, and perpetual ease of access,” said Richard Struse of the U.S. Department of Homeland Security Office of Cybersecurity and Communications, who chairs the OASIS CTI Technical Committee. “OASIS provides all of this, and is an ANSI-accredited developer of American National Standards as well as an authorized PAS Submitter to ISO. Having these certifications available to STIX, TAXII, and CybOX means they will be implementable by the broadest possible stakeholder community.”
OASIS CTI Technical Committee members have formed three Subcommittees to address the specifications individually. The CTI STIX Subcommittee is chaired by Aharon Chernin of Soltra and Sean Barnum of MITRE. The CTI TAXII Subcommittee is chaired by Bret Jordan of Blue Coat and Mark Davidson of MITRE. The CTI CybOX Subcommittee is chaired by Trey Darley of Soltra and Ivan Kirillov of MITRE
New members are encouraged to join the OASIS CTI Technical Committee and its Subcommittees at any time. Archives are accessible to both members and non-members, and OASIS invites public review and comment on the work.
Support for CT

Check Point
“Check Point believes that open standards and community sharing are vital components of a successful and effective fight against cybercrime. Our goal is to make Threat Intelligence, from a variety of sources, timely and actionable. We have been working with the STIX/TAXII community for the past three years and are adopting STIX/TAXII in our architectures. We look forward to working with the community to expand the standards to allow for significant sharing between governments, security organizations and vendors, and customers.”
–Dorit Dor, VP, products, Check Point Software Technologies

eSentire
“Real-time threat intelligence consumption will become more of a reality as these specifications are widely implemented by vendors in all parts of the security ecosystem. Our security intelligence analysts have been affiliated with and advocates of STIX, TAXII and CybOx for quite some time. The introduction of OASIS as an international standards checkpoint will undoubtedly improve threat intelligence sharing amongst partners by facilitating the exchange of computer-readable threat information.”
–David Maxwell, Director of Threat Intelligence, eSentire

Fortinet
“Information sharing is crucial to building a more secure infrastructure across the global ecosystem. Creating a common language, a methodology for how that language is communicated, rating systems, and other standards are going to be required for efficiency and clarity to combat the speed of new threat creation. STIX and TAXII in particular are important initiatives towards next generation threat intelligence. Using the same terms, data streams, and threat modeling methods will help researchers, vendors, and law enforcement alike share information back and forth to stay abreast or even ahead of threat actor groups. We are pleased to contribute to this and more through OASIS.”
–Derek Manky, Global Security Strategist, Fortinet

IBM
“IBM has long supported industry standards to solve the world’s most pressing challenges. Cybersecurity is one of the greatest challenges our modern society faces and requires a coordinated approach to succeed. Under OASIS leadership, we see an opportunity to better organize the good guys to fight cybercriminals by sharing cyber threat intelligence data in an automated and efficient data standard.”
–Peter Allor, Senior Security Strategist, IBM

iboss
“We have long been committed to any advances that can better enable the sharing of threat intelligence among security professionals. Until now, organizations have been hampered by a lack of common standards and the tendency for security information to be siloed. We strongly support this important endeavor and look forward to contributing to the standardization being led by OASIS.”
–Paul Martini, Co-founder and CEO, iboss Cybersecurity

iSIGHT Partners
“iSIGHT Partners, creator of the commercial cyber threat intelligence category, understands how security organizations can gain the advantage over adversaries by using threat intelligence across their security and risk management program. As an early contributor and enabler of STIX, we welcome the opportunity to join with OASIS to further develop CTI standards and accelerate the adoption of context rich threat intelligence.”
–Robert Huber, VP Community, iSIGHT Partners

NEC
“NEC is very pleased to be part of the CTI Technical Committee and continues to drive CTI adoption with industry partnerships to benefit customers. NEC believes that threat intelligence standards are crucial for proactively countering the cyber threat. We are excited about the formation of CTI TC and support its efforts through its contributing to and promotion of this global standard.”
–Kozo Matsuo, General Manager, Cyber Security Strategy Division, NEC Corporation

New Context
“Development of an industry-wide standards framework for cyber threat intelligence is crucial for the information security industry to be able to define and share threats. New Context is a proud sponsor of OASIS and believes strongly in open and transparent standards frameworks development. We look forward to collaborating on the next standards for STIX, CybOX and TAXII.”
–Daniel Riedel, CEO, New Context

Resilient
“As a Sponsor of the OASIS CTI Technical Committee, we are delighted to be at the forefront of advancing critically important standards like STIX, TAXII and CybOX. By creating protocols that address how to best model, analyze, and share cyber threat intelligence, we can provide greater support to overwhelmed security professionals.”
–John Bruce, CEO and co-founder, Resilient Systems

Soltra
“Soltra is proud to be a member of the OASIS CTI Technical Committee. Our threat information sharing solution, Soltra Edge, was built leveraging STIX, TAXII, and Cybox – key standards within the industry. We look forward to contributing to CTI as we continue to establish and maintain open standards, while improving cyber security capabilities and reducing workload.”
–Aharon Chernin, CTO, Soltra, a DTCC and FS-ISAC Company

TruSTAR
“We are proud to support the work OASIS is doing to advance their cybersecurity specifications and promote information sharing, a critical factor in today’s security posture. By sharing details about malicious incidents quickly, not only between the public and private sectors, but across industry lines within the private sector as well, we can work together to better defend ourselves and stay ahead of the hackers.”
— Paul Kurtz, founder and CEO, TruSTAR Technology

ViaSat
“Focusing on standardizing threat intelligence technologies to keep sensitive government and corporate information secure is paramount to the mission of OASIS and its members. At ViaSat, we take a comprehensive approach to cybersecurity, from identifying potential cyber and physical security vulnerabilities to designing and implementing a plan that leverages big data analytics, intuitive visualization and intelligent automation to keep pace with evolving threats no matter where data resides on the network or how it is accessed.”
–Jerry Goodwin, VP, Secure Network Systems, ViaSat

About OASIS:
OASIS is a non-profit, international consortium that drives the development, convergence and adoption of open standards for the global information society. OASIS promotes industry consensus and produces worldwide standards for security, privacy, cloud computing, IoT, content technologies, digital experiences, and other areas. OASIS open standards offer the potential to lower cost, stimulate innovation, grow global markets, and protect the right of free choice of technology. OASIS members broadly represent the marketplace of public and private sector technology leaders, users, and influencers. The consortium has more than 5,000 participants representing over 600 organizations and individual members in 65+ countries.

Fortinet, Palo Alto Networks, McAfee and Symantec Found the Cyber Threat Alliance

In what could be a very virtuous trend, four of the cyber security industry’s leading tech vendors (Fortinet, Palo Alto Networks, McAfee and Symantec) have established a consortium focused on the furtherance of the art and science of cyber threat intelligence. This alliance, started in May and expanded in September, aims to help industry entities coordinate and collaborate in new ways against the high end adversaries attacking the corporate world.

The consortium is focused on sharing of threat intelligence, including indicators of compromise, according to a release.

We believe this will be a significant new source of information that contributes to the overall cyber threat intelligence capability of industry.

The mission of the Cyber Threat Alliance is to drive a coordinated industry effort against cyber adversaries through deep collaboration on threat intelligence and sharing indicators of compromise.

While past industry efforts have often been limited to the exchange of malware samples, this new alliance will provide more actionable threat intelligence from contributing members, including information on zero-day vulnerabilities, botnet command and control (C&C) server information, mobile threats, and indicators of compromise (IoCs) related to advanced persistent threats (APTs), as well as the commonly-shared malware samples. By raising the industry’s collective actionable intelligence, alliance participants will be able to deliver greater security for individual customers and organizations.

“We must match our adversaries’ aggressive drive to innovate with our own deeper commitment to collaborate. It’s no longer enough to share and compare yesterday’s malware samples. As an industry, we need to understand and be poised to react to the latest complex and multidimensional attacks of today and tomorrow. This cyber alliance provides a critical framework for educating each other on the infrastructure and evolving tactics behind these attacks.”
– Vincent Weafer, senior vice president for McAfee Labs, part of Intel Security

For more information on the cyber alliance and its members, visit:
cyberthreatalliance.org

This is a continuation of and very supportive of the trend we have been reporting on towards automation. This type of alliance will eventually be able to produce indicators that can be acted on in automated ways, giving a leg up to enterprise defenders.

More Content

Cyber War

Optimizing Corporate Intelligence with OODA Loop

This post is part of our Intelligent Enterprise series, which providing insights aimed at corporate strategists seeking competitive advantage through better and more accurate decision-making. The first post provided foundational insights into A Practitioner’s View of Corporate Intelligence. This one dives into actionable recommendation on ways to optimize a corporate intelligence effort. It is based on a career serving large scale analytical efforts in the US Intelligence Community and in applying principles of intelligence in corporate America.

SciFi

Science Fiction Gadgets You Can Get Today

Technology is advancing pretty fast, at times influenced by the exciting world of Science Fiction. This video captures 10 of the tech developments first seen in SciFi that are available now. A key point of this, if you want to know what is in our future, watch more SciFi!  

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]