Starng Best Pracces with the BPA

and Security Assurance

Version 9.0 (EoL)

docs.paloaltonetworks.com
 Contact Informaon
Corporate Headquarters:
Palo Alto Networks
3000 Tannery Way
Santa Clara, CA 95054
www.paloaltonetworks.com/company/contact-support.html

About the Documentaon

• For the most recent version of this guide or for access to related documentaon, visit the
Technical Documentaon portal docs.paloaltonetworks.com.
• To search for a specific topic, go to our search page docs.paloaltonetworks.com/search.html.
• Have feedback or quesons for us? Leave a comment on any page in the portal, or write to us
at documenta[email protected].

Copyright
Palo Alto Networks, Inc.
www.paloaltonetworks.com
©2019–2022 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at www.paloaltonetworks.com/company/
trademarks.html. All other marks menoned herein may be trademarks of their respecve
companies.

Last Revised
March 14, 2022

Starng Best Pracces with the BPA and Security Assurance 2 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Table of Contents
Geng Started with Best Pracces.............................................................. 5
Idenfy and Priorize Best Pracces......................................................................................6
Access and Run the BPA........................................................................................................... 9
Access the BPA from the Customer Support Portal................................................ 9
Generate and Download a BPA Report....................................................................11
Security Assurance....................................................................................................................15
The Seven Key Security Capabilies to Adopt....................................................... 15
Check Adopon of the Seven Key Security Capabilies......................................16
Improve Adopon of the Seven Key Security Capabilies.................................. 18
How to Engage Security Assurance.......................................................................... 19

Starng Best Pracces with the BPA and Security Assurance 3 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Table of Contents

Starng Best Pracces with the BPA and Security Assurance 4 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces
Security best pracces prevent known and unknown threats, reduce the aack
surface, and provide visibility into traffic, so you know and control which applicaons,
users, and content are on your network. When you implement security best pracces,
you:

> Minimize the chances of a successful intrusion.

> Idenfy the presence of aackers.
> Protect your valuable data.
> Protect your customers, partners, and employees, and thus protect the reputaon
of your business.
> Help to achieve a Zero Trust security environment.

To transion to security best pracces, first you need to understand your current
network security posture and idenfy areas for improvement. Palo Alto Networks
provides a guided transion path: the Best Pracce Assessment (BPA) combined with
Safe Transion Steps and best pracce technical documentaon.
When you subscribe to the Premium (on or aer November 1, 2019) or Planum
Support Contract, you have the opportunity to prepare for Security Assurance.
Security Assurance provides access to Palo Alto Networks security experts and tools
to help with inial incident invesgaon.

> Idenfy and Priorize Best Pracces

> Access and Run the BPA
> Security Assurance

5
Geng Started with Best Pracces

Idenfy and Priorize Best Pracces

Palo Alto Networks’ Best Pracce Assessment (BPA) uses your Tech Support File to analyze
Panorama and next-generaon firewall configuraon sengs and compares the configuraon
to Palo Alto Networks best pracces. The BPA shows the current state of best pracce security
adopon and suggests specific changes to align the configuraon with security best pracces.
Running the BPA not only gives you an understanding of where to improve your security posture,
it also sets a baseline for later comparison and provides links to technical documentaon that
shows you how to transion the BPA’s recommendaons into a best pracce configuraon.
Using an iterave, priorized approach, you can transform your security posture to a best pracce
state, one step at a me, measuring progress as you go at your pace and level of comfort:
STEP 1 | Upload a Tech Support File on Customer Support Portal and Access and Run the BPA
yourself, or contact your Palo Alto Networks SE or partner to run the BPA on Panorama or
your next-generaon firewalls.
If you run the BPA yourself, we recommend that you contact your Palo Alto Networks SE or
partner to help interpret the results and discuss the next steps.

STEP 2 | Idenfy and priorize the first area of improvement to begin the transion to best pracces.
Whether your Palo Alto Networks SE or partner runs the BPA or you run the BPA, your SE or
partner can help you formulate a priorized plan to safely phase in best pracces. Plan to start
with the safest, easiest, highest impact changes first, such as applying Anvirus, An-Spyware,
Vulnerability Protecon, and WildFire Analysis profiles to your Security policy allow rules.

Starng Best Pracces with the BPA and Security Assurance 6 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

STEP 3 | Use the BPA’s links to technical documentaon to configure the best pracces you priorize.
Downloading the BPA report gives you a .zip file that contains the detailed HMTL report, an
Execuve Summary, and an Excel spreadsheet that lists failed best pracce checks. You link to
technical documentaon in two ways:
• From the spreadsheet—The Documentaon tab provides links for each failed check.
In addion, the idenficaon number in the Check ID column on the Policies, Objects,
Network, and Device tabs links directly to the relevant line on the Documentaon tab.
• From the HTML report—When you open the HTML report, you see a heatmap that
summarizes best pracce adopon. Go to BPA to access the report.

From the BPA summary page, view Policies, Objects, Network, or Device detailed reports
for the selected configuraon assessment.

From a detailed report, click the circled blue ? for descripons and raonales for
the configuraon check and links to technical documentaon for the best pracce
configuraon.

Starng Best Pracces with the BPA and Security Assurance 7 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

For Security profiles (Vulnerability Protecon, Anvirus, An-Spyware, URL Filtering,

File Blocking), use the safe transion advice to ensure availability of business-crical
applicaons as you move to best pracce Security profiles.

STEP 4 | Aer you implement the first set of best pracce changes, run the BPA again to measure
progress and help verify that the changes work as expected.
Compare the first BPA output and the next BPA output to see the improvements in your
security posture. Idenfy and priorize the next area of improvement to address.

STEP 5 | Use the BPA’s links to technical documentaon to configure the next set of best pracces
you priorized.

STEP 6 | At your own pace, repeat the process of running the BPA to measure progress and
idenfy and priorize next steps, and then configure best pracces using the technical
documentaon.

STEP 7 | Get started now—Access and Run the BPA or contact your Palo Alto Networks SE or partner
and begin the transion to a more secure network today!

Starng Best Pracces with the BPA and Security Assurance 8 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

Access and Run the BPA

Access the Best Pracce Assessment (BPA) from the Customer Support Portal. Super User
accounts automacally have access to the BPA and can assign the BPA User role to a Standard
User’s profile so that the Standard User can run the BPA. This procedure shows Super Users how
to give access to Standard Users and how to run the BPA. You can also view short videos on how
to run a BPA and how to understand the results.
In addion, if you subscribe to the Premium (on or aer Nov 1, 2019) or Planum Support
Contract, you have the opportunity to prepare for and acvate Security Assurance. Security
Assurance provides access to Palo Alto Networks security experts and tools to help with inial
incident invesgaon. We strongly recommend that you run the BPA to measure your adopon
of seven key security capabilies and to ensure that your adopon rate is at least equal to your
industry’s average adopon rate so that your network is beer protected. The combinaon of the
Premium or Planum support contract and a recent BPA measurement that shows your adopon
rate for the seven key security capabilies meets your industry’s average automacally acvates
Security Assurance.
• Access the BPA from the Customer Support Portal
• Generate and Download a BPA Report

Access the BPA from the Customer Support Portal

STEP 1 | From the Customer Support Portal’s authencaon home screen, select Members > Manage
Users.

Starng Best Pracces with the BPA and Security Assurance 9 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

STEP 2 | Click the pencil icon to edit the Standard User to whom you want to assign BPA permissions.

STEP 3 | Select BPA User role and then click the update check mark to add the new role.

Starng Best Pracces with the BPA and Security Assurance 10 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

STEP 4 | The Standard User now has the BPA User role privileges.

STEP 5 | Super Users and Standard Users with the BPA User role can log in to the Customer Support
Portal to access and run the BPA (Tools > Run Best Pracce Assessment).

Generate and Download a BPA Report

Aer you gain access to the BPA, you can generate a BPA report for a Panorama appliance or for a
next-generaon firewall.

If possible, generate BPA reports for Panorama appliances instead of individual next-
generaon firewalls to gain complete visibility into all of the firewalls in your environment
in one report. Generate reports on a regular basis to measure progress toward adopng
security capabilies and security best pracces.

Starng Best Pracces with the BPA and Security Assurance 11 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

STEP 1 | Drag or drop a Tech Support File (.tgz file) in the Customer Support Portal window or browse
for a Tech Support File.
Super Users can create Tech Support Files (Device > Support > Tech Support File or Panorama
> Support > Tech Support File).

STEP 2 | Oponally, map each zone to the area of architecture, or click Skip this step to run the BPA
without mapping zones.
Drag and drop the architectural value from Architecture Classificaon, use the Classificaon
drop-down to select a value, or select mulple check boxes to select mulple zones and then
apply a value to all of the selected zones at one me.

Starng Best Pracces with the BPA and Security Assurance 12 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

STEP 3 | Idenfy the industry mapped to your account, and generate and download the BPA report
(Generate & Download Report).
You can change the industry against which the BPA compares your results using the drop-
down. If you want to change anything before you generate the report, you can also go back
and make those changes.
Generate & Download Report downloads the detailed BPA report, the Execuve Summary
report, and a spreadsheet that shows failed best pracce checks to the system from which you
accessed and ran the BPA.

STEP 4 | The generated BPA displays the Execuve Summary and informs you that the detailed HTML
report was downloaded to your computer.

Starng Best Pracces with the BPA and Security Assurance 13 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

STEP 5 | Now that you know how to run the BPA, go to the Customer Support Portal and try it
out today (or contact your Palo Alto Networks SE or partner to run the BPA) to begin the
transion to a more secure network.

If you subscribe to the Premium (on or aer November 1, 2019) or Planum Support
Contract, use the BPA to prepare your security posture to take advantage of Security
Assurance, which helps with inial incident invesgaon.

Starng Best Pracces with the BPA and Security Assurance 14 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

Security Assurance
If you detect suspicious acvity in your network, Security Assurance provides extra help from Palo
Alto Networks when you need it the most. Security Assurance provides:
• Access to Palo Alto Networks security experts and their specialized threat intelligence tools
and threat hunng pracces.
• Advanced log and indicators of compromise (IOC) analysis.
• Configuraon assessment that includes customized product security recommendaons.
• Next step recommendaons to expedite the transion to your incident response (IR) vendor to
help manage and resolve the incident.
To take advantage of Security Assurance, you must subscribe to the Premium Support Contract
(on or aer November 1, 2019) or to the Planum Support Contract.
The first step toward Security Assurance is to run the Best Pracce Assessment (BPA) to measure
your adopon of seven key security capabilies: WildFire, Anvirus, An-Spyware, DNS Sinkhole,
URL Filtering, Vulnerability Protecon, and Logging. We recommend that you ensure your
adopon rate for those security capabilies is at least equal to your industry’s average adopon
rate.
Running the BPA and adopng higher levels of key security capabilies provides beer protecon
for your network and helps avoid incidents. The BPA also measures the adopon level of many
other security capabilies such as App-ID and User-ID, zone configuraon, other security profiles
such as File Blocking and DoS Protecon profiles, and the BPA makes recommendaons on how
to improve your security posture.

Run the BPA at regular intervals (for example, monthly or quarterly) to measure the
adopon of key security capabilies, understand the state of your network security, and
priorize security improvements.

When you subscribe to the Premium Support Contract (on or aer November 1, 2019) or to
the Planum Support Contract and run the BPA, if it shows that you have adopted the seven
key security capabilies at a rate that meets your industry’s average, Security Assurance is
enabled automacally. If you need assistance to adopt these key capabilies at a rate that
meets your industry average, contact your Palo Alto Networks sales representave for help in
defining requirements, providing jusficaon criteria, etc. If business reasons prevent you from
adopng the key security capabilies at this level, please work with your Palo Alto Network sales
representave on how to gain access to the benefits of Security Assurance.
• The Seven Key Security Capabilies to Adopt
• Check Adopon of the Seven Key Security Capabilies
• Improve Adopon of the Seven Key Security Capabilies
• How to Engage Security Assurance

The Seven Key Security Capabilies to Adopt

We strongly recommend adopng the following seven key security capabilies for the following
reasons:

Starng Best Pracces with the BPA and Security Assurance 15 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

• WildFire—Aach a WildFire security profile to security policy rules that allow traffic to protect
your network from new, unknown threats. WildFire is a strong defense against advanced
persistent threats (ATPs).
• Anvirus—Aach an Anvirus security profile to security policy rules that allow traffic to block
known malicious files such as malware, ransomware, bots, and viruses.
• An-Spyware—Aach an An-Spyware security profile to security policy rules that allow traffic
to detect command-and-control (C2) traffic iniated by malicious code running on a server or
endpoint and to prevent compromised systems from establishing an outbound connecon from
your network.
• DNS Sinkhole—Configure the DNS Sinkhole poron of an An-Spyware security profile
that is aached to security policy rules that allow traffic. DNS Sinkhole idenfies potenally
compromised hosts that aempt to access suspicious domains by tracking the hosts and
prevenng them from accessing those domains.
• URL Filtering—Aach a URL Filtering profile to security policy rules that allow traffic to prevent
access to risky web content (sites that may contain malicious content). URL Filtering profiles
and URL categories give you granular control over the types of websites to which you allow
access.
• Vulnerability Protecon—Aach a Vulnerability Protecon security profile to security
policy rules that allow traffic to prevent aackers from exploing client-side and server-side
vulnerabilies and delivering malicious payloads to your network and users, and to prevent
aackers from using vulnerabilies to move laterally within your network.
• Logging—Enable logging on all traffic (allowed and denied) to provide a me-stamped audit trail
for system events and network traffic events. Logs provide crical informaon for invesgang
incidents. Log Forwarding enables you to send logs from all your firewalls to Panorama or to
external to aggregate the logs for analysis.
Adopng these key capabilies greatly improves your security posture, reduces your aack
surface, increases your visibility into network traffic, prevents known and new aacks, and
protects your the data, assets, applicaons, and services that are most valuable to your network.

Check Adopon of the Seven Key Security Capabilies

In the detailed BPA report (HTML format) you receive when you generate and download your BPA
results, go to the Adopon Summary page to check your overall adopon of the six security profile
(WildFire, Anvirus, An-Spyware, DNS Sinkhole, Vulnerability Protecon, and URL Filtering)
capabilies and your industry’s average adopon of those capabilies (logging is a separate check).
The Adopon Summary page shows your security capability adopon compared to your industry
and helps you idenfy gaps in adopon. For example, if your industry is High Technology:

Starng Best Pracces with the BPA and Security Assurance 16 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

The results show that the configuraon meets the industry average adopon for four capabilies:
WildFire, Anvirus, An-Spyware, and Vulnerability Protecon profiles. The results also show that
the configuraon does not come up to the industry average adopon of two capabilies: DNS
sinkhole and URL Filtering. This indicates the next course of acon: configure DNS sinkhole in the
An-Spyware profile and apply URL Filtering to internet traffic.
In the detailed HTML BPA report, go to the Trending page to check your overall adopon of
logging capabilies and your industry’s average adopon of logging.

Starng Best Pracces with the BPA and Security Assurance 17 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

This page shows not only your level of adopon compared to your industry, it also shows your
level of adopon compared to the last me you ran the BPA. This is a measure of security
improvement over me as well as a call to acon if your results indicate that your security is not as
ght as you want it to be.
If the profile and logging results show that your adopon of all seven capabilies meet your
industry’s average, Security Assurance is automacally enabled. If you need assistance to adopt
these key capabilies at a rate that meets your industry average, contact your Palo Alto Networks
sales representave for help in defining requirements, providing jusficaon criteria, etc. If
business reasons prevent you from adopng the key security capabilies at this level, please work
with your Palo Alto Network sales representave on how to gain access to the benefits of Security
Assurance.

Improve Adopon of the Seven Key Security Capabilies

Use the BPA in conjuncon with Palo Alto Networks technical documentaon to idenfy the
security capabilies that need improvement and to make the needed improvements, especially in
the seven key security capabilies. Improving your security posture helps to safeguard your users
and your valuable devices, assets, applicaons, and services.
• WildFire—Transion WildFire Profiles Safely to Best Pracces and then implement WildFire
Best Pracces. The best pracce WildFire profile is the default profile.
• Anvirus—Transion Anvirus Profiles Safely to Best Pracces and then implement Anvirus
Best Pracces (or slightly stricter Anvirus Best Pracces for the data center).
• An-Spyware and DNS Sinkhole—DNS Sinkhole configuraon is on the DNS Signatures tab in
the An-Spyware security profile. Transion An-Spyware Profiles Safely to Best Pracces and
then implement An-Spyware Best Pracces (or slightly stricter An-Spyware Best Pracces
for the data center).
• URL Filtering—Transion URL Filtering Profiles Safely to Best Pracces and then implement
URL Filtering Best Pracces.
• Vulnerability Protecon—Transion Vulnerability Protecon Profiles Safely to Best Pracces
and then implement Vulnerability Protecon Best Pracces (or slightly stricter Vulnerability
Protecon Best Pracces for the data center)).
• Logging—Security policy rules log at session end by default.
In addion, the BPA and the technical documentaon show you how to improve many other
security capabilies such App-ID, User-ID, File Blocking profiles, DoS and Zone Protecon, and
credenal the protecon. Some key resources are:
• Geng Started with the BPA—Shows you how to use the BPA to review the adopon of
security capabilies and idenfy gaps in adopon, evaluate your configuraon including
policies, objects, network, and device and Panorama configuraon, and priorize changes
including strengthening your device management posture, improving visibility into traffic, and
implemenng inial best pracce controls.
• Decrypon Best Pracces—Shows you how to increase you visibility by decrypng all of the
traffic that your business model, privacy consideraons, and regulaons allow so that you can
inspect the maximum amount of traffic and protect your network from encrypted threats.

Starng Best Pracces with the BPA and Security Assurance 18 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

• DoS and Zone Protecon Best Pracces—Shows you how to take a layered approach to
protecng against denial-of-service (DoS) aacks that try to take down your network and to
defending your network perimeter, zones, and individual devices.
• Best Pracces for Applicaons and Threats Content Updates—Deploying content and
applicaons updates in the best manner for your business requirements ensures that your
network is protected against the latest threats and idenfies the latest applicaons.
You can find all of these documents and much more from the Best Pracces portal and the
Transion to Best Pracces page.

How to Engage Security Assurance

If you experience suspicious acvity, when you engage Security Assurance, you must provide a
specific set of data about the suspected incident so Palo Alto Networks’ experts can invesgate
the acvity.
• Data to Collect Before Engaging Security Assurance
• Engaging Security Assurance

Data to Collect Before Engaging Security Assurance

Palo Alto Networks’ experts need at a minimum the following informaon about the suspicious
acvity to begin diagnosing the potenal issue. Please collect this data before you engage Security
Assurance.
Basic details regarding the suspicious acvity:
• The suspected aack vector and type: What evidence of suspicious acvity alerted your
administrave or response team?
• Timeline:
• Date and me of the suspected inial aack, if known.
• The me at which you idenfied the potenal issue.
• Incident details:
• Known IP addresses of impacted systems.
• The IP addresses of impacted hosts that are publicly available through NAT.
• Crical services that could make the system or systems a target, for example, databases,
web services, remote access (RDP, Citrix, etc.) servers.
• Known or suspicious IP addresses that may be related to the aack.
• The User-IDs of compromised user accounts (if any).
• Topology diagram or overview: The locaon of the firewall in relaon to the impacted hosts. (A
complete network topology diagram is not required.)
• Malware and indicators-of-compromise:
• Samples.
• Hashes.
Firewall data:

Starng Best Pracces with the BPA and Security Assurance 19 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)
Geng Started with Best Pracces

• Tech Support Files:

• Generate and upload Tech Support files from the firewalls in the path to potenally
impacted devices at the me of the suspicious acvity.
• If you use Panorama to manage the firewalls, generate and upload the Panorama Tech
Support file.
• Firewall logs: Export logs from the firewall and Panorama appliances from two hours before the
suspicious acvity. Before you export logs, verify that the CSV row seng is at its maximum
value of 65535 rows and if the value is lower, increase it to the maximum of 65535 rows.
Export logs for each of the following basic log categories (if logs are enabled) based on IP
address informaon and Timestamp details (you can filter logs to display log entries based on IP
address and me):
• Data Filtering logs
• Traffic logs
• Threat logs
• URL Filtering logs
• User-ID logs (if you suspect lateral movement is involved)
• WildFire Submissions logs

It’s important to understand your deployment’s log retenon policy and log retenon
capacity to ensure that no relevant data is unexamined. Administrators may need to take
addional acons such as exporng data from firewalls or other logging servers to assure
connuity and completeness of data for the duraon of the invesgaon.

More ways to idenfy meaningful data about suspicious acvity:

• Use the Applicaon Command Center (ACC). The ACC can show you traffic spikes, anomalies,
and changes in the me before, during, and aer the suspicious acvity.
• Use the Threat Monitor Report to view the top threats over a the me period preceding,
during, and aer the suspicious acvity.

Engaging Security Assurance

Aer you collect data about the suspicious acvity to ensure the mely analysis of the relevant
informaon, you’re ready to engage Security Assistance. You can engage Security Assistance in
two ways:
• Log in to the Customer Support Portal. Click Create a Case to open a support case. When you
fill out the form, select Threat.
• Your sales engineer (SE) can open a support case on your behalf.

Starng Best Pracces with the BPA and Security Assurance 20 ©2022 Palo Alto Networks, Inc.
Version Version 9.0 (EoL)