CYBERSECURITY SURVI VAL GUI DE Principles & Best Practices January 2015
Lawrence C. Miller, CISSP Matthew Ancelin & Shoba Trivadi
Advisory Panel: Matthew Ancelin, CISSP – Chief Contributor & Reviewer Judith Backel, CISSP – Reviewer Jay Mackey, CNSI, CNSE 4.1, CISSP, CEH – Reviewer
Palo Alto Networks, Inc.www.paloaltonetworks.com © 2015 Palo Alto Networks – all rights reserved. Palo Alto Networks, PAN-OS, and Panorama are trademarks of Palo Alto Networks, Inc. All other trademarks are the property of their respective owners.
C7*76 Foreword
1.
Introduction Principles and Best Practices
1
C@ ;@= & @
7
3
Modern Applications
2.
C@ C<;@@
49
Traditional & Next-Generation Countermeasures
3.
C@ B@ %@ & %;=@
85
Enterprise Security Design Elements
4.
C@ '<<;@ < %< A< <@
145
Next-Generation Firewall Technologies
;< C A;@@
179
A;<;@
183
F5*5) @ H H< XH @ A@H &HK AM K=HH =X@@M @@. AH @ A@H &HK, ., K @=J H<H H< K@ H= I=HM MI=HM K=@@ = HI I I IHI. <= = = H = IH@ H= I=HM H. H< HLH H< CMI=HM @, H< LHH= H= I=HM @H = =JH@ IHI H HMS J H<H. R&LH-H=S =@= H<H K H< = I= HK HX = I H J= J===@=HM H@ J HX, @=H=, H<H. REH= I=HMS @ K=H< H<H HH= @ @L =NH=; K<=@ MI=HM @ H< JH @ H< HH =@ K=H< JI@=@=H= J=I. @ A@H &HK = @ @= =IHM K@ H H< = =H XK@@ HK I=HM IH. <= HIH HM HK, K < H < H<= K@, H<= =@@, H<= IH= H<= @ H<M =HH H<= H H <=HH I HK H H CYBERSECURITY SURVIVAL GUIDE1
<@ @=H H=I < = H< H= I=HM, K < H<= K=H< H< = K@ K< HIM H J IH K@ K< MI = < K=H< H< J<= <=@<= == HH K@ K< H< < H == < H=I H H<=J. @ H= HH=H= X= H<H J < J = H=. H< =HH HIM, K @J H< < K=H<IH @= H< I@= H IH H< H= H H=. HMS =HH , K < H<H IH I =J M H< HIH H<@J H H< L<=@=H= =J H HH= H M =J =H = H=. @ A@H &HK AMS < = H<H H< K@ =@ = H<= K=@@ <@ HIH R@M @S H<= J=H K@@ I=@ I HK. H H<H , H<= =@I @JH =H H< DI= @ A@H &HK =@M I@=<= I= . < H<H HIH H< LH H= @ II@ =H= MI=HM H<= . +IJ=J= MI=HM H<H LI H == I= I=HM I I= LHH= @IH=, K<=< H<= @ =HI. '5
Palo Alto Networks, Inc. www.paloaltonetworks.com © 2014 – 2015 Palo Alto Networks-All rights reserved. Palo Alto Networks, PAN-OS, and Panorama are trademarks of Palo Alto Networks, Inc.All other trademarks are the property of their respective owners. 2 PALO ALTO NETWORKS®
I75)8(7 P5( 0*6 ) B*67 P5(7(*6
MS @=H= H<H @ < J@J @L I H< J . *= H H< H= =@I K = H<H, H @, I@HM -@=.
IHM H I< B= I 'K DJ= (B'D), @I IH=, I=NH=, HK-X HK=/I=HM/ H/H., J=HI@ H H H<, IH< @=H HK I=HM <@@. A I@H, M = HH HK I=HMPH=H=@ H I< -=-H< =H I=HMPIH @ J@J H H< <@@.
CYBERSECURITY SURVIVAL GUIDE3
4 PALO ALTO NETWORKS®
<= = =J= =H H< @@K= H: V Pa/ 1: C6#/0#!/'6 La+"0!a# a+" T&/#a0 HH H< CMI=HM @ H< ==H H< H = H<= . H @ =H H=H=@ K@@ IH I. V Pa/2: C6#/0#!/'6N#5-G#+#/a'+C+#/*#a0/#0 H H=H=@ LH-H= H@ H<=I H<H J= IHI. V Pa/ 3: C6#/0#!/'6 B#0 P/a!'!#0 a+" P/'+!'#0 HH H H= ==@ =HI =-H< @M= =X = @H I=HM H<; H< N-HIH @. < < = H<H =H <@ HIH IH H< ==@ == I HK. V Pa/ 4: C6#/0#!/'6 S'+0 $/* Pa A N#/0 K=H< == L@ @ A@H &HK H =H LHH= =K@@ H<@M I= A D, D CHH D.
CYBERSECURITY SURVIVAL GUIDE5
1. C<'*56*(857< L)6(* & 5*76 "< ; A== <; @
< @=H= @ = <= =@M =@@M =H = @ @ K<=H, IH H< =X=H HI TMU. @ H<@= EH= 2.0 @=H= ==@M = I K-@H I H< IM HK I K @ @=J @ =H=H. A= H < =M CM H< A=H= H= H (A), M = =N= ==XH XH H< I EH= 2.0 @=H= H<@= = H<= =NH= =@I= HH @@H=, = K@ <=, I L ( 1
L@, HJ@, H=, I=H=).
CYBERSECURITY SURVIVAL GUIDE7
K*< C(*7
E;=@ 2.0 ==<;@ O; A=== @ K @@ <3 -@ ;<<@ =< = ; <<<;, ;3<<; @;, ; ; ;<; =@ ; ; ;=@.L
S*(85 E7*556* N*75 +I= H= HK I H =@M =@ L= Q H< H HK K H< THIHU HK, H< HH K TIHIHU HK, XK@@ K @M H H< =H HK H< HK HK. AM HX H<H ==H H < HIH HK H H < IHIH HK K @@K, K<=@ M HX H<H ==H H< IHIH HK K @. A K LH= == @=H=, @M H T<@,U K = I@ H< =K@@.
1. The Application Usage and Risk Report: An Analysis of End User Application Trends in the Enterprise, Fall Edition 2009, Palo Alto Networks, Sunnyvale, 2009. (For more recent reports, search for ‘recent reports on applications.’)
8 PALO ALTO NETWORKS®
For example: V DCFH 80 :CF K96 HF5::=7 V H 443 I K HX V H 25 -=@, H 20 21 F BIH K=H< M H<=, HK I=HM = H =@ HM. C@=M= @=H= P IH@M @@K @P= =XI@H I M @=H= I H< I. A@=H= <J @ ==@M J=J, I= H<=I I< M= H <= ++$ <==, H @= H @M H ( H X@H=) HHI@ =H= XK@@. T&0,
a'!a'+0 ('+!"'+% Maa/#) &a# #!*# /#"*'+a+ aa! #!/ $/ !6#/!/'*'+a0 a+" &/#a "###/0 '+;/a# +#/0 a+" 060#*0.
K*< C(*7
A; < @ O; @ = < ;@ < ; @ =<.
C066+< A0(7 6 I &a0 a0 #!*# '+!/#a0'+%6 "'$;! !a00'$6 a'!a'+0 a0 #'/
%" / a", '+ a !#a/ a+" !+0'0#+ *a++#/. M @=H= @@M (@K =, <=< K) @@M (<=< =, @K K), IH H K< = HKP= <K H< @=H= = = I.
CYBERSECURITY SURVIVAL GUIDE9
F L@, M =NH= K I =@ HK= @=H=, I< F, =HH I= IH= I< I=H=, < J@H, H=, I JM. KJ, H< @=H= I H @ =H=J =H= I H =NH=S I@= =PK<H< =JHH@M @==I@M.
K*< C(*7
A==<;8A @<3 ==<; @ =< < <= <3 =<@ @; 3< ; @@. A==<;@ ; @@@ @<3 < ==<;@ @<3.
P*56 0 D*9( *6 @ J=PI< H< H@HP<J I=I=HI = I= =NH= JMK<, @M = @@K H I H< J= H<= =H @=H= H< @ K-@H I. <= H = K ;
< <; (TB'DU). B$D B'D @=J =NH= H< H J== I=H H @M, IH H H <@@ I H H< JH I HM J=. < =NH= @M J= H< HK HK J=, IH H< @M J= H< J= H H H H< HK.
10 PALO ALTO NETWORKS®
C<;@<; < I A =HH H, K H< <;@<; , = @@M @H H H< B'D H. CI=NH= I I = @ @=H= H<@= H<H KI@ @, J=H, @ L=J, I= H =H@@, = H I H< H @IH=, @= H< H =J @ IH=J=HM, <@ -K =, =H= @= , H< H<=. CI=NH= @ @H H H K H< THH H<=U HH @H, K<=< = == =H KM =H M= J= =@I= =H, H@J==, IH=@.
K* < C(*76
BDB; < <; @ @ ; =@<; @ < < <=. I @< 3@ < B < ; < <; =<;, B < ; < <; ;<<, B < ; < <; C, .C<;@<;@ @;@ 3< ;<; <3 <;@=<; <3 <<@ ; < =<@ @ 3< @@ @<;.
#*' ) E7*556* A0(76 2.0 EH= 2.0 H J@IH=M < = H< <J= K- @=H=. DM= HH, =< I@H==, =HH=J=HM
<
H<
H<
HH
K
<@@ = I= =H. EH=@M K @H, I< F, I@H=@ @=H= @=J H<I< =@ @= H H< I.
CYBERSECURITY SURVIVAL GUIDE11
%<= + ; E;=@ A==<;@ + I@ L@ 2.0/EH= 2.0 @=H= =@I: V +=@ HK @= F V =X = H@ @= +M V = H@ @= A'$ HH (A) V I@=<= H@ @= II V IH=J=HM H@ @= +@. IL V 'X 365 '@= =H 'X +I=H V B@= H@ @= B@ V BK- X@ <= H@, I< @., DBL, G@ D V EH= = H= H@ @= CN V *++ H@ @= &KGH V +=@ = =H, I< K=HH, =HH, *=H V == @= +=@HLH
12 PALO ALTO NETWORKS®
= A<=<; < + ; E;=@ A==<;@ = =H= <K =@M EH= 2.0 @=H= <J H = H=, = H< @@K= ( @M= 347 =NH= K@K=): V F <H JH <! A = @ H< 18 H< = =H =H= = A=@ 2008. V G@ D = 33 H H 82 H = H< 6 H< HK < +H 2009. V
K=HH >I 252 H = H = 775 H = H K=H< = H< 6 H< HK < +H 2
2009.
HMS H- =HH-=J K@, H H= < I=@M. @ < I H< H, R; <=<; <3 ;
;=@ ==<;@ IH HH=H=. %<; B;L@ ; @@ '=NH= H II H< HH=@ I= XHP H< =<H =P H< B'D I=NH= H, H< =H<: V @==H@M @@K @ H<@= EH= 2.0 @=H= M =@M == H<= I = H< K@, V EL@==H@M <==H H<= I, IH H< I@ H H=J@M I< @== K=H< H=H=@ XK@@ I=HM H<@=. 2. The Application Usage and Risk Report: An Analysis of End User Application Trends in the Enterprise, Fall Edition 2009, Palo Alto Networks, Sunnyvale, 2009.
CYBERSECURITY SURVIVAL GUIDE13
A)9*56* E++*(76 + I*++*(79* P0(*6 <H< =@==H@M @@K ( =) L@==H@M <==H (IH H ), H< J I@H =H=J @== I< H< =@I:
<@ %< $H IH=J=HM I IH =H< X KM H =HH H< IIH H<@= @=H= K=H< H< H= =HIHI (K< @@K), I @=H= H<H I=@= H H< @ X=H (K< <==H).
D6587 + C57(0 B86*66 O*576 HH=@ =IH= =H=@ I= H= I H II <@ H<H I H @=< =X KYK H H =IJH H@, K H @M K I I@@M H H<= I @ H<@= @=H=.
E=<@ < @@ ELI H =H=@ = H< H= I H IKP H< IH<PJI@=@=H= = @ H<@= @=H=, HI@ H--I HK @M H<H =IJH H@ ( L@, K=H< LH@ L=, MH HI@, H H @=H=) I=HM H H<H H< =.
%;@ < <;-C<=; @H= I@HM -@=, L@, H< .+. @H< I H=@=HM AIH=@=HM AH (AA) = <@H< =NH= H< MH C IHMS DH +I=HM +H (C D++) = H=@ =IH=.
14 PALO ALTO NETWORKS®
I7* N8'*5 + ! *(0 *6 BM = H< = =H K=H< @H=J@M @==H, K H @=H= H<H IH<=N IH = H< H=, I=HM IH K H< = =H K=H< H=@@M =X=H I IK @ H<@= @=H= H<H M I = H< =NH=.
R*856*) '< M0(86 A(756 A@=H= @ <=> I M @==I H, I< K K=H< +M I = +M= I= H<= H = =J=@ IH. < F@ @K =J = 2012 < H K<=< KI@ H= H< +M @=H=, @= H<=-HM H M ==J=I@ I= K<H H<K= H @=H=H +M =H@@.
A==<; H-;-' M EH= 2.0 @=H= = H =IJH @M H XK@@ H<H H<M =@M =H@@ I M J=, MK< MH=. <= = @=< M M=@@M >IH= <K H< @=H= I=H I= HH= I< V %< <==;, I= , <= H H@ (C D) I= =. V @ < ;<;-@; =<@, I< I= G@ @ J C H 80 () =H H< H C H 5222 (ELH=@ = H@), I= D&+ J H H< H< H 53.
CYBERSECURITY SURVIVAL GUIDE15
V ;;; ; <<; @ @@, I< K< -H (2) X@ <= @= B=HH =HH () @=H @= == = I= J . V H; ; '' ;=<;, K<=< H< @=H= HX, L@, J C H 443
A==<; @ ; =< < A=@ 2013 A==<; @ ; =< M @ A@H &HK I H<H IH 1,317 I=I @=H= @MN, 26 H (334) I ++$. ' H< 334 @=H=, 39 @=H= < H, 35 @=H= I C H 80, 9 @=H= I H H.
A==<;@ @ '' F=I 1-1 <K H< I HM @=H= H<H I ++$.
16 PALO ALTO NETWORKS®
F 1-1: C< <; < ==<;@ = < @; ''
CYBERSECURITY SURVIVAL GUIDE17
C0*7-S*5 9*5 A0(7 6 M H=H=@ @=H-J @=H= K = I M I= @=H= I H< H<=I H= K<=@ ===N= =IH=. F L@, *C +<=H I H <= I =H = =H=@ H <K H< H@ @=H= (H=J@M) IH=, H< H< H J HH= < ==@=HM.
H% ; H%' =H< H< H HK J@= K-@ K- @=H=, + <J =H K IH L=H@M HK H<= @@ H= HX. =H=@ XK@@ H< I=HM =HIHI I@ H =H=I=< K<H< H H< @=H=, == +, = I @=H=H I= I.
K*< C(*7
< < C (C) @ ; ;-=<@@ <;<; (IC) =<<< ;@ ; ==<; < ; <; 33; <= < ;<, ; < <= <; @ ;@.
C08)-B 6*) A0(7 6 M H= ==@M I= @I- @=H= I< +@., EL, 'X 365, G@ A. < @=H= HM=@@M I= K K, IH H< K=H< H @=HJ <J= H< @=H= = HH. C @=H=
18 PALO ALTO NETWORKS®
H<H H-< =@I H< I= @ I @=H= I< +<=H, =I, + *C, +M, =K ( F=I 1-2). C<<; A==<;@ ; %< H<=
F 1-2: "<@ >; ==<;@ <@@ =<@
@ A E<; << =I@M, @=H=-@M ($M 7) HH = ==@M .
5)70 S*(857< M*685*6 < I=@H H J= HK-@M ($M 3) HH= H
D<=@ <H J@ I= M H< H<=I @=H= J@.
CYBERSECURITY SURVIVAL GUIDE19
%< H<==; H <=, I -H H, HI@=, ++$ <== I H H I = @=H=H I @=H=, K@@ H J HK @==I I. =HM @@ K @K HH L@=H @=H= JI@=@=H= H< H< HK JI@=@=H=.
D@@ @ < K= J=@=@=HM H<H J@H K=H, H@=H, K =H @H=J@M M H H K H<H. V I=@M =M L=H= H<H H<H TKU H<H TIKU H<H H H=H=@ =HI- IHI. V A < =M H< = L=H= H<H, K H= L@=H <= H H ; . MS H<H ==@M <=H=H = H I IHH HK MH LH = H=, @@H= =H=J @ H. H HH =H =X =NH= ==J=I@ @ H< =.
H-P5 0* C6*6 + <=<-X@ L@ =@I =H H<H, HH HH = H< M H, H= HH- =.
20 PALO ALTO NETWORKS®
C C D 2013, H< H HH H <= J@ H<H H<M < L= > H < =J@J= J 70 =@@= IH =H , = =H H< @H =H H < H H. < < K I H <J I H<I< I@M-<= HH, K< H< HK <H= = =H== HH < H =H HS HK. < AC MS HK K H< =H HM =H HS HK K H H< I H@ I H=@ I = H< IIH HH H H<= C HK.
E; '< F 'H 2012 H M 2013 = = HH HH = H H< + EM H K H H H< C+-CE* (IH=@ CH@ +MH CM EM * ). <=@ K <, HH= H< =KH @= = L= IH- HHH =H H<= H@ HK. EM H I= HK @ K = = < HHH.
<; ; '-'=<;@< E@=<; M 2014, H< =H +HH DHH "IH= ==H XJ C<= H=@ H<=HM- IH, =@I= == H =H IH I I, A= HH IH K=H< IH<=NH=, H=HH= , =H=, K=H< H< =HH H I , = =, H H H<H, H<. <= H H I< A1 IHH , K<=< =H H C<= =@=HM I=H =X@@M HH= = =@=HM HH @@@M.
CYBERSECURITY SURVIVAL GUIDE21
C867= *) A77( 6 HH HH, < H J@ IH=N HH <= H H JH H< =X I=H, MH, @=H=, XIH=, J @ @M = =X =NH= H =J @H=. A= H =NS 2013 DH B< JH=H= *H, 92 H H < I@H LH@ H, =@I= =N =, HH-X@=H I, H=J=H, @M, H< IX@=H H<K= IK <.
' <<@ <J @ ==H, H=JH M H< H = @H M =H= H<H. A I<, < K J H, H@H
22 PALO ALTO NETWORKS®
A66*7 *+7 H@@HI@ HM, I< =HM =, <=@ =H=, H< =JH= H H< @=@ =JH= H=H=J JH. H< < M==@, H< JM @IH=J =@M H@ H H=H H< =HH H=. K<=@, H<= H<H H< XH=@=HM H< J=H= = H<H H< H=-HHS = =H=.
' '=<;@< A=@ &H=-HH =NH= H <J =@=HM / HH= @ I< H< =@=HM H =@ HM =H=@ =HIHIPK =, KH I@=, HHH= MH, =IH=@ MH, =H H< . < CH +HH= HH=@ +HI= H = 2011 H<H 33 H= =@I MK = H<= =@=HM @= =NH=.
* M)*5 A77( S757*< < HH HHM < J@J =H =H, I@H=-H ( F=I 1-3).
CYBERSECURITY SURVIVAL GUIDE23
"-'= %<@@ ; ; A '
F 1-3: < <; .
% < A A HM=@ HH = K=H< H< =H= HH =H, L@, I K=H<= =NH= = H= =H @== =H @= = <=<= -=@ = . V < IS K K = =H H K H<H IHH=@@M K@ @K H H< IS IH = H< IP =JM K@. V < =H =H = K H I H< H@ H< HH H H< HHS HM =H =H H< H HK. V F H<, H< HH = @H M L@=H= H< =H@ H H< HK, =H= = @K@M I=H@M H@.
24 PALO ALTO NETWORKS®
I;<; L@ @= ; <; @ '+$#!'+. H= HM=@@M < =@ == H H =H H<H I= H= K<=< H =H K . ' HH <= = =H K=H< @K, L@=H I H H JH HK = K, < I= I JYK H< HH. L@=HH= = II@, =H M J= <@@ H H< HH <=. V =H< <@@ , H< HH < H@ H< MH. < HH = H< @ H HM H H< C: H = H< I K HM= H<. V 'H< L@=H I@, I< HH, J= H< HH K=H< I@@ <=@ I =H (G) , = H<M K =HH= H H< IS @ =, @ H @=, HM, H H< IS IH.
T #6 '+$#!'+ '0 0#a& a+" #a0'+. @ @ <3; <=@ ; 3O 3< <; @ @@, 3< = @; '' < @< < =<= ;=<; @ ; I" < 2 ;<@.
CYBERSECURITY SURVIVAL GUIDE25
P*5667*(* , ;@ < ;@ #/0'0#+!# < <. <= = @M <=J M =H@@= H=H, H=H, H=-A @K H< = <= K<=< I H< HH =H= H@ H< H H H< @K H H=I J= HH=. V A << = @K H<H J= =J=@ (H-@J@) H IH. *H=H @=J = H< B'+ <=, K<=< H= MH @J@ I=HM H@ <J J===@=HM H H<. V A << = @- J=H H=H, @M I H HH IH H<H HH M I@@-= MH=. V B<<@ @@K HH H M IH<H=H= H = H = MH. V A;-A* =@ @=H=H@M =H@@ H=-J=I HK H< = <=, H<M JH= IHH= HH= J@ H< @K. F=I 1-4 <K H< IM J=I =H HH= I = @K =@I= H= =, H= LIH@ = =K @, I= =K +MH X@.
26 PALO ALTO NETWORKS®
P*5667*(* (7(6 F8) M05*
F 1-4: "<@ <<; =@@; @ <; ;
C8(7 CI=H= = H< @=@ HH. < HH IH @ H I=H K=H< H@ HK H @ H H@ H HH MH HK.
CYBERSECURITY SURVIVAL GUIDE27
AHH I=H= HX IH H@H
C) ) C750 C H@ I H<H H< @K HH = H@@@, @, IH@ M H< HH. <= = H< H= H H< IH= K@ H<H @K @= : V Y= H V =J= V ==H=H= HH V J @I (@-@H=) H=
28 PALO ALTO NETWORKS®
=I K ==@@M K=HH @-H=, @-H= H K<=< = H I= H@ HK. AH @I<, H<M I - H H H< J=I K=HS ==. A H=J H< J@J, H< YL=@, XI@, I=H=J H@ . @K K=H I H =HH@M H HH=, H H K L@=HH= HI=H=, =J @I--@M IH K=H< =H=@ IH=@=HMP@@ H<=
3 H< ==H=@ =H=. H =HH@M, @K KM H H=J@M H=H H@ IH H< J=H= =NH=.
* C*750 R0* + M05* < = HH @K = <= H< H<H @ = H= H <K H<M HH H<@J. < H<H <J IH H=H=@ H=-@K HH= = H< , <J H@=< H<@ K=H<= H< H= H<H ==@ H=-HH I H H@ =H= HH =H=J H. AHH H<=I <J @ J@J @K K @M H@ @ = H< <S @ = H< @=M@ HH.
CYBERSECURITY SURVIVAL GUIDE29
AHH <J J@ K H< @=J= @K (I< =J-M-K@), <== @K I=H= (K=H< MH=), J== H=H=@ =HI- HH=.
B " H= I=HM =@ <J = HH@ K=H< @K J HKHM M. HIH@M, @@ H<= <- L= H =@M K K== H< K. <= = I = @ H H H< J@IH= @K H<H =H< IHH IH H J= HH= M H=H=@ @K =HI.
B B<@ ; B<;@ BH (; ;3 ;@) HH ( < ;< <3 <@
<; <) @M > @ = H<= J@IH= @M<= @K, H=I@M =XI@H H=H=@ H=-J=I/H=@K @IH= H HH. A I< =H = =HH H IH K<H =H = H<H HH =H J=I H= @K, <K =H =H I H H H@ H<.
+ B<; @ B+#? A HH=@@M J=I IH =HH =H=H= = J=H = H< THHU =H@. $=H@@M, HH = HK H (=H <=). @= @= HM @K, K<=< K @ K =H H, H H@@M =H H= I=H= <@ H H< IH= K@ ( F=I 1-5).
30 PALO ALTO NETWORKS®
B<; @ C<;<; C;; BHH H@M H@@ M H@ J.
B<; < <;<
F 1-5: A < <;< <;
I< H< KM H<H H< HH < K<H K =@ = @ IH=, HH <= K<H = =@ = H< K@ @K. &K @@ @K H< HM K HH< HK @, K=H< < =H <= K= H< K HIH=J H< J@@ HH.
CYBERSECURITY SURVIVAL GUIDE31
B7*76 5* ( 7* 50) + M05* BHH J@J H II K @ H =H I=HM IHI @M. + H< H =HH I=I IH=@ H=H HH :
D@ ; F-<; V BHH @K H<H H I@@ JH H< =@=M I=@H = H< HH =H@. V A HH <J II H@ J =H=IH @@ J H< K@, K=H< I@H=@ @@ H=. V BH @ HH=@@M @J H< =H H I=H= <@, J== H< K=H< =X=H I I=H= H< H H H <= H=.
";<; V H H< H@ J @ @H@M < H< HS IH=@=HM. <= @ K = < HH K, K< K I H= H< HH H=I@ H I< @@H= =H I, K<=@ H< H H< HH I@ = . V < =HH =H = H<H H< =H= = H< H =HH H, I H< IH=@=HM @KM < @H .
32 PALO ALTO NETWORKS®
%@@; ; I;; V G=J H<H H H< < H HH =@M < IH=, H<M H=I@@M K@@-I=H HH @-H =HI= =H HK. V += H I H< H@ H
5*76 7 7* E7*556* G=J H<= YL==@=HM =@=HM H J , HH H I IH = H H< H=. BHH J=HI@@M I@==H = H H<= IH=@=HM, = = H H< H<H @=X =H= H H. < I@H=H =H HH = @@M @H I H H< H-<P HH H<H K = M I@ H@= =H =H= H< LH. H=J =JH=H= = I= H H< =H=IH H@ =HIHI HH.
CYBERSECURITY SURVIVAL GUIDE33
I;@ < B<;
F 1-6: @ <; ; <;< ;@ < <;
< @@K= H= =H H< @ HH: =, DD, X=@, HH =HI=J HH. <= = @@K M K<H H< =IHM = = IH HH.
K#6 T#/*
A <- @ =@<; (< =@<;@) < <;< <; < <; ; <;< @@.
34 PALO ALTO NETWORKS®
S B7*76 T a/%#0 +#0 a/# $#+ "#"'!a#" 0#+"'+% 0a*. T a/# !a#"
0a**'+% +#0. < = = =@M H=
T R0! +# '0 a+ #5a*# $ a 0a**'+% +#.
E= < @< B<;
@< <; @ ; = <3 @=; <;. I @ = <3 @;; = < 25,000 @= - @@@ = < 3< ; ; < ;, @ =, @; ; <3 192 @= -@ = ; = <. < ; 7@ ; = @ ;3<; =<; <; <=@ < ;<@ =3<;! @< @ @ < ;3 < ; 2.4 <; <=@ <.
CYBERSECURITY SURVIVAL GUIDE35
DDS B7*76 A 0'%& '0 + 0a**'+% +# *"# '0 0# 0 a0 a/ $ a
"'0/'#" "#+'a-$-0#/'!# aa! (DDS) . < DD+ HH HHH H JK<@ HH MH K=H< HX @ I =H. H< , H< H= K=H< H< =H @=H = H H H< HH H< HH =H@. V H H< H-< = =@M I= H< = <H = H< H= H Y H HH K=H< HX. V < H-< @J H< =J @ HH H H IH HX H<H JK<@ J HK I H H< HH. V < DD+ HH H HH =X = =H< @/ @=H=@ , H LHH MH H< HH = HI <@H= H< DD+ HH.
DDS +#0 /#/#0#+ a "a /'0 $/ #+#//'0#. < H= =H@ HH=@@M H< HH DD+ HH I@H= = KH= @H IH=J=HM. EJ = H< H= = H H< I@H=H HH, M =H =H H==H= = H< HH I@ I J@I@ HK I, K<=@ IK=HH=@M =@=HH= M=.
36 PALO ALTO NETWORKS®
E= < '; B<;
'; <; @ ; = <3 DD<' <;. '; @ < <; ; .'. ; @ @< ; 2011. I <; DD<' @ @; D, '# ; H P<<@, ; @ <<; @= < 'B @, "'#, ; <<"@@;.
F( 0 B7*76 F'+a+!'a +#0 &a# &a" '"#0/#a" !#/a%# '+ /#00, a/%#6 "#
0#!a!a/ a*+0 $ "a*a%# &a# !a0#" '+ *a/#. B= HH, I< I+ +MEM =@ H< =H H<H I @@ HM H=. < HH HM=@@M H @ @=H<= H< = HH, K<=< K @ =@ =@ K. H, = HH H @ =H @@K= @ I HH H @= H< H IH I=@= H<= K HH HH. EJ K=H< H<= @@ =N, H< =H H< HH I: V I+ HH <J H@M @ H H@ =@@= @@ H= = JM <H = H=. V 'H< X=@ HH I H< H<H =H =H=, = AC (AIHH C@= I) H.
CYBERSECURITY SURVIVAL GUIDE37
T '*a! $ a ;+a+!'a /#a!& !a+ # #+/*0 $/ a+ #+#//'0#. < < IH =H =H= @ H =I X=@, @@ H< H=. A=H=@@M, = I *I, F= AIH= I =, H< H= @ M H<H M HH=@@M J J.
E= < @/'=E B<;
@/'=E <; @ O;; <; @ @<; < ; $100 <; 3< @ ; -@ @;@@@ <. I @ <; =-<-= (2) ;<@ ; D (@ D <<<) <;<; 3< <; ; <;<, ; < ;3<<; 3< ;<.
5*7*) I75869* A77( B7*7 BHH @ M H HH, <=H=H = HH. < HM HH JM =H H< H<= @ IHH. H HHH= H =H @ I I H @I< H= @ @, H< @@ HH = H = =X <=
38 PALO ALTO NETWORKS®
Ta/%##" a+" '+/0'# aa! +#0 /#/#0#+ +# $ *0 "a+%#/0 &/#a0 $/ a+ #+#//'0#. < H<H @H @KM IK H H=-J=I J, H<M H H< H I H<H H= H<M =HH =X@@M HH H< <=<H J@I =H= I< < J@H, I , @= H, X=@ H, IH @=H.
E= < A< B<;
A< <; @ ; = <3 ;@<; @ ;@ ; @ ; @<; ; =<=. @ ; ; 2009 ; <@ <;<;@ ;; A< '@@, G<<, J;= #<@, ; @=.
#7 6 7* I)8675< ) '87 B7*76? < L@= HH < H=@M H IH= = H< =IHM, @ = <J I H H I K=H< @K H H H H= =H H< @H H H=I HH. IH <K H<= = , =H = =HH H IH H< =HIHI HH. H=J =JH=H= = I= H H< =H=IH H@ =HIHI HH.
CYBERSECURITY SURVIVAL GUIDE39
I;@ < <;
F 1-6 (=): @ <; ; <;< ;@ < <;
<H, H< @ = H H H< H (H< =H <=) H<= = (H< H@ J).
D*(77 B7*7 H< H H H H H<= J, H<M H H K =HIH=, I@ H, M H< H<= H<H HH I=I I. < @ < H<I
40 PALO ALTO NETWORKS®
<=@ H<= HHM M H=
D@; C<; ; C<;< ' D=@= H@ J H I= H<
#< 5* B7*76 (0*; & (0(7*)
B<;@ < ;< <; @; @ = HH K, HH HM=@@M H @M =@ J, IH H< < I@H=@ H@ J IM I. A=H=@@M < J = HM=@@M =I@H M J=HM =H== H @ H< HI @H= H< J.
<
=H== =@I 2 HK, @ =@ HK= =H, J I=H= H<H LM H<I< H< =H H. <= H<H =@M X= H< H@ J = =@ <@@, I== H= H<=@ =JH=H=.
B<;@ @; <@@ < @ H<= J @=H, H HH = H K=H<H H< @ H@ J, = H<H < IH =@ A$$ H< H@ H= H
CYBERSECURITY SURVIVAL GUIDE41
. M H< H@ J =@, M H< @@ H= II@, H< H K=@@ @ H H IH, I=@M I@H @H@M K H J, H< HH K=@@ I=@M J.
B<;@ = < < < ; ;@ H @ H<H H< J K=@@ H H IH @H =I@HI@M. A HH K <S I HH, < K=@@ ==H@M HHH H J H K =HIHI.
; +; ;@ @< B<;
F< ;@ <3 @ ==<, ;@@ ; @< <;@@; ; -=
-) )*0 )*6 7 57*(7 E7*556* < H-K @ = J =@ =IHM H H< @H H H=I HH. KJ, =HS =HH I=HM =@ H IH H<H H< H, K<=@ @@ @, JM @=HH@ H =H=H H< H<H H<H HH H ==J=I@ H=.
42 PALO ALTO NETWORKS®
$==HH= @@M I H: V $==H *I V = H=J +<I@ V B= H=@ H AHH
I"IED E'$CE': T *0 '0 '*'a'+ '0 &a -"+ *"# '0 '+!/#"'6 /#0/!# '+#+0'#, & '+ #/*0 $ '*# a+" #$$/ . A I<, @M H< @H H H=I HH HH, HM=@@M = HH. <=@ M H HK = H<H, = HH H HH H=I@ H=PH<M =@M @= <H H =H H<H H<M , H< H< H@ =H=J J@I@ =H=.
I"E IE'I*E 'CHEDE': S#!+"6, -"+ *"# '0 a/%#6 /#a!'#, 0*#'*#0 a'+% 6#a/0. EH= I=HM ==H IH I H<H =HI= L@=H SH I = H< XH @. JM @ , @M= H< =IHM H =@ HH = @I H K=H= JH H H @K K< = = =H MI I= =
CYBERSECURITY SURVIVAL GUIDE43
BEIG I"%ACICA $ AAC: S*# +#0 ' 0'*6 # '*/a!'!a aa! a !**a+" a+" !+/ ##. <= = <K M HH H =H=IH I H< K@. *@@ H<H H< > <@@ < = H< I=H H X H H@ @@ H< H@ J = <H K=K H=. < =H=IH H< HH =, H< =XI@H =H K=@@ H =HH.
C(086 6 D*59* ): R867( H< *IH, IH<=H= K K<H HIH H<H @H @@ H< H@ J K @H K=H<= H< =H +HH. <= @@K @ @K H IH I@= H @@M =H H< @@-=HH =@= @@ H< J H .
%<@ <; <;@ M HH <J J @@ J H< K@, K=@@ =X@@M IH= = H<H <J JM @=HH@ @K H HH =. <= @ =H@M = H< HH =H@, K<=< H< == K = H K=H<H H< @ M =H.
I+ 0&/, a "'0/'#" +#/ '0 "#0'%+#" '&0a+" a "#!a'a'+ a#*, 0 ' ' # #/6 "'$;! #5#+" &'0 *"# +#0 '+ %#+#/a.
44 PALO ALTO NETWORKS®
@=<;@ @ ; ;@ < E;=@! + K<=@ < X
T&'0 0 /#0+0'''6 $/ /#!'+% #+#//'0# $/* +#0 0a/#6 + 0&"#/0 $ #+#//'0# '0#$.
CYBERSECURITY SURVIVAL GUIDE45
S85< V H = ==@M @L H =H=I=< HK @=H= HK. V @==I @=H=H @=H= < M H< H<=I H@. V <H H <J I< =N H<= H=J <J <=H H=HM H XH H=@ H=H=J JH. V < H<H @= M@ = < HH K<=< HH K=H< ==H=@ =H=, J@ =H, H@=< I=H=, H< K K=H< H@ HK H @=< H<= ==. V BHH =H=IH, I@H-H@H HK = <=, K<=< =H, -I, H M IH J=I @==I H. V CH=, @K H, JH H=H= <J < @M @==H I = @= K=H< HH @K.
46 PALO ALTO NETWORKS®
D6(866 < @@K= I=I = H J = H<= MH IH H < MI L@H= <: 1. MI K <@ IH= J=H, MI H@@ H< = HK @=H= K<=< <H =H, JI @I @=H=? <H L@ =H=@ @=H= H<H MI I I@@M K<=< @I ? $@@M <H? 2. MI K <@ IH= J=H, <J MI IH
R6@C798 G=H9GS CF F9GHF=7H98 B9HKCF F9GCIF79G? /<5H K5G MCIF F957H=CB? 5@=B; K=H< 7C-KCF9FG CF :9@@CK GHI89BHG, 5F9 A9H
CYBERSECURITY SURVIVAL GUIDE47
K0*)* C*( 1. <=< H< @@K= = H L@ HM=@ R<@S H=H=@ XK@@?
) %< 194: I;; C (IC) ) %< 443: ' '< ('') ) %< 25: '= " ;@ %<<< ('"%) ) %< 53: D<; ' (D') 2. & HK H<=I H<H I H J H- HHI@ =H= XK@@? 3. & HK H<H EH= 2.0 @=H= XH H =NH=, H< L@ H= 2.0 @=H=? 4. I F@: < @I= @ H J=, K@@ @ H @=H=, = = =H = H I HK. 5. I F@: B'D H @M I= H<= K @ J= H HH< K=H< H HK I. 6. & I = =I K< B'D @=M = =H=J. 7. I F@: =H = K @K H L@=H HK JI@=@=H= H< @=H= JI@=@=H=. 8. I F@: A @ H<H I K L=H= @==I , =X, I< H<H =H H K RIKS H<H. 9. & H< <H=H= HH. 10. <H =@ I=H @@ H HH <J = , = H< JI@@ H H-K? A&+E*+ A*E A E E&D 'F + B''. 48 PALO ALTO NETWORKS®
2. C<'*56*(857< C87*5*685*6 <; & -G ; <; C<;@@
<= I@ IH@= H< J=I @ I=HM IHI K<=< L=H HM HH H< K=H< LH-H= I=HM H<=I. <=@ H<= HLH = ==@M I HK I=HM H, =H = =HH H K =H @H= H MH-@J@ I=HM H@ K@@.
CYBERSECURITY SURVIVAL GUIDE49
H H< @@K= = H=: V =H=@ E=H +I=HM V &LH-GH= E=H +I=HM V =H=@ &HK +I=HM V &LH-GH= &HK +I=HM
50 PALO ALTO NETWORKS®
5)70 E)7 S*(857< +MH I=HM =@I H@ H<H = =H, I< H IH, @H, J, J=HI@ J, =IH=@ H@ MH, =@ J=, IHH H@@ <= (A), M H< =H IH= J= =H. <= H= =I H< @@K=: V AH=-=I/AH=-+MK V +=HI- AH=-=I +HK V -DM EL@=H AJ V - DM AHH
A;-*@/A;-'= < H< @H H= IHI, H=-J=I HK L= X@ MH HHH H H< H< =H K- X@, =HI. H@@= H=-J=I HK =J@J =H@@= =, K<=< H < @-@J@ H MHS I. +=HI IH I@@M K@ IH. DK@= = =HI X@ = H<= I H=@ IH= H< HK MH H<M I= .
';-@ A;-*@ '< BM =H HI, =HI- H=-J=I HK = H=J I H<H @J H= IHH =H K H<H IH=@ K H<H = =J, =H=X, @MN, =HI X@ H =H=IH. < H=I <- = H H<H H @K,
CYBERSECURITY SURVIVAL GUIDE51
K<=< < K=HH @, IH = IK MH H H< I=HM =IHM. KJ, H< H TN-MU = =@=. F=I 2-1, < M @ A@H &HK, <K H<H H< I M = TN-MU L@=H J 5 H 20 M = H< @=H= JH. <-D E=< A@
F 2-1: A < ;-@ <; ==<; <
+-@ <-D A@ HH=@M, K- N-M HH = I=H=X T= H< K=@U I H I H= @, J, H< -=@ H<H. <= = I H I H =@I= I K -=@ H<H, J=@=@=HM I -=@ I=HM @IH=, I< H=- H=-J=I, I H< K H<H JH M @K J@. =I H=H=@@M @@-=- H H<H M @@ H< H @=< H<= I I @=JM. =I @@M
52 PALO ALTO NETWORKS®
I H<@J H< =. < =YL==@=HM @ LH==@=HM J=I < I H< H I M <=H=H @K, =@I= >, H=H, H< L@=H.
P57*(7 67 "586*6 ) M05* + @M K KM HH= = H I H< @@K= HK XK@@ = H<= H=: V A=H-+MK +HK V H HI= JH= +MH V @ F=K@@ V &HK-B F=K@@
A;-'= '< AH=-MK HK = JM ==@ H H=-J=I HK, = H<H =H I =HI H @ H< @K M J=I, I< K, @==I K @=H= H, H< @==I H@, K<=< < I <J= K=H<IH H<= ==.
H<@ I;@<; %;<; '@@ H HI= JH= +MH (+) =HI <I=H=, <J=@ @M HH=, =H H< HH= @K =H J= <=. +MH ==H=@@M -@= H H <H K<H H R@ <J=S H< KH< <J= H<H JM H<H @=. <=@ =H = @ H, + < H K=@M H I H< LH @L=HM = @M= =H H=J@M, H< @H
%@<; F@ @ ( <H-) XK@@ @M =H@@ XI =H, I< @H H IH. @ XK@@ HM=@@M H @=H=-@M ($M 7) XK@@ H<H @@K @ HX H =H J= ==J=I@ ( I) I=HM @=M. @ XK@@ H=I@@M <@I@ @H I M H HJ@= I H<H H H<= @H IH =H@M H H< HH, L@, J I@= =F= H=. =K F=K@@ = L@ @ XK@@ H<H = =H@@ H H< =K 7/8 H H= MH. A @ XK@@ @M HH H< =H J= H<H =H = =H@@ , IH J= LH @M HH= == H< HK.
<-B@ F@ &HK- XK@@ HM=@@M HH H (HIH) HK =H H<H IHIH HK, I< H< HH. KJ, H H=H=@ HK- XK@@ @=HH@ H HH =H == H< HIH HK H<H H<H ==H K=H<= H< HIH HK, I< H< J= H<H < = M @K = H= H<I<IH H< HK. A @ XK@@ J= H<= LH @M HH=. A=H=@@M, @ XK@@ H@ IHI HX H< =H H <@ JH @K H<H =H. KJ, =H <I@ HH< H<H =@= H<K= M= @ XK@@ = = >H=J = H @K HM.
54 PALO ALTO NETWORKS®
N*;7-G**57 E)7 S*(857< H< MH I=HM K@, J=HM K H< = I
A==<; +@; AH=-J=I H M I= @@ X@ , I@ H<M H< K-. <=H@=H= I H<H R<; ; ;O O@ ; =<@@@ , <@ @@ < .S <= H= H=@: V < KM <=H@=H= K V < <=H@=H= K K< =H H
+@; +<@ BM =H=M= K<H LH @=H= @@K H I, H@= H<, K<=H@=H= < KI@ H< @ IH M H< X@ I= H @@. H K@, H MH, H<= < = I=H H=J. I = H<I< K<: V H= K=H< IH HK IH <, V HH@M <= @=H= HH, V H< I H <J H< =
CYBERSECURITY SURVIVAL GUIDE55
+; +@; <@ ; ; <@ ;< <=H@=H= K K@@ =@-I <=, I< A, K<=< H H IH JM H, LIH H< LH M = M IH. +=@-I J @ I K<=H@=H= H=J@M. KJ, I= K<=H@=H= K=H< I-=J @H H IH JM <@@=. U+$/+a#6, ' '0 # 0#/-"/'#+
a$/*0 &a a/# *0 $#+ aa!#". E;07 P5*9* 7 +=HI H=-@K @IH= <J H< =<H YK <J= H I K=H< K =HI = H<H, K<=@ @K K=H IH H< K=H< K J=. V = =HI H HH H< H = @I H @M= RK<--@S, K< HH = =H=X <=H K, K<=@ 2 K HH I. A K = < , K<=< H HHH H @ H< M@ =H H H< J-K= H @K =HI. EL@=H JH= H H =H=M MH<=, H< R @
@; < <@ ; < 3< ; ; . S
56 PALO ALTO NETWORKS®
<@ L@ @ <;@@; E< M
'<==; < @ ; &LH-H= L@=H JH= H H< =H I H H =@@ H< H<H KI@ @ H<= L@=HH= H<=I, =H .
M'0* D*9(* M**7 =@ J= H (D) HK J= LH-H= =H I=HM =@ J= I< H< H@H. D J= H@=N H =@=H= =@ J= I< : V D <@@ =;<; (D%)P*H=H K<H HM H H H=HH H< J=. V %< ;<;*I= , @ MH=, @K I=HM HH=, H. V " =<<;+ =@ J= K @K JH T>=@=U TH=U =@ J= V '< @<;PH@M =H@@ HK, =@I= H< IH J-H<-= V < @/=I@M H@M @H H< @H HH @H H@ J=
CYBERSECURITY SURVIVAL GUIDE57
K*< 7*56
J; 3@ < ; ; A== ' < ; <<- @@ < . @ @ @<@ <; ; @@ < < < <;< ; ;@ < ==<;@ < =; 3< , 3< @<@ ;< @;<; ;/< <;< A== @ A=='< @. J; =@@@ @ 3@ <3 =; O@ <=; @@ @, <;3 @<;. D<; @< @ ; < =<@. <<; @ >; 3< G<< A;< .
5)70 N*75 S*(857< =H=@ HK I=HM = : V F=K@@ V HI= DHH= JH= +MH V CHH F=@H, *$ F=@H, L= V =HI@ =JH &HK V DH $ ( $) JH= V =X <H H
F5*006 F=K@@ <J H HK I=HM = H< @M M H< HH. A XK@@ = <K / HK @H H<H H@ H< YK HX HK HIH HK (I< H $A&) -HIH HK (I< H< HH).
58 PALO ALTO NETWORKS®
% L; L@ 1988, D==H@ EI=H CH= (DEC) I=@H H< XH H X@H= XK@@ (@ K H- XK@@). V < XH-H= XK@@ =H ==J=I@ H H H= K<H< H= HX <I@ @@K HK H< HIH IHIH HK H @. <= H=H= = M H<= =H= H= K=H<= < HPI< I H=H= , H@ (C, D, C) H IPK=H< = I@ H< XK@@ H<H =H K<H< H< H <I@ @@K, @, . V A H X@H= XK@@ HM=@@M H H H< XH H< @M H< '+ @ (
' ;@=<; L@ +-H= XK@@ K =I=H-@J@ HKM. A HHI@ =H= XK@@ = H< H =@HH= =I=H-@J@ HKM. +HHI@ H =H= K =JH = H< @M 1990S M < H H C<=H +HK.
CYBERSECURITY SURVIVAL GUIDE59
+HHI@ H =H= < H< @@K= <H=H=: V A HHI@ =H= XK@@ =H= HH =H= IH H< =H I=H= = H<H <J H@=< HK <H H< HIH IHIH HK. V ' =HH H= = H@=< HK HK <H, H< XK@@ H HI@ H< = H<H @@K HX H YK HK H< HK <H K=H<IH IH< =H=. V <= HM XK@@ = JM H, IH = <=<@M H H< HIHKH<= H< HK <H I ==J=I@ H SH =H H H< H= = H@=<.
P5;< 6*59*56 A@=H=-@M HKM, H @M = H< LM J, H H< H<=-H= HK XK@@. V LM J H =H =H I=H= HK <H. H, IH H H< ==H= <H H H< LM J, K<=< @MN H< HH H< H H , = =HH, M H< ==@ H H H H< H=H= <H. V LM J = JM I I H<M @=H=-@J@ ($M 7) =H= H< H H, I H =@H H I IH<H=H=, H< =H@ HK IHIH HK. KJ, LM J <J H=J =H J@@ H< HK.
60 PALO ALTO NETWORKS®
I;@<; D<; ; %;<; '@@ <=@ H=H=@ XK@@ L= $M 3 < =H=, =HI= HH= MH (D+) =HI= JH= MH (+) J= @-H= =H= HK HX =HI H< H -H =H= @M= HK H=J=HM H.
<; ID' ; I%' =H=@ D+ + = ==@ H H=-J=I HK = H<H =H HHH H H< K-, @==I, HH I K=H<= H. A D+/+ = HM=@@M @M H HH @ L@=H HK JI@=@=H= HH HK. < =M = HK D+ + = H<H D+ = = =J MH, K< + = H=J MH. A =J D+ =H @MN HK H=J=HM @H H< I=HM ==HH H HH=@ HH JI@=@=H= H< HK, IH =H SH HM=@@M M JH=J H= H H HH. A +, H< H< <, @@ H< IH= D+ IH @ IHH=@@M @ IH HH H< HK = @-H=. KJ, + < =JH H<H =@I: V IH @ =@= @ HK IM = H
C066(76 + IDS ) IPS D+ + @ @=X K@- ( =HI) <J=- ( HH=H=@ @M-) MH. V A K@- MH I H K JI@=@=H= HH X@ H =H=M =HI= HHH. < HM MH <J @K @-@ H H< <J=- MH, IH IH H=II@M IH K=H< K HH =HI H H=J. V A <J=- MH I @= @ HK H=J=HM H =H=M III@ HH @J@ HK H=J=HM H<H M ==H=J =HI= HHH. < HM MH H=J H< K@- MH M H< H=J = HH= J=I@M IK JI@=@=H= HH, IH H<M <J I< <=< @ =H=J H H< K@- MH.
+ C<;; F@, F@, ; + %<@ HH X@H, *$ X@H, K L= HHH H H=H H< HH H=J=HM I H HK. < I=HM @IH= HHH H @=M K =H H= H<H =H< @@K @ J=I I I H< HK. F L@, H< H= * HH M <J H =@ = =H I< F $= @=H=H @= H= I=H= H=J=H=, K<=@ H< I @.
62 PALO ALTO NETWORKS®
#*'67 * C7*5 *6 EL@ K=H H= =@I: V G@= @= = V = V H = J=@ V <= V +=@ = V - -=@
I= < ' '@ =H= H @K= IH=J=HM, H< =H M = HH @K H<H I M IK=HH=@M @@ J=H= H, J= =J-M-K@. CH= =H M @ H @==@=H= = H< LI@ <H =@ ===H= I=H = H<H =@ H HH H< @M = L H <= <H- K=H.
H< $;<;@ E=< ' '@ '=NH= M @H H =@H H< @IH= = J=HM H =H< @ HH, K I = H=H =H, @= @@ H=J=HM. < =JH @= HH = H<H @ =H=J I= H< I H HH I=HM ==HH H @@K H K=H H<H <J =@M @=X @, H @=H=H I= I. *$ X@H= K ==@ H H H<H H=-J=I =HI LH H<H H< I= I @H (*$) K = H< =H H K=H. < H H= 5F9 HMD=75@@M A5=BH5=B98 6M H<9 =B8=J=8I5@ G97IF=HM J9B8CFG H<5H DFCJ=89 H<9G9 HMD9G C: G97IF=HM GC@IH=CBG.
CYBERSECURITY SURVIVAL GUIDE63
"5780 P597* N*756 =HI@ =JH HK (&) HK = H =H@@ =@ =H, I< @H IH, H@H, H<, H LH H HK M H< IH H< = H<M K
K*< 7*56
I;; <<< ' (I@) @ @ <;<;@ =<<< ;@ ; ;=@ I =@ ; <;<; @@@<;. ' '<@ ('') @ ; @ ;=<; =<<< @ < @ <;<; @@@<;@. '' @ ; @=@ ;@=< ' ('), < '' @ @ < <<; @ ;<<.
64 PALO ALTO NETWORKS®
IP6*( "PN A & I= H=@ & @=H HK H =H@@ H< =H J=. A I K M = I= XIH=. C@=H-H-J & HM=@@M I= I H= H ==H=H H< H=, I< @I<= H< @=H HK @= = I= I K. A & XI H @@ H< IS HH HX H<I< H< H XK@@, J== H=@ HH= H<I< H=- H@ == H H< H= HH, IH K=H< @. A@HH=J@M, @=H HI@= XI H @@K HH HX H< J= H =H@M H H< HH, K<=@ H< =X HM H= HX IH H<I< H< HI@, H@ HH= K=H< I< @ H=. @=H-HI@= , @ XK@@ (=I = H< J=I H=) <I@ XI H=J, H<= XIH= H R=-S =H H= HK. #E: A @ ; @@; @@ < ;;, < ; ;, ; ;< ;=@ ;< < @ ;;.
SSL "PN A ++$ & @M H- RH@S K H=.
CYBERSECURITY SURVIVAL GUIDE65
A H@ ++$ & @M I= I H @I< K K, & H@ K I= H< + H@, @ =H H< H HK K=H< H<= I H=@. A =@J@ @=H = I K=H<= H< K =, K<=< =H @M @ H< H= = H=J, J =H@ K< H< H= = @. <= HM & H=I@@M II@ H I H<H H= J= H<M H K H@, I< <H@ =, K< I@@ @=H & HK H =H@@. NOTE: '' *# ;<< @ < 3< @; ; =3 < <3 <;;; ;/@ ;@ < ;=@ <, I@ *# ;;@ @ < <; 7< <3 @-<-@, < ;-<-; *# <;;<;@, @ @
<;;; ; ; ; <3O ;< < >@ <<; ;<.
D7 L66 P5*9 *7 &HK DH $ JH= (D$) $ @IH= =H H H<H = @J= = HK, L@ J= -=@, X@ H, HH I@, M= H +B H
66 PALO ALTO NETWORKS®
V F==@ H I< IH I =H I V H@@HI@ HM H< XH=@ =HM M =H= A D$ I=HM @IH= JH =H=J H = H=HH IH= H< HK M I, =H< =JHH@M @==I@M. A IH D$ @IH= HH H< H= H HH J = H< H = MH. KJ, H< @IH= =HI HH=@ K JI@=@=HM = H< HK H<M <J J===@=HM =HP H< =@=HM H MHP@@ H H< HK. 'H< H< @M MH= <= @K<, I< +I=HM @= H< -=-H<-=@ MH= =. 'H H= D$ @IH= I= M J= H H H=J@M IH HX H =H= =, K<=< H H< @L=HM HI@<H= HK =I.
!*) 5*7 M**7 =X <H H () J= @@-=@I=J I=HM @IH=. <M = H< I=HM IH=@=HM : V (HHI@ =H=) XK@@ V D+, H=-J=I V H=- V &, HH X@H= V D$ =H =@ @=
CYBERSECURITY SURVIVAL GUIDE67
J= H =@M M H< I=HM IH= HH H< H<= H@ IHH: V @ H< =< HI H H H< @. V += @@ IH= = I@@ H< H M I, @= @@ H< IH= I@H = I H 97 H = H<I<IH/ H H- H<I<IH K=H<IH I=HM HI @. V D=H H< IH= @@ == H< @H, H< ==J=I@ = H = =@ K=H< @=HH@ =HH= H= HK H<. F @@ H<= <H=, J= J I = H< @@H-=I H= J=H =L=J @IH= =J= =NH= @@-=- I=HM J=.
N*;7-G**57 N*75 S*(857< < LH-H= XK@@ = K@@ X M GH H<= K H=-I T;<=<; 3-@ ;@=<; < @==<
;@<; =;<;, ==<;- ;@=<; ; ; =< <;<.U H HK I=HM J K = @J@ @=H= K H@ M =H< = @=H= =HI H H<= + =, = MI - @= @=H= H@ I@. =H< , H< H= T@H-U HI H H XK@@, @=HH@ H <@ MI I H< IH@ H XK@@ = = H LIH.
68 PALO ALTO NETWORKS®
K H=J@M I= H = <J=@M H I H< @=H= =H @M I H< HH H<H H< @=H= H<@J M. @M @@K= , H< @= H<, M =<==H H< I=. EJ@IH= &LH-GH= F=K@@ < J@IH= LH-H= XK@@, = H< @@K=: V =@@ H< LH-H= XK@@ = J===@=HM IH= H< @=H= HX MI HK? V =@@ ==HH I= H X LH@M K<=< @=H= H< LH-H= XK@@ <I@ @ , K=@@ H< LH-H= XK@@ J= H< ==HH K=H< J===@=HM J @@ @=H= H<H YK= M I@H? V =@@ H< HX H@ @=M H= H< >IH @@K M? V =@@ MI HK HH H<H MHHQH< K IK? V C MI MHH=@@M =H=M IK HX? V C MI =@H H< = I=HM @== K=H<IH == ? V =@@ H< ==HH=J H MI H JH H XK@@ H I? V =@@ MI > = = = H=J? V C H< @== MI @ <@ H=IH H H< I= HH @=?
CYBERSECURITY SURVIVAL GUIDE69
C5( 7*567(6 + N*;7 -G**5 7 F5*006 &LH-H= HK I=HM = X M J@ <H=H= =@I=: V A HI @= H H@ @@K/@ ==, @ M @@K/@ @=H=, I, HH. V A HI@M =HH H I=HM H@, =@ @H, K< ==J=I@ I=HM IH= IH H<= IH= < H<H =H@@= IHH=@@M, = ==H@M I@ KM. V A I=I <K <=HHI K<=< IH @K @HM, I@H=IH= = H<I< A+C- (@=H= =X =HH =I=H), =@- @@@ = <=HHI. V FI@@-H @M= H IH, = H< = H=, @@K= X=H IIH = L=I J===@=HM.
3 F '<; C F=K@@ @H= =H= K=@@ HM=@@M @@ =H H< : V ' F;<;@: < I=HM IH=@ @H H H< XM H< I=HM H@, H< =@=HM H H< = =H K=H< H< @=H= HJ= H< HK. V $=<;@: F H= H=J, H< = IH = =, TK< @=H= @=M @=J, <K < @L = =H H ?U V %<;: < = = =@: C H< XK@@ K<H =H = I H H H< I= H<I<IH H< =NH= I=?
70 PALO ALTO NETWORKS®
10 ;@ -G;<; F "@ D< <=@ < =NH= K=@@ <J J= I=H ==H= K=H<= H< H< @H= =H=, H< H H<= LH-H= XK@@ ( M XK@@ H<H HH) IH :
I)*7+< & C750 A0(76 P576 A@=H= J@ @ < H H H/H@/ @=H= J@H H<@=. @=H= @ H= -H H < H (.., =HH = @=H=, -H- X@ <=, ). A=H=@@M, I ==@M JJM I< H @=H= H I J H H (.., *D, ++). H @=H= =X XK@@ @== K< H ==@M =@JH, XK@@ IH I H<H M @=H= I M H. < H M @=H= M H = H< IH@ < = H< @=H= @ H<H = =J= H< =H= H- XK@@ H LH-H= XK@@. AM @=H= M H @ I K
CYBERSECURITY SURVIVAL GUIDE71
I)*7+< ) C75 0 C5(8 9*7 56 A 0*a +*#/ $ a'!a'+0 + +#/ *a6 # 0#"
/0#6 #a"# #/6 0#!/'6 '!'#0 &a a/# '+ a!# /#! a+ /%a+'7a'+0 "'%'a a00#0. K @ @=H= @@ =H H< I=HM J= H@QH< H<H L@M = H J I=HM (.., LH@ L=, -& @H MH HI@) H< H<H H H =@M <=J H< @ (.., H J/H H H@): V ELH@ L= -& @H MH HI@ @=H= =X@@M I H =IJH =-@ I=HM H@ I= J= H<=I. < @=H= <J I= J@I H<M = H J I=HM, =HI= I I= I=HM =. V *H J/H H H@, I< *D =K, HM=@@M I M IH =@ H K X=H@M. <M @ IH@M I M @M H M H< XK@@, H@=<= H= H H<= < H< IH IH= H< HK. @, H @@ H< @=H= M H< =QH @=H= <J @=H=H I, M MH HI@ @=H=. KJ, H< H@ ==@M = H M HH H = =HH HH. =H<IH H< =@=HM H H@ H< I=HM J= H@, =NH= H H<= I=HM @==, L= H<@J H H< JM = H<M H<I
72 PALO ALTO NETWORKS®
!)*567) C5(89*7 A0(76 T/# a/# "'$$#/#+ 6#0 $ !'/!*#+'+ a'!a'+09#a!& 0'+% 0'%&6
"'$$#/#+ #!&+'#0. < H< I@= =JH LH@ L= ( LM. @ H I@= L=) H<H I H< +. V =JH L= H H I I@=X (.., < IH) K=H< @=H= @= LM CGLM. V *H @=H= @= *D, =K GMC <J @=H=H I, IH I H H< =H =, <I@ @@M. V H H< =IJH (.., @HI, , <=) <J @=H=H I= I . *@ MI =NH=S I=HM @=M H, MI XK@@ H <J =X H<=I H =H=M H@ @@ H< @=H=, @ H, H@, MH=, H< J=J HH=. ' =H=: @=H= H<H @ =IJH= I@@M IH H H< < H HH H@, =H = =HH H IH H @M H<H MI XK@@ =H=M H< =IJH= @=H=, IH, =H = @ =HH H K <K H H<H XK@@S @=H= =H@@= = IH =H=.
D*(5<7 O87'8) SSL ) C750 SSH Ma+6 a'!a'+0 0# SSL '+ 0*# a6, 0&a#, / $/* + "a60
!//a# +#/0. G=J H< == H= + M <=<-=, <=<-K
CYBERSECURITY SURVIVAL GUIDE73
@=H= H<H -I @M (.., G=@, F), IS =@=HM H ++$ M K=H, H< = @ K= @= H = XK@@ H<H SH <J H< =@=HM H MH, @=M, H@, ++$-MH HX. A LH-H= XK@@ IH YL=@ I< H<H H= HM ++$-MH HX @H @ (.., K HX X=@ J= <@H< =NH=) K<=@ H< HM (.., ++$ H H, + I@=X K=H = EH EI) MH J= @=M. ++ = I @M I=J@@M =@M XI M -I -K I = H< H<H H H H@ = I. < H H<H ++ = MH @ =H II@ H@ H <= -K @H H=J=HM. < =@=HM H MH ++$ = IH=@ @HQH >IH I =HS ==@M ==XH H H= HX, IH @ I =H @ K H< M HI H<H KI@ I =@H =H=J K=H<IH H< =@=HM H MH ++$. M @H H @ =@I =H= MH= ++$ M H, =I IHI; @=M H@ J MH=, H< M <K HK @H H ++$ MH= H H<I
=I@HI
++$
H=
K=H<
=H@
. A=H=@ I=H H = H< =@=HM H =H=M H@ H< I ++. +=X@@M, ++ H@ <I@ =@I H< =@=HM H H= = =H = = I H K= (@@, H, 11) H=J I (+C, +F <@@ ). K@ <K ++ = = I H< H@H =H =H I=HM @==.
74 PALO ALTO NETWORKS®
P59) * A0(7 F8 (7 C750 A@=H= @H J@ I<
G@,
F,
+@. =H J= I K=H< =< H HI IH= H<H <@ H I I @M@HM IH M H JM =H = X@. F L@, @@K= L = J@I@ I= H@, IH I= L DH +<= H H J @MS H LH@ I M =H@ I@HM @= J=@H=. AH< L@ M G@ =@ (G=@) G@ @ (GH@). ' I = = =H G=@, K<=< M @@K M @=M, H<M =@M K=H< HLH H GH@, K<=< M H @@K. A XK@@ IH @ H =N @=H ==J=I@ HI IH= H<H =H @=M =@H. A LH-H= XK@@ IH H=I@@M @=M < @=H=, =H= < H<H M ==H =H IH= = K = I. < H T U HX @=XH= = H H= =H = H< H H<H H< @M I @=H= < = IH I@H=@ IH=. =H IH= HI = =HI = H< =, H< XK@@ IH H =H K=H<= H< HH H@ @=M <. CH=I@ HH H= H IH H< =H IH= H<H < @=H= M IH, H< =H =H =, = =H=@ I=H.
CYBERSECURITY SURVIVAL GUIDE75
S<67*7 (00< M* ! 5+( K HX L=H JM HK H ==XH =. < J@ =HH @H H = K=H< IK HXQ= =H H=N, MI ===N =H H<I< @=M H@, MI XK@@ =@M <H=N IH @=H= H<M TKU K=H<= MI I=HM @=M, MI XK@@ <@ MI H= = H< IK HX = H<H?
! 75+( 6 06 6750< 7*) 7 75*76 7* *75 AHH H H =M H@ = H L@=H HH @=H=. F L@, H HH KJ, HH M H =M H< < I< H<H H< I@H= HX = @ =H=X K HX. +I< @M @M ==H= HH. +==@@M, @K K=@@ H I IH=N H@ H H<= H@ @, @= I=HM H H H IH M IK @K =H=. BM I@H, XK@@ IH @=M @@ HX @@ HQH<= = K< H< @= <=HHI I=HM H@ @ =I= JM =HH. =H=J (I@H M) @ @=M JMH<=, H=J (I@H @@K) @ @=M @M K<H H<MS H@ H @=M. C@=M= JMH<= = @M @@ H H< <@@ H<H IK HX =HI. A XK@@ IH =J MI H< =@=HM H @@ IK HX, @@ H, = H @H= I=@M @MN H< HX H H= = =H = H< @@K=:
76 PALO ALTO NETWORKS®
V =H@ IH @=H= V =@ @=H= K=H<IH =HI V H<H. A=H=@@M, XK@@ IH J= H< M H@ H H @M H< IK HX, IH H MHH=@@M =H M H@@= =H J= @=M, H= IH =HI, I=HH= =@ @=H= H HI (CA) IH< @M=, = = =JH=H= H H= = =H H<H.
S( +5 "586*6/M05* A6 P576 EH= H=I H H K= @=H= H @ H< I=QH<M M <H =H@@M, IH=
CYBERSECURITY SURVIVAL GUIDE77
H @==I J ( H@), H< H< HH < I@@ H I M H H@ =H= < <. H @H = @@K= @=H= = =H H<H. < @=H= I=H J =H= H@ (.., +<=H I CF+, +, I= <=H=H XK@@ @=M H< T@ H< @=H=.U) < XH H = H =H=M H< @=H= (@ H MH=), H= H< IH= MI M KH H @@K M, H< H< @@K H M H< =H H<HQL@=H, J=I/@K, MKP J XH=@, I@H, =H=J =H=.
E'0* 7* 6* 0(7 96'07< ) (750 ==@M @H IH= H< I K@@ H< H=, H H= = H< H HK H< H@H. ' H< = K=, H<= = K ==XH H= H< K = @ K= H@M. <H< K= <, <, IH =H, I LH H H H H<= @=H= J= =-F=, K=@ , M M M. *@ K< H< I =, J K< H< @=H= H<MS @M= =
78 PALO ALTO NETWORKS®
I XK@@ IH <J =HH J===@=HM H@ J HX @ K< H< I =. <= = H H M H<H H< =NH= K=@@ <J H< LH @=M H<; L@, =NH= =
M* *75 6*(857< 60*5 M H= HI@ K=H< =H= =H= , @==, H =H J@ I=HM @. H< K, = H H K<H H<MSJ @M H, = J=, = =H @ K=H< =H @== =H= SH <@ I H< ==HH=J H, =H <@ I ==H H=. < =H=IH H< @=M = (.., H- XK@@ @@K H 80 HX, + @ /@ H<H @=H=, I K HKM *$ X@H=), H< < =H = H H<H @=M. V <=< @=M H< I=HM H I H @ EL? V K H<M H= @J @=M Y=H H< =H J=?
CYBERSECURITY SURVIVAL GUIDE79
G=J H<H HM=@ H- XK@@ =H@@H= <J I@ H<H =@I H<I I@, = H<I @=H= =HI H H<I H = @L=HM M J@ =HI.
D*09*5 7* 6* 75887 ) *5+5(* M =NH= HI@ K=H< H< = HK I=HM. A@@ H H, HI= I I=HM HI XK@@ H= ==XH@M @K H<I<IH . LH-H= XK@@ = I=@H H< =
80 PALO ALTO NETWORKS®
S857 7 * 6* +8(707< < L@=J KH< J=HI@=NH= @I IH= =HI K I=HM <@@ H<H =XI@H ==@ @M XK@@ H H=J@M I H ==HH IH=@=HM, =H H, @ =HH= =H K=H< H< J=HI@=NH= J=H. H HH HX YK= = IH H< H H K@@ K=H<= J=HI@=N J=H, XK@@ IH IH H< LH IH=@=HM = H< <K J=HI@=N H. < M= HI H K @=H= K=H<= J=HI@=N HH LH H< <@@ =H=M= H@@= @=H= I= H- -H= <. =H= H @=J= H< HI = J = H< <K J=HI@=N H, =H = =H=J H<H XK@@ J= =-H< =HH= K=H< H< J=HI@=NH= J=H H H@= H< H= @=H=-H= @== K J=HI@ <= @=H= H@=< H K. <= = H< @M KM H I MI IH J@J= H H <=HHI K=H< H=@ YL==@=HM K<=@ = = @= I=H.
CYBERSECURITY SURVIVAL GUIDE81
S85< V E=H I=HM H HH= <= K<=< = MH J=. EL@: H=-J=I HK, H=-MK HK, H XK@@, <H =HI= JH=. V +=HI HH= JH= X@ K=H< K H. &LH-H= EL@=H JH= HIH H< K<=< @@K HH H I. V &HK I=HM H HH= <= K<=< = R H< K=S. EL@: XK@@, K I=HM HKM, H=- HKM, HK =HI= JH= MH. V =HI@ =JH &HK & = H< J== MH HI@ HK MH K<=< I H = H=H = =H@@==@ = =HH. V =X <H H J= = I@H=@ HK I=HM IH= =@ @H. V &LH-H= HK I=HM =@= K H< = HK HX JH= H<H K<=< HI@M =HH, J== J===@=HM H HK H=J=HM, H
82 PALO ALTO NETWORKS®
D6(866 1. < @@ +HH "I@ I@=< IH M 4, 2014 M B= DM, +. H= +I=HM H +MH: TAH=J=I = U.
CYBERSECURITY SURVIVAL GUIDE83
K0*)* C*( M H< @@K= K@ <: 1. < F@: A -M HH = H<H @H @ H< M. 2. & JH =JH I= + =H <=. 3. K L@ LH-H= =H I=HM A@ =H= <=H@=H= EL@=H JH=. K H<= H< =? 4. & H< H=H=@ HK I=HM IHI. 5. <=< H< @@K= = H X= <H=H= LH-H= HK I=HM?
A) HH I=HM H@. B) $K @HM H = K=H< ==@ H<I<IH @. C) A< H H=H H--H@ H @@K/@ ==.
D) B=-=H=@ I@@-H @M= H. 6. & H< @M I @=H= K<=< <J H< =@=HM =IJH= I=HM @=M. 7. < F@: +I +H $M (++$) HH HK HH. 8. < F@: A< H I @== @KM I= @= @=H= H= H @@. 9. <H = H< = HK =H=J H @ H=J H @? 10. & H< HH =@ <@@ H I= J=HI@=N H H J=H.
84 PALO ALTO NETWORKS®
3. C<'*56*(857< B*67 P5(7(*6 & P5(0*6 E; = @ ' D @ ; E ; @
AH = L H H< J=I H<H I=HM < H<H I@ =H MI =@M @= = H< J=I <H, =H KI@ = H IH ==@ I=HM @IH=. = H< H H= H = H<= H=, MI = =@H I HK =NH= I= H< H H= ==@ IH = H<= <H. B IH= M @L >H , H H< H H= = IH H= I=HM =. ' H< H =HI@ HH= = N-HIH HK=. <= = L@= = H<= H= K< K IH =H K=H< =H- I=HM < @H K=H< = @= H=.
CYBERSECURITY SURVIVAL GUIDE85
< @-B@ A==< $ + T Z#/ /0 0#!/'6 *"# '0 /#$#//#" *"# $/ 0#!/'6 '+ "a60 &/#a-/'""#" #+'/+*#+. A= H H< 2014 CMH<H D *H, H< 60 H =NH= @@ J=H= H II@ MHH = 2013. G=J H< LHH H K<=< HMS =NH= H=I H @M =H-H= HH=, H<= = I=. < =@I I@H= <=HHI = I H @M H IHH IH= H<H JMH<= H< == =NH=S HK HIH, IH @ H< ==@=HM @M IHI H J= IH J===@=HM, H@, HH= @=H= HX H< HK. < =H- < H I=HM H<H K @@K@ MHM @ H=J.
%-B@ A==< $ + P#/'*##/-a0#" /0 /#'#0 + a00*'+ &a ##/6&'+% + '+#/+a +#/ !a+ # /0#". < =M =I K=H< =H-H= I=HM HHMPK< IHI @M H <I@ K@@-X =/ =H H H< HKP= H<H =H @= H< IH= H<H JMH<= H< =H@ HK HIH. KJ, H<= IH= = @ H =J I= =H= IH= J=H K<:
86 PALO ALTO NETWORKS®
V *H @M, =@ I, @I IH= @IH= @I H< =H=H= HK T=H@U TLH@U V K=@ H<@=, H< @=H= H H=, H< H IH IH I =HI IH@ =H=@ HIH @, M H JM @ I=HM H<H
F085*6 P*5*7*5-B6*) A5( =H- < HH= =@ H IH : V < HH=@ <=H=H M H<H H HH =H Q= K<=< H<M KI@ H< <J H< =H@ HK V = K< @==I I @ H = H H< =H@ HK =H=J I M I= H< H@ H=@ HIH I V H< @=HM H<H =H@ HK @M <I IH =H =@I H I I K=H< =<H@M =H @J@ HIH/=H=J=HM K<=< <I@ =@@M H = M JH (.., < J@H X=@ MH JI =H/X@ J)
I;> C=@ < %-B@ A==< HS =HH H @=N H<H HIH @ = H H< @M =I =@ H< ===<= H=J =H-H=
CYBERSECURITY SURVIVAL GUIDE87
< H HK I=HM. AH< H=IH= H = H<H @M J= H<@= @M I H I=@ HK =H @H H I< IKH HX H<I<. M=@ <H= = H<= =@I H< ==@=HM H: V DX=H=J@M =H=I=< @=H= (K<=< @ H J@M ==J H@ HH=) V IH@M IH MH @=H= HX V IH@M =H=M H@ I (@ K< H<MS @H K<H J= H<MS I=) V X@H @@K HX H @M K @=H=- H<H, IH @ IK < H I@H = H<H @M -<=HH= S = KM H<H @=J J=J =H@ HIH I= K=@@ H IX=H. C IH H H @ I H<H H< J= H<@= I H =@H H< I= HI@@M J= H< J===@=HM, H@, H<H =H= =@=H= H I@M @ H=@ I= @=H= K<=@ H=@@ H
%*5 5867 S*(857< M)*0>* N* #< F=H =HI M FH *<, IH = @HH=J I=HM @ H<H H< <H= =@= =HH= HH= M J= H< IH= HIH H< IH=. =H< IH, H=@ I=HM =@=H= @M = KM H<H J= @=M H HH= @@ I, J=,
88 PALO ALTO NETWORKS®
@=H=, H I, H< I=H= HX HK H<, @ @H=. BXH =@H= IH HK =@I: V C@@M =J H=J = =H=H= H @ J= J===@=HM @H @=H=, HH= JH= J H<H; V H X=M <=J= @= K=H< I=HM =JM H; V = =@=HM H I@M @ HH=J ==H=H=JQI< I =@=HM =HIHI J=HI@=NH=
E ' < "<; <@< @ A == @HH=J @ I=HM, IH = =H H M H< X== K=H< =H-H= HH= H< @M J= H<@= I H =@H H<. H H<= M H= TJ HIH, @KM J=MU =H I== ==@. <= = IHH=@@M JH=@ I=HM @ K<=< H H< = THIH IH J=M.U H=I@, K=H< IH H< = I@H HIH M H=HMQ=@I= I, J=, @=H=, HQ@ K<H =H = =H @H= @H=J H H< H HK. =H=, J=M= H<H IH<=N H=H= @KM = @M K<H H<MS @@K H = @ H=@; =HS K HM. < =@=H= H< HK < , H=J@M:
CYBERSECURITY SURVIVAL GUIDE89
1. < H H@=< HIH I= H<H H=J@M HH@=N =H H H< =H@ IH= J=H. < @ = = H J I=HM IH=@=HM @ H H< =H H I H<H I= HH=. <= KM =H @KM @ H< =H == =H I=H= HX. 2. < HIH I= H H< >IH ==H=@ IH<=NH= H@ H. T@KM J=MU @ I= = =H= =H= =H I=H= HX IJ=J H=J=H= (=.., H<H).
* P5*6* + %*5 5867 S*(857< < IH ==@ @=H = H< @@K= H= X H< H=@ >H=J IH =@HH=.
C<;= #1: E;@ @< @ @@ @ @@ < <<;. <= IH H @M H< I@H=@ HIH I= IH @ = I I I=H= H/ I, J K< = X H H< T=H@U HK. H @ I= H<H @M J= K=H< H< =
C<;= #2: A<= @ = @ ; @ ;< @@ <;<. < @ = H<= = H @IH@M ===N @@K H I H I H< H
C<;= #3: I;@= ; < L. <= =HH H< H T@KM J=MU K<=@ @ = =H @ H<H IH HH= I= H< >IH H=H H H@. C@ H=II HHH= IH @ = H LH@M K<H = <= = T@@KU @=H=, H< @M KM H H<= = H =H H< HH H<H. @ =N < 7@ @ 33?<; @ @ ; < @ <; @3 ;@=<; ;<< ;= <3 ;3<; @ =@ =< (.., <; @ ; < @==< @ @;@@ @ < < =@@). @@ @ @ @ @@O<; ;;@ <; ;@; I @@@, =<@, ; =<<<@;, 3<, ; @;@ @=O ==<;@ @ ;/ ; @ <- K==@.L+ @3 ;@=<; , 3< =, =; 3O @; H =<<< <; C =< 80 < < =@@ <3 ;< <; -< ==<;, =<; ;<@ < ==<;@ ; @ @ , @ @ <@ @ 3< , @< ;<;, ; <;@@ < ==<@@. ; @ @ @ @ , ; 3, =<< ;@ 3< =;; < @ @ <.
%*5 5867 C(*780 A5(7*(785* <@ IH K<H IH @ @= = H=, HI@ <=HHI = <K = F=I 3-1.
CYBERSECURITY SURVIVAL GUIDE91
F 3-1: < @J <;= .
< = H =@I H< IH +HH= @H, HIH N, =H H =HIHI.
%*5 5867 S**7 7 P07+5 * H HK HH= HKM M FH *<, H< IH +HH= @H = H< H I H X =H@ HIH I=. H< K, =H = K<H J= H< >=HM H< I=HM IH=@=HM H @=J H< IH H=@ >H=JQ=@I= H< =@=HM H:
92 PALO ALTO NETWORKS®
V @ I HK V I@@M H@ HX YK H/ I V H=II@M =H @@K = M H<H H=J=HM A@H<I< F=I 3-1 =H H< IH +HH= @H =@ H = =@
@=@=HM,
@==HH=Q
H=J
=@HH= = @=@M H H=@ I@H=@ =H =H=IH H<I<IH =NH=S HK. =H=, H< @IH= = =H T@HU H @M H YH H<H =H = H= I@H=@ =H=H ( HH=@@M =H=IH) I=HM H<@=, IH @ H<H H<M H H <@=H= H<H HH= K H I H< HH I @H =H= IH H<H H<H I.
5867 %*6 * H = =H (CA) M FH *<, HIH N = =H=H H =HIHI K< H< I H @M H H H< HIH @J@ IH @ < ==@ IH=@=HM. +<= IH=@=HM I< H@ HM HH= = =H=J I H<= = K<H = H HI@@M ===N H< I @@K H
CYBERSECURITY SURVIVAL GUIDE93
@=H= N I@H=-H= J=, N I@=-= K @=H=. H = =HH H H, H, H<H HIH N = H =H H TH HIHU K< MH ( H< H<H) K=H<= H< N @ H I=H @M/=H@M K=H< < H<. F I@@ N HIH =@HH=, H< HK KI@ XI H I H<H A$$ I=H= HXQ=@I= H<H HK J= = H< NQ= =H=H M H< = IH +HH= @H.
";; I;@ CH@=N H =@=H= I=@ H @= X=H ==HH= = =H=, H=I@@M =@HH= =J@J= I@H=@ =H=IH IH +HH= @H. =H=, H I==H= HK J= J=H KM H I@H H< H=J =H= @M= =@=H= IH +HH= @H. BM K= @@ = @ H H I==H= HK, H<= H H< M M I IH-- @M= H@ H<@= =H, L@, H IH< < HK J===@=HM, HH IK H<H, IH @= H=.
%*5 5867 7 N*;7 -G**5 7 F5*006 BI H< <H M IH HK I=HM <=HHI = H< IH +HH= @H, =H = =H=J H<H =NH= < H< =
94 PALO ALTO NETWORKS®
= K< = @H=. < , = M= = @ J= <K LH-H= I=HM @H H H< = I=H. < @@K= H< <=J I=HM IH=@=HM.
' A@@ C=HH I ++$ & H=J=HM = J= @@ @M, H, IH, IH K<J H<MS @H (.., H H/< X, H< @@ HK, J H< HH). @== H H= K<=< I J= =H=J @=H= H X @=H=, I, HH, J=, J= HH.
I;@=<; < L A@=H= =H=XH= IH@M =H=X @=X @@ HX, @ H H@, J=J HH= I< H <=, MH=. <= @==H H< H<H @K M I H <= HH= J= @H HLH =H @=H=, =H HH, H<H.
@ %@ A@@ C<;< < =H= @=H=-, I-, HH =H=XH= @=J =H=J H@ @ H<H @@K =NH= H H@ =HH= K=H< I LH=J I=-@JH HH=IH, =@I= H< =X @=H= ==J=I@ IH= = I, I I =H=HM, H< =X HM = H = (.., =H =@ I=HM I) C H H=H=@ XK@@ K<=< @H H I< HX H<I<
CYBERSECURITY SURVIVAL GUIDE95
I H<MS @==H H H H@ @J@ @=XH=, H< I@H = HI@M I@ H@ H<H @M @ H< =
A; %<<; A =H= H=-J=I/@K, =HI= JH=, J H<H JH= H<@= J= <=J HH= =H H< K IK H<H, =@I= H<H =@ J=. =H=, IH @-@, <=<@M =HH I H<H =@= H J= H< H = H< H<H HH= K IHH=@@M IH.
C9*5* +5 00 I )6 =HI@ <K @= @ HIH I= H =HH@M H-H=J@M H@=< H<I<IH =NH=S H= HK, =@I= = H/< X, =@ I, H H< HH =H, = H< @I, H H< = H H< HH, ==J=I@ @J K<J H<M =
H-=<; @; BM X=H=, IH +HH= @H H II I=HM HK= =@=H=. KJ, =H IH @ @ @=J= @@ H< HI K=H<IH = HH@. +J@ = @H <=<- IH +HH= @H <I@ =@I:
96 PALO ALTO NETWORKS®
V ';-=@@ @< . <= ===N @HM = I=H H< = HX H H I@H=@ H= (.., < I=HM IH=). V '= <;< ; =;@ ; ;<;-@=L, =
=<@@; ;;@ (.., @< =@). <= J= H =, @H= H I=HM IH=, =H HH =.
F, ;<;-@= =<; @@M, =H <I@ =@ H =@H IH < = KM H<H I= =XH= H H< L=H= HK = @H@M HH H MI I. 'HI=H= H H JH > HK J<I@ , =IH= H= = H <=.
CYBERSECURITY SURVIVAL GUIDE97
=@H IH J=HI@ =H
A P55*669* A5( +5 I0**7 %*5 5867 H J= K K=H< IH =, =H = =HH I=HM <=HH H @=N H<H =HS H M H =H=H K=H H< LH <=J J<I@ H<= =NH=S HK I=HM =HIHI. , H< H JH IH <=HHI = H<H =H = I=J H =J =@HH=. H HH, I=HM H XI IH +HH= @H = @=H-@M H H= H=@ =HI HH= YK H<I<IH H< HK, =@I= K<, K< H K<H LHH =X I I= =X @=H= H I. A K=H< H< H=@, H< I=HM H KI@ H< = L@@H =H= H =H@@M: V @M J= = =H @H= H H@=< =H@ HIH I= =H=X HIH N V XI H< =H H =H= @== H H=J@M IH < HIH IM T@=U
98 PALO ALTO NETWORKS®
A;@ AJH =J < I< H<= =@I ===N= H< HH=@ =H H= = @ H H< I= =JHH K H J H=. A A@HH=J A< F H< I=HM H H<H @M <J IH= H< HH= YK = H<= J=H, @HH < = H IH HIH N = H H@=< = HIH I= @H=J = / =H=J=HM H< H =J@J. A @=@ HH= =H = H<= = H = M =H=M= K@@-X H I MH =J@J= <=< HH= =H=J HQI< H< 4: V MH =IHM (C) H< X=@ H V @ <@H< =H= () V @@M =H=X@ =H= () V H@@HI@ HM () F H<, =H H< H = =J@M H@=<= HIH N/I= H< H H< IH= J=H H<= @H=J =P L@: V H MH/HK (K< ==HH H <@ H< J=@ TM H H< =U II@ HH I@ @ H = H< H= HK) V H I H= (B2B) V =<-X@, IH-= I H= (B2C)
CYBERSECURITY SURVIVAL GUIDE99
V B< X = =M IH= =, @@K M @@ H< < X V GIH HK (H< K=@ K=) V CI HK AH= IH ==@ H H > =H H H< HH @ . KJ, H<= K=@@ @M I= @= IH= H<, @M I=HM J= K=H< IH +HH= @H H H= @@ H< I==H =@=H=.
B**76 + A)7 %*5 5867 P5(0*6 ) P5(7(*6 < J@ H<=@ I= JH =H K=H< I= IH I=HM <=HHI. < =@I = @ H: V H@@M -=IH=J@M H< H=H= H IH @ V 'H= I@@@ =HIH=@ K H= IH= H=J=HM, @=H=H H<K= V FI@@M =@H @@ IH ==@ H, =@I= H=H H @H =J=@ H@ @=M (K<=< = H=@ H I= HH I) V DH=@@M < H< =NH=S I=HM HI =@=HM H JH H< LX@HH= =H=J H V +=@=M <=J= =H== @= K=H< @=@ H I@H= (M I= <=<@M H=J HIH I= H H =H=J I)
100 PALO ALTO NETWORKS®
V +I@M @ =@M H H H I=-=J ==H=H=JQI< I =@=HM, =@ HK=, =HIHI J=HI@=NH=, @I IH= V *I HH@ H K<= (M I= =@ @=H I=HM @H H< H= IH= J=H, =H =H @@H= =H =H IH) =H-H= I=HM HH= H=I H @M <@@. < =I = H @M ==@M <=H=H M H<H, IH @ > < H H< H<@M I= @QI< I =@=HM,
CYBERSECURITY SURVIVAL GUIDE101
N*;7 -G**5 7 N*75 S*(857< P5(0*6 H<= H= K =HI H< H H= H H@ HH @H @K. <= H<@M = = H I@H L=H= I=HM HH= H=, H =H < H -=-H<. < H<@M H<=I H @==H H< LI H HH, K@@ H< HH= =H= =H H<H M @M =H.
I;<=<; -G;<; F@ A @K J@J ==J=I@ =H H =H H HK, H= ==@@M H L H<= @MH=@ H=J H =H HK @J@ =H@@= H@. &HK I=HM @@K I H I H< JM H=H H<H =H=I=< HH @= @KP=H @= I=H= K=H< @ H HK. HK=H "< GS I <, TH< HK = H< IHU, = JM @ H< H<H < HK. I I=HM I SH H H H<= @J@, K I JM @ = == H< H H< H. A=H=@@M, HK I=HM <= J= =H @M =H= H@, I@= H< -=H H<@J, K<=< = M @K. BHH @K =@I H=H, K< I = H = H H< HH <= = H H IJH H=-J=I HH= H< I=HM <= H< <=. <= H TCH< 22U H< I=HM H = M I=HM HK I= = <H H HI@M HIH. <= H=@M <I@SH =@M H<H <H- I=HM = @H, IH H< =@M H =H IH H<H H< <H @M H=@M =H=@ @M = H<.
102 PALO ALTO NETWORKS®
< =H J I@ @M H HK I=HM = @. KJ, H< LH-H= XK@@ = H=I@ J= I@M H< H =HH =H= H H< X
C066(7 + 5+( A LH-H= XK@@ HI @=XH= HX H =@M =HI, IH = @=H= @M=, MH=, = <I=H= H =J@M @ H< @M HX H H H= =H HI =H=HM ( F=I 3-2). <= =@=HM H ==H @MN J IK HX K=H<IH H H MH= = X= <H=H= HI LH-H= XK@@, K <@@ H<= =@=HM = =J@I@ = H< X
CYBERSECURITY SURVIVAL GUIDE103
F 3-2: -;<; L@ @@ ; < L @; < ;L<; <@
I7*57 A=H=@@M, HI LH-H= XK@@ J= I@@M =HH < H H<H JH=. < =H=H= = H<= = H< HI =H= I@H=@ I=HM ==@= H =@M @H= H< H< L. F L@ H< @=H= =H=HM, @K HH=, =HI= JH=, *$ X@H=, X@ HM H@ =H= H< HH <I@ @@ =HH =H I=X HLH. <= =HH= J= =H@@=H X=H=J IH= HH H< M ==J=I@ H<@M J= M =H@. <= @@H=J =H@@= = = H IH H< H@@H@ = IK H<H.
<; ; E;<; ' H< H =HH H H<H H= H H H@ @K = H I H< JH =H= @==H H< =@=HM
104 PALO ALTO NETWORKS®
H< H H <=. M, H< >=HM H< HH JH I M HH J=HI@@M I<, HH HX = HM=@@M @@ I< H<H =H =@M @ =H H< I T@U HK HX. BM == I@@ J===@=HM H@ LH@M K<H HX = @@K =H H< HK K
R*)8(* 7* A77( S85+(* A =HH XH H H< H= = H HI H =H=J H@ @. =H=J H@ =@M =X@@M @@K= H< HX MI KH H @= JMH<= H<H MI SH. < H= =H=J H@ < @ H< X= <H=H= HK XK@@ H<H H H< H< HM HK I=HM. F L@, = MI KH H I @H, H< MI C H 23 H @@K @H K=H<IH =@M @@K= @@ H< HM HX. HIH@M, H=H=@ XK@@ <J =J@M @H H< =@=HM H =H=J H@ = M @=@ KM, @=H= <J @ H I -H H @M H (C H 80, 443, 53), =@M < HK H.
E;< %<@ C<;< E= =H=J H@ = H=@ = H< X
CYBERSECURITY SURVIVAL GUIDE105
J=HM =H= H= <J K ==J=I@ H J@ KI@ @=H= J=, H K<=< = H H I K=H< H< @=H= =H. = HH K, JM K H< @=H= H<H K=HH =@M = <J M @ J@I H H=. BM =H= =H=J H@ @, I=HM H I @= H< J @=H=, H HH@M HM= H HM I H K=H< @@ H< @=H= H<H H<M KH H @. <= < ==H@M @I @ I @=H= J HI<= H< HK, K<=@ H=@@M I= H< I JH H<H HH I H H = IH H< HK.
C<;@ ; C<; KJ, = =H=J H@ = H M =@M Y== K=H<. + @=H= M I M H <J I= J@I H<H = H =@M H. A I<, I=HM H <I@ @ H I@H K=H< J=HM I K=H<= H< =NH= = H H@=< =H H J @=H= I @.
P0 R***76 A=H=@@M, @=H=, I< F, K=@@ <J H< I= @ I. H< , I=HM @== <I@ IH< X H @@K @M H= I H @=H= @==H H< I @=H= H H= J HI ( F=I 3-3). *I H< HH I M H=H= H= @=H= H =X I I I= .
106 PALO ALTO NETWORKS®
F 3-3: D;; A;@ A '@ ; B@;@@ E;<;;@
CYBERSECURITY SURVIVAL GUIDE107
E67'06 P0(*6 ) C7506 E@@ =<@ <3 ==< ==<;@ ; @@ @ <; <=; ;@ ; : M E@@ @; <3 @ <; ;<==<;@, =<<<@, @@, . M + ==<;@ ; @? M + ==<;@ > 3< @;@@ ; < ;@ < @ ? M + -@ < =@<; == <;@ <@ ;=@ ; < < ? E;3< =<@ <;< <3 3O M ; ;;@@ < @ 3O M @@ <3 =< @<; < ;=<; ;>@ =<
I9*677* !6 ' H< H= < = H< =@=HM H IH@M @=M H< J HX H< HK, K H< <J K<=< H =JH=H M == IK HX = H< HK.
; C< < <J= IK HX = =H=@ @I = H< =H=XH= HH, K<=< K=@@ H H TIKU HX I H H<= I =HM MH= I=I <J= ( F=I 3-4).
108 PALO ALTO NETWORKS®
F 3-4: I;@ ; ;;<; L
D** ) C00*(7 CIH D C HX, =@I= =X 2, X@ H, = @M I H@ = HH. < I H H = J=H HH= @K HH= J= I= =HI- H=-@K = @ I H K@ K M@. IH H< ==X IK HX =H HLH, = H < M @ A@H &HK, IK D HX HM=@@M IH @M 2 H HH@ HK K=H<, MH H=HIH 51 H @K @.
CYBERSECURITY SURVIVAL GUIDE109
I;@ K HX I@@M H M H< @=H <= <I@ =JH=H H H= = H< ==J=I@ = I= @=H=H @=H= H<H = H =N JI HH=@ HH =H=. @ =JH=H K< H< HX = =: V D =H < IH H K=H K H J @K H =@ HK= =H? V D =H H=H I@ <I@ @@K =N@ HH? V D HHH H K@ I@ X@ H IK *$?
D*7*(7 A@@ H< <J= =H=M H< @=H <= H<H = =H M H. BM =H=J@M =H=M= H< J HX H< HK, M TIKU HX <I@ ==@M , H
M @< ; @;<;, <@ <3 3O M C< ;@ , I' (;@<; =;<; @@), , ; O ;@3 <@ M DO; @< ==<; ID@ 3< ; ;; < @< ==<;@, @ ; M C< CA@ (= =@) 3< ; ;<;, = ==<;@ ; < @ @ ;<@ 3< ;@@ M I;@ K;;<;L 3O 3< =<; ;< @ < < =<; <; <
110 PALO ALTO NETWORKS®
C750 7* E'0 A0(76 A@=H= ==@ H H< HH @=M@. <M I=@ H H< ==H=@ =H= H H< = H@ H< HH. <= =H= @K @=H= = H<= K.
'< A==<;@ H< H, H< H @= @=H= @K K H -=@. F I=HM H=J, J=I -=@ =@M KH <=-<. KJ, J H<I< -=@ = H=@@ I M HH, =H < I@@M @H =H @IH HH -=@ @=H= K HM=@@M <J=@M I M H< H=, -=@ @MN H =@ H< K<=@ H< = H H H< -=@ J.
'< @@ BH-< <J K <=H I< H<= HHH= H H HH @=H= H<H =HH K=H< I = @-H= YL==@=HM H< H -=@.
'< <; A@@ @=H= H H I@, HH K <J J=HH H @=H= H<H IH H< HS I@H=H = H =@=HH =@ == K<=@ == <=. +=@ HK= @ I @=H= H H< H< =H=, <J H< H I @K =H= H< IIH H@ HH. <= =@I @=H= I< =@ HK= H<@J, K- -=@, =HH = () @=H=, 2 HK J=HM X@ H X@ <= @=H=.
CYBERSECURITY SURVIVAL GUIDE111
< @=H= IH@@M = H =@M < =H= = J=HM KM, I H = J@= HH=HI H H< @=H= I H<M M IH H I= H< IH= H< X. <= J= =H@@=H HH K=H< I@H=HI =H= H= H II J@.
S(0 E**5 +=@ @=H= @ H =@ J=H =@ ==, @= HH H =H = @@I = H @I IIH= J=H= =H @== I @=. F @@ =H <=H=H=, @K =H= H=I H @M H== IIH= I =H =@@-J= @=. H = -=@ HH<H, H< @= M @= = HKH @= F H<H H =. C-=H =H= I@H I @= = =X H<@=, I< F=+<, @@K < H H J =@ HK= IH. <= H= HK =@ HK= @K < J = H< @ K@. *< H< H= =H +<KJ FIH= < J= @@= J= H< @ =@ HK= @=H= = H< HH @=M@.
112 PALO ALTO NETWORKS®
I; 2010 == '<@ ; C<, <= ; =@@; ;@<; ;< ;< @; @< <;. I; ;@@, <= 3<; <-;3 ;@ , 3 , <; <; ; <;< @@. I;@, ; 3O 3< ;3 <@ < < < =<= <@, G<< G<=@, <;@, ; <
S*(85*0< E'0* < =@=HM H I@M @ @=H= = =H=@ I=H H=. +=@M @= @@ H @, K=@, =@ HK= @=H= KI@ H< =H=@ II@M H= H< H=S =@=HM H I=H HM H K=H< H< IH= K@. A XH H H I@M @= @=H= = H @==H H H< @=H= M I I I H<H <J J H< @=H=. F L@, H F =H I@M= @=H= @==H H @ H= H K< =@ =H== H< MS @= =H=HM, K<=@ H< @M H @@K , <J H=
CYBERSECURITY SURVIVAL GUIDE113
F L@, H< M I@ @@K H =@ HK= @=H= IH =@ H< H= IH=@=HM JH H< @=H= K@= X@ H< =M <J=, I< HI@= H< @=H= <= H< IS H. <= H ==XH@M @==H H< =@=HM @K M@ H H H =X HH. A =H K =@M I HH -I H IHH=@@M IK=HH=@M K@ @==I X@ K=H = H< I. <= = @M H =J-M K@, I J H@M J@= K H<H <J =. D=J-M K@ =H=@ =@ HK= HH K< @= M =H H =H H<H J= I L@=H K<=< H< I H K@ @K = H< I. E@= =J-MK@ HH= HI = LH-H= XK@@ HH =H H<= HM =H= M H= I H J=M H<H H<M @@M =H H K@ X@ H<H X@ H I@@ K K=H<IH H< IS K@.
A)7 SSL < @= H< HH @I IH= = @= H K= H= ++$ J=HM H<@= =IH=. +=@ HK= =H @ =JHH@M = =H = @K H = <= M J= H H< I@H I ++$ H HH I I=H=. <= = =JH =J H<H < J <=> IHH =.
114 PALO ALTO NETWORKS®
@ I< F=+< <J H<= =@ M H<H H< H= =JM H< HH. ' H< H< <, H H= @ H< =@=HM H M=@@M @ K=H<= ++$ MH I=H=, H
CYBERSECURITY SURVIVAL GUIDE115
M ; @ <3 ;<; KL ==<;@ ◦
2
◦
==<; @ < @@/<=@ < ;
M ; @ <3 ;<@ 3@ ◦
F ;@3
◦
D@<= @;
◦
;;; <3 < ==<;@
M ; --<;<@ ; @@ ; ;; --<;< =<<; 3@ ; ;-;<; O M ' = '' @ <; ==<; ; < ◦
◦
D= @< ;<;, , I;@; "@@ D< ;< = 3O 3< < O;; @@
M I;@= < @ ==<; 3O @;: ◦
I;@<; ; =;<;
◦
" =<<;
◦
O;
P5*9*7 7* !6* + C5(89*756 < J=I H= I H< -I 2.0 @=H= H<H -H M @K I =H H< H=. KJ, H< = @ @=H= H<H H=J@M = H H<I< H=H=@ HK I=HM. <=
116 PALO ALTO NETWORKS®
=@I J=HM H H H<@=, L=, II=@H =IJH= @=H=, K<=< K=@@ @ I= H=
%; $=;; < ;; *<@ + H< @=H= <J J@= H= I, K<=@ H< I = IJ I <J=. @@ H<M K=@@ I= H=
F 3-5: C;<@ @ '' , ;= %2%, ; ;;; ==<;@ < < <;
*H H H<@= <J K=@@M I@, H< K=H< I IH H. EJ H K-= @=H= <J H< =@=HM H =J H I H@ J IS <=. +I< H<@= =HI HK =. F=H, K< I H H <= H C, < = H I H M H=H= I M @=H= K=H<IH H<H HX = =H M H< XK@@. =H= H
CYBERSECURITY SURVIVAL GUIDE117
=IJH= @=M, H< H H I H<H JH M @@K= I H H@M IH @@ = =M <J= H< <J H< I@H HI@ H <= <= == H< H=.
P5*9*7 I7586 +@M, H H H<@= J= H< = IH= I == I@@ H <= == H< HIH H= HK. <= HM H H@ = H< I@H=H @ @K = H< XH @, I< =H J=I@M H I = H @I< =HI=. < @ H= @=H= K<=< <J J@= I K=H<= H< H= IH =@M H I=HH=@ LI = =I I M IIH<=N IH= I. F L@, M H= I ++ (+I +<@@) H MH @=H= = H HH. KJ, = ++ = I H HI@ =H H< HH, =H =H, I =H H< H=S H =H=@ H. < @=H= K=@@ H=
I=H= XK@@
H<
I=HM
=HIHI. LM H<@=, I< CGLM LM, J= @H=J@M M KM I H I MI@M K=H<IH H= H@ <J I = H< 75% H= HK.
118 PALO ALTO NETWORKS®
A@=H= I< @H+I, <=, I-I=@H H HJ I=HM =HIHI I@@M IH = H = IHH. < @=H= <J JM K, = M, J@= I K=H<= H< H=, H<= @@M ==H =HH=@ HHH H J= H= I=HM. < H@ H @M HX K=H<IH = =H, IH H<M @ H H I <=<= <J= I< X@ <= L@M @ HH =H, K<=< = HI M ==XH@M <=< = @K =H=. A I@H, H< @=H= <I@ @ = @H @@ .
M < @<= @ < I @==< <; M ' ; ''H <;, =;; ''H ;;; M B< @ <3 ; ==< =<@ M B< ;= ;;@ @ @ '3 ; H
P57*(7 R*7* !6*56
CYBERSECURITY SURVIVAL GUIDE119
== H< H=H=@
M E;3< 3 ;=@ O; ; =;<; @@ <3 @ <<; M E;3< --<;< =<<;@ M E;3< @< =<@ @ <; @ <<;< ;< < O@ < <;< 3< @ @@@ ; @ @ <
F) I+*(7*) H676 =H H< I=HM HS H H H JH=, H= <= K=@@ =J=H@M =H K=H< @K. <= I@ J= IK HM @K, IK JH, M
120 PALO ALTO NETWORKS®
H< HK. F @@ H<= M =I=HM, HH H I=H = H IH=, H<M @ H H<@J =XI@H H X H. < = I=H H HH H<H I H =H=M H HX <J= H<H H IH H< @ -I HX, J = H< H = @H@M IK = H< =IHM.
D<; < C<; ; C<;< L ' H< > JH LH-H= XK@@ = H< =@=HM H @=M HH=@@M @L H HX H H< @=H= @J@. <= =@I H< =@=HM H =J@M K=H<= HX H @ H@ I= K=H<= H@ IH=@ H< HI I@M= @=H= = =H=X. <= LH= = =H=M= @L HX = JM J@I@ K< =H=M= H< I=I H@ HX H=I@ HH.
; I%' < D B<;@ CIH + =HI @ H H =H=M HH=@@M @M<= @K =X H K=H<= H< @K. F L@, +MEM JM I@ K= = HH J H<H H< @K HH@M < =H =N, H< < =H =HI. KJ, +MEM ==@@M K@ MH XIH= X@ H IH H< H. *< H @ A@H &HK K @ H =H H<= XIH= X@ K @ H X I=I HH @@ XIH= X@, H<H @ + H =H=M H< H< H, J = H< @K =H@ = H =N. <= = >IH L@ K< + @K HH= =HH H X H<H.
CYBERSECURITY SURVIVAL GUIDE121
A877 + B7 C5(7*567(6 HIH@M, H H= SH <J H< H= I H IH I@ =JH=H= H < K = H<H. +I=HM =IHM J J= H= K=H< H< M H@ =H= H HH H MH HK. F L@, H< @ A@H &HK B<J=@ BHH *H IHH H< H= @H= H< <J= H<H ==H H< H. <= H @ J@ H <H=H= =@I=: V ;;<; C%/D%PBHH HX = I@@M MH IK. += LH-H= XK@@ =H=X @@ HX, H= IK C D HX H HH= =H X= H=H <=. < H @@K H H H IK HX M =, H=H= MH. V %@; < D; D'P@K K=@@ H I M= D&+ = H HH I=H= =XI@H H H. BM I= HX HK I@H=@ =H <H K=H< J-<= @=H , =H JM =XI@H H H H< H< H< H =H HI I H=H=. V A <; ;<; " '@P@ A@H &HK HH@M H =H H<H <J <H @K K<H< =HH=@@M I=HH=@@M. A LH-H= XK@@ K=H< *$ X@H= =@=HM H = I = H@M ( IK=HH=@M) J==H= H< =H HHH= H K@ X@. V *@; ; @ D<;@PBHH HH@M J= I = H J= HH= H J J
122 PALO ALTO NETWORKS®
=J =@. A I@H, HH K=@@ H <J H I K = H IH H< H@ =HIHI. A I H@M J==H= K@M =H = K=@@ H=@M H @I=J, IH M <@ H J= H= J= =H=. V B<@; < I% <;@ I;@ < @P ==@ J=, H K=@@ H I <- K = H I=H H I, K< HM=@@M I *$ H K HH K =H. A K=H< H= K@M =H =, H= H= I= = H= ==H H< H H K H
!6 DNS S0 7 )*7+< +*(7*) 676 D= & +J= (D&+) SH @KM IH@M =H=M =H <H I H< @@ D&+ J = H K=H< @J= H< D&+ IM. H< XK@@, H< @@ D&+ J = H< ==H H< IM. D&+ =<@= H@ H< =, M =HH= H< D&+
CYBERSECURITY SURVIVAL GUIDE123
IH = K=H< =H H<H =H H< = H =X J. H= = H< H< = I H<H < H HH HH H< HK @K. < HK D&+ =<@ <: = @;< < @;<. V I@= =<@= = I H @H @==I = H<H = I M @K, I< H@ J. <= H= I= I@=<= H< IH<=HH=J H< @==I = H =H H =<@ J H@@ M H< I=HM J. H= @@H H< I = =J H< IH D&+- =HI. <= = H= H T<M=U. V $@ =<@= = = H D&+ I= @==I = K=H< @@ =<@ . A LH-H= XK@@ =HH D&+ I= H D&+ IH K=H< D&+ ( F=I 3-6). < HI =H H =H@ =<@ J -IH@ . +IIH@M, @@ @@K= = K=@@ H H H< =<@ J -IH@ , K<=< =H M H =H=M H< =H <H = H< HX @ X@.
124 PALO ALTO NETWORKS®
F 3-6: < @;<; ; @ < ; ; <@@.
S*(85 "5780=*) D7 C*7*56 7 N*;7-G**57 F5*006 =HI@=NH= = <@= =NH= IH=@=N H<= H H <K =HIHI H=J@M, @= H IH= = H, =JH = H=@ X==. GH H=H H<H @H 50% @@ L86 J K@ J=HI@=N HM K=H< H<= I LH H K H 77% = 2015. M =NH= @ J@J= H<= J=HI@=NH= =HIHI H I=@ H<= K IHH, @J=, =JH @I J=H. A =NH= J@J H=H=@ H H H J=HI@=N @I IH= J=H, I=HM <=HHI IH IH H< <= H I=H. <= =@I H @M = IH@ H@ H IH=@=HM I< @=H= @H, H<H HH= YL=@ HK= =HH=, IH @ K <@@ I
CYBERSECURITY SURVIVAL GUIDE125
=@I <J= J===@=HM =H J=HI@ <= HX H<H M H @J H< J=HI@ =HIHI, H< =@=HM H H= I=HM @== H J=HI@ <= =HH=H= JH, <HH= I=HM @== = @ H K=H< @=H= KYK.
*<; ; C< C<=; E<<; MS =NH= ==@M H K=H< = K=H< @. H< <@@= = =H=, =NH= H @M K=H< <== IH IH = H =J H=@ X== =J =J I= . F M =NH=, H< H= H<@= @= J=HI@=NH= @I IH= J= M XH H=@ X== H = @=H= @=JM.
"5780=7 =HI@=NH= H<@M H=H= =@
126 PALO ALTO NETWORKS®
F 3-7: *<; @
F=I 3-7 <K H< <=HHI. +J J=HI@=NH= HM=@@M IH=@=N
#< S*59*5 "5780=7 ? H H H J=HI@=NH= ==H=H=J = K=H< H< @=H= H H I= @=H= =H, I-I=@H J =H H==N I H H K=H< @=H= H=N
J=HI@=N
J.
+J
J=HI@=NH=
=J
H=@ X== @K =H@ L=HI =NH=: V $=@ @; @<@. H T J, @=H=U @, I@H=@ J=HI@ @=H= I =@
CYBERSECURITY SURVIVAL GUIDE127
H @M I H<
#< C08) C87? =HI@=NH= = H H< XH H = =NH=S HHM H J HK IHH, - J=. C@I, I@= =H=, = H @H= IH H< @ I H<H =@M J==. < .+. &H=@ H=HIH +H <@M (&+) X @I IH= = +=@ I@=H= (+) 800-145 T @ @= I=I=HI, J=H, - HK H < @ XI@ IH= I (I< HK, J, H, @=H=, J=) H<H =@M J== @ K=H< ==@ H H J= J= =HH=.U < I= J@I @I IH= = H< =@=HM H @ I
128 PALO ALTO NETWORKS®
HH< H <=J = @. <= = HI =JH I@= @I. H I@H=@ =NH= I K=H<= =NH= =H@M I=@= H H =HIHI, @ I H @=H, = H @H= I< H @ K=H< =NH=@ . <= H @M = H H=@ XH IH H<@M XH. DH @=H= =@M M I HH K< H<M =, >H @ =@M, IH= H H=J@M. =HI@=NH= = =H=@ H H<= <=HHI, @= @=H= H @=J X=H@M, = M= . KJ, H< =H=@ H @I IH= = HK <HH= H<H @ =H H H=H< HH< = @ , H<H H<M IHH, =@M @=H - =. < =NH=@ @ @ H J@J HK TJ=-H=U, I@H=-HH @, K< IH= H I, HH= HK I@H=@ HH H J==.
S*(857< C6)*576 S*(85 7* J85*< 7 7* C08) =H< J=HI@=NH= @I H<@=, H< H H J=H < J@J ==, XL J=H K< @=H= I =H
J
HK
M=,
IHH,
<HH
J=H K< @ IH= I J=@@ H IH M @=H= H MK<, MH=, M J= ( F=I 3-8).
CYBERSECURITY SURVIVAL GUIDE129
F 3-8: E<<; < ;
+I=HM = H< =H
D<( N785* + "5780=7 ) C08) +I=HM @ H I K=H< H< M= HI J=HI@=NH= @I. =HI@ <= <=<@M M=, K=H< IH , J < H=. <= @=H H< =@=HM H H I=HM @== H J=HI@ <= H= JH H<H I=H I@HM @= H=I H H. =HI@=N IH=
130 PALO ALTO NETWORKS®
J=H @ @ =H I=H= HK J=HI@ <= K=H<= J. H-<H I=H= M H J==@ H HK- I=HM @= == IH= J=HI@ J. < IH= =H-<H J=HI@ <= HX H LH@ I=HM @= =H= M H =@ I @HM I=H. AH H< H=, H< L=H= H H<H <J =H H< I=HM @ = H< J=HI@=N H H Q<= @=H= @, =H=IH H=, H<HQ H KM. < <= @=H= @ H<H H< =H=XH=, H@ @H @=H= @ @=< J= H H@. < =H=IH H= =@ I LH H=, H< J@IH= H<H HK <=H=H, I@H=JH, HH HH I= I- @== @H H<H K. IM, LH-H= XK@@= =@=H= H @M @ @=H=, HH =H @@ K IK H<H K=H<IH =H, =HH YL=@M =H H< H H H=I H =H=@, IH@ I=HM I=H. <, I=HM H< J=HI@=N H H IH L<==H H< @@K= <H=H=: V D@=J @@ H< HI H<H H@ H: < =@I @=H= @H, H<H HH= K=H<IH =H= H< H< H H, YL=@ =HH= =H H< H H =. < HI IH J=@@ K=H<= J=HI@=N XK@@ H I =H-<H I=H= EH-H HX.
CYBERSECURITY SURVIVAL GUIDE131
V IH M=: V +I=HM @== IH @= J=HI@ <= = H. V +I=HM @== IH @@K J=HI@ <= JH. V +I=HM KYK IH IHH <HH =H SH @K K J=HI@ K@ J===. V CH@=N, =HH H: CH@=N H = =H=@, IH =HH @@ J=HQ
E;67 S*(857< S0876 7* D7 C*7*5 D N7 D*09*5 EL=H= I=HM @IH= = H< H H H<= H@ == H H@. M I=HM @IH= @ @H @=H= H@ H<H JH= HI H H<= HHI@ =H= XK@@. < J@ @ K=H< H<= <. < @ J===@=HM =H @@ HX H<H J=J @=H=, @=H= H<H I H H H<H H<H @J H< <J= @=H= M =. +I=HM @== @ J@IH MI I=@ XK@@ @=M K=H< I, H=H=, I, H H=, @=H= H@ @=M K=H< ==@ I@, = =H= H
132 PALO ALTO NETWORKS®
H< H<H JH= I@. @=M K I H< =XI@HM = = =H= I@H=@ @=. A I@H=@ @=M I@ < H @M = ==HH=J J<, IH M = I= I=HM = K=H< @=M H<H M < H . <= I@H=-@H I@H=-I@ < @ H H HI @. F=@@M, L=H= I=HM @IH= = H< H H H H< M= HI H< J=HI@=N J=H, H H @== H J=HI@ <= H= JH. M J=HI@=N I=HM = J=HI@=N J= H- H@- I=HM @=, @=J= H< =I= H<=
M'0* D*9(* C6)*57 6 H M, H< @ =@ J= < < = H= <=. & @ @==H = =@=HM IH=@=HM, H< H< H@H = HH = ( = , @H) H< H=H=@ @H IH. H, K=H< H< J= H= =H@M H H< HK, I=HM H = K= IH H< @==HH= K<H H<M H HH. =H<IH @H =HI K<HS <= H< HK, M =NH= I - @=M HK =@=HM. H = H< =H=J XH =@=HM H< B= I 'K DJ= (B'D) HPI< = IH=J=HM <=< @PI=HM H HHH H @ J= H<= HK
CYBERSECURITY SURVIVAL GUIDE133
<= H H H< @H=J@M H@@ J=H H<H L=H. +I< H H @==H = , =@ H @=J =H @ HK K<H H< I= K<H I KH. H=@@, I< H H HI@ H--I HK I=HM H HM= H @= H< HK I HM= H J HH=, H< H< @@K= I=HM H H I H< @ H<H IH= H< H=. +I< M= < H =@=HM @ H I II@HI = K<=< =H=@ I= @ H<@= @M K H K ==J=I@. = LH-H= XK@@ K=H< & =@=H=, =NH= LH HK I=HM H HH= H =@ J=, =@I= H< H@H. =@ J= I= & @=H HK IHH=@@M H H H< H J=@@ & HKM LHH= XK@@. A I@H, =NH= =HH@M I=HM @== @=H=, I, HH J=, @ K< H< I = @H. <I< H< @H @=H=, I I= IH=J=HM H@ K<=@ >M= HH= =@ H<H H H< J= H. BM @= H< I=HM = H< HK @J= @KM- H= H H< LH-H= XK@@, H= K @H @M H I@@ JH H< =@ J= H<= <= K=H<IH I=HM =.
B**76 ) L776 + E;67 A5(*6 < @= H H< @ =@ J= I=HM, H< I < H<H J=@@. < H= J=HI@
134 PALO ALTO NETWORKS®
H =HIHI (D) H<@= H<H =@H H. < M =@ J= H (D) IH = H H< HH= J=. < @M & IH K<=< K ==@@M = H< H I =. E< H< = J= @H =@=HM @IH=, IH =HS =HH H IH H< @, @==HH= K<H < .
C<;;@ ; * D@<=@ I;@ (*DI) CH= J=HI@ H =HIHI (D) J= H< H =@H H. CH= H=H= H J= = L. D @@K I H H H@M, H
"< D ";; ("D") =@ J= H (D) J= H< H XI H= =@ J= HH= J== H< J= I. D M = @= I=H J=, IH H< =H=@ =H= H<H IH @ H I=HM.
<; '' *% A ++$ & J= HM, I H H HK. KJ, =H H J= M HK I=HM H@, I< = =H @=H= I, @= I=@ HX JH= ==H X@ <=. A I@H, ++$ & J= H<
CYBERSECURITY SURVIVAL GUIDE135
=@ J= H H @=H= K=H<IH H< M I=HM H@ H HH H< J=. =H= H H< H<@= @=H J, H< I I=HM IH = HK , I< HK H@ K=@ HK I=HM, K<=< H I H <=J H= =@=HM HHM. < @ H H=H=@ HK I=HM IH I< H< HHI@ =H= XK@@, +, L=, K<=< = H HLH =>=H @==. =H< K=@= @=H H<@= H =, J@= <=J =@ HHM =@ <@@.
S+*0< E'0 M'0* D*9(*6 @M @ =@ J=, MI H: V HH HX V HH H V EI H< J= = ' <I< =H= H<@=, =NH= I H<H @M IH<=N J= <J H =H=J =H=, =H= =HH I=HM H<I<IH H< =NH=, HH =@ J= JI@=@=H= @K.
%< -G;<; < ' ; A@-<; C<;;<; < HK = H< @= HK H= @=H=, H I.
136 PALO ALTO NETWORKS®
H J= H< J=I @H= J== @=M H @H J=. KJ, H< H=H=@ XK@@ H =H=H HK I, =H =H=M @=H=. H =@M =H M HX @@K H=I@ HK H H @ =H @@K = H- @=M I=@=. =@=HM L H<= -L=H= =H=, I @ H MH<= H<M KH H<M @ H H H<= J= H< HK. =H=@ XK@@ H< I=HM @IH= H J= J===@=HM H@.
R*7* !6*56 P6* C00**6 *H I H <@@ I HK I=HM = <@ K=H< H< H=H=@ &. ' H< I =H H< H K=@ HK H< &, H< I < =H H< H H< HH K=H<IH M I=HM = H< HK HX H< IH= H< >I==H= H=.
% = -G;<; F@ *% G < LH-H= XK@@ = K=H< & HKM @J H< =H=. H HH= @@ HK HX = H< = , H< LH-H= XK@@ J= H< H @=M HX M @=H=, I HH.
CYBERSECURITY SURVIVAL GUIDE137
@=H= @H =@=H= H< LH-H= XK@@, @ K<H< H< I = = H< X H< .
M'0* P57*(7 A@@ H< H<@= K HH< H J= H< IH= =@ HH= H<H LH H @@ I. =H< H IH= HK I=HM, =NH= J= <= = J= K=H< < H<H K@ < H< H< =H= =H.
-G;<; F@ =< %<<; < LH-H= XK@@ J= I HH= HX = H J= @H. + H< M =@=H= =@I: V A==<; =<. EI H<H I <J H H< @=H= K<=@ J= I =M @H. V L;. *H=H PM =X K=H M HMPH HH H<H M ==H IIH<=N. F =H, =NH= M KH H I H<H @M K@ IH<=N H, K<=@ @= @@ H<. V " =<<;. < LH-H= XK@@ @MN HX @==I HH, J== H< H H I X@ H<M < J= H< HK. M H= H <J H=J=I @=H I= H<= =@ J=, K<=< @M = H< =H H= @K = H< HK. < LH-H= XK@@ HH H<H =@ @H, H
138 PALO ALTO NETWORKS®
=NH= = H =H== HH= =H K@M =J JI@=@=H= = H< H= MH. DI H H< JH I J= = I, H< ==HH @=H= H= MH IH, =HS H M =NH= H H= >IH <K I< = H<M =H H=I@ H<H. BM @= JI@=@=HM HH= = H< HK, H< LH-H= XK@@ =HH L@=H =H < H< IS J=, H
D7 P57*(7 ' H< ==@ IH =@=HM = H< = H H = @ IH= H@@ I=, @M =@ J= K<=< M M H K M H< =NH= = @=H= IH= =H H@. ' < H @J H<= <@@ = H @J @KM- H= H LH H< IM HH= H @@ @H=. <= H, H< @=@ =H, =
CYBERSECURITY SURVIVAL GUIDE139
V D L;. CH@ H< H =H=J H HH I< =H =@ I=HM I = @=H= HH HH<H. V F ;@ ;<; <;<. CH@ H< X@ H IH=@=HM K=H<= ==J=I@ @=H=, @@K= @=H= I K<=@ JH= I= =I IHI X@ H. F =NH= K=H< <=<@M =H=J H, K=H< I@HM @= I=H, H< =@HH= H= =HI@ DH HIHI (D) =@H I< H H< H H< J=. A H= H H< < I= L H< J= H H H= H H< H H< J=. D H< @=H= H< H K=H<= H< H H, J= H<I< @=H J=I @H. < LH-H= XK@@ IH< HH= I< H=H= H H< H H H @@K @M J=HI@ H, HIH= K=H< J= H, <I@ =H M H H@M K= J= H<HS @H J==.
D*9(* M** 7 DJ= H @M @ = =@=HM @IH= =H H@=< H< IH@ X@ H<H J J= HH= J= HH. IH<@@, =H J= H< H I H<H H< J= = =H
140 PALO ALTO NETWORKS®
I = =HH K=H< H< =NH=S @== H = =H I H. + H< H<= H<H J= H H@ =@I HH= I=H, H K== J= K== H I =@ I@ HHH. T"=@=U ( A@ ='+ J=) TH=U ( G@ A= J=) =@ J= J == I=H M II H< H=J I=HM HH= = =@ ='+. =H< J= H @IH=, =NH= < H = J= < >=@ H I H< J= HH H =H I=HM @=M ==.
CYBERSECURITY SURVIVAL GUIDE141
S85< M F<@@ < @ "< @ 3< @;<; ; @-= ;< @@, @@ <3 @ <<; < <, @ @@ ; 3 @ ; @ O. M ;-;<; ;< @ < @ 3< <; <3 @3, ;@<; <3 ;;<; 3O ; =;<; <3 ;<; 3< @@ ;@ ; <@ =@ ;<. M C< @@ ; ; ;<;;@ <33 ; ;@ < @; ; < ; ; <3 <@ ;<;;@. M "< @, ; <;;<;@ < ;=@, @< =< @ @ <3 =<<; @ ;; @ @; <@ @ @ < ;; ; = ;<@.
D6(866 1. <H H H = +I=HM +MH DJ@H $=M@ (++D$C), K< H< I@=< I< @=M@ @? 2. <= HLH H HK I=HM @. AH K<=< < H< ++D$C KI@ H< @=? 3. C@I IH= = = L@=J KH< , =H @=@=HM, ==@=HM, @H=J H. <H H< <@@ H K=H< I= I< J=H? K H< =H I= H=H=@ $A&/A& J=H? 4. C= MI K =@ J= =H @=H=. <H = KI@ =HI = MI J= K =HH H H= HK? <=< @=H= =
142 PALO ALTO NETWORKS®
K0*)* C*( 1. *@H H H< -IH I=HM @, < @@ H<H @M:
A) HH H@M H@ <= <= =NH=S I=HM =H, H<M H< == R==S H H< HK.
B) IH H, @= H, H< == HK. HIH H, @= H, H< IH= =HH = = HK
C) A IH J= HH=J ==
D) < @H =J=@ HHM IH H, , J=X 2. & H< XH H H= H< IH I=HM @. 3. <H H=H =H=I=< HH @K @= @K? 4. I F@: *IH= HH I =@= HI H =H=J H@ @, K< @M =X @=H=, =X I @@K H HJ HK. 5. K HX, K<H< C, D, 2, H K<=< 3 H< @@K= =?
A) CIH I=@H =-<I @=H= HX. B) @H H HI@M H=H =. C) &K@M J=@@ =@ @=H= K<=< <J MH H <J @=H= =H=X I=@H.
D) @==I HX. 6. & H< ==H H< HK H<H M =H H <H <= = =.
CYBERSECURITY SURVIVAL GUIDE143
7. < H X=H H=J KM H I J=HI@=N H H = H I K<=< H< @@K= H<?
A) +J K<=H@=H= I= @M K I. B) DM=, IHH, H@@M @ I=HM H<H @=J I@@-HI H<H JH= H HK <H. C) H HI= JH= = =H= K=H< H@ @H. 8. I F@: =HI@=N H H @I IH= J=H IH I = JM =H KM H H H<= H=J <=HHI 9. & H< < H I= =@ J= K=H< H H= I. 10. I F@: A ==@ I I I= =@=HM = HH= H< H H< =@ J=.
144 PALO ALTO NETWORKS®
4. C<'*56*(857< S0876 +5 P0 A07 N*756 - G; <; F ;<< @
< @@K= I@ L@= J=I =@=H= H<@= I = LH-H= XK@@. A@H<I< H<= =I= = =X H H<@= =@=H= I = @ A@H &HK LH-H= XK@@, =H J= IH= H<@= =@=H= H<H X LH-H= XK@@ = @.
A==<; I;L<; A H< IH=@ @H LH-H= XK@@, @=H= =H=XH= J= J===@=HM H@ J K-@H K-@H @=H= H<H J HH= M I= @=H=H HX, <= H = H<I< H< XK@@ I= MH= (++$ ++). H< H, IJ -K-@H @=H= H<
CYBERSECURITY SURVIVAL GUIDE145
H HK K I=@M J @. KJ, = HMS I= J=H, H< H= H @M @ I M H< @=H= <@= @M H H<= > . A@=H= =H=XH= @ ==HH H H< @=H= H< HK, @ <K H<M K, H<= <J=@ <H=H=, H<= @H=J =. < I = >IH= K=H< I =H=XH= (=I @H = H<= I@, ==HH LH@M K< = I= H< @=H= H<= =H=HM, H >IH . A K=H< H<= =H=, ==HH I =H=J I=HM @ I@ H @ IK @=H=, K<=@ @=, =H= <= H< H<H @@K.
F5*00 5 +( C066(7: A0(76, 7 P576 +HHI@ =H=, H< = H HMS XK@@, K H H H= K< @=H= I@ H@@ I= H I/ H=H= . < H=H < H H- @=XH= H@ H<@M = H< =M @=M @H; H = <- =H H< IH= H HI . <= H<H M HMS @=H= H =H=X, I< @ H@@ M H< XK@@ IH TH H< HU HX @=XH= M XK@@ <@ H H< XK@@ H- @=XH=.
146 PALO ALTO NETWORKS®
A@=H= =H=XH= H<@M = LH-H= XK@@ H @M M =@ @H @= H H@. H, @=H= =H=XH= I I@H=@ <= H H= K<H H< @=H= =, XH H, H< @=H= =H=HM H< H< = H< XK@@ @=M. A@=H= =H=XH= = <=<@M LH=@ @=H= H=I H J@J, @=H= HH= <= IH = K=H< H< J-<= @=H= @.
A-ID@ 5+( C066(7 *(0< < XH H H<H @ A@H &HK LH-H= XK@@ LIH = H< =H=XH= H< @=H= HJ= H< HK I= ADW. = M I =H H<=I, A-DW H= K<H H< @=H= =, =H=J H, H@, MH= (++$ ++) H< J=J HH= @M ( F=I 4-1). < I =H=XH= <= I H =H=M H< @=H= K=@@ JM = H< @=H=. < @ YK = @@K:
A==<; ';@ +=HI I XH H @ I=I @=H= H= @H HH= <H=H= H H@M =H=M H< @=H= @ H< H@ H = I. < =HI @ H= = H< @=H= = = I =H I@H H =H = I= -H H ( L@, *D H 80 =H H 3389, =H H H). H< =H=X @=H= = @@K M I=HM @=M, IH< @M= H< HX = H =H=M I@ @=H= K@@ H<H.
CYBERSECURITY SURVIVAL GUIDE147
'' ; ''H D=<; A-DW H= H<H ++$ MH= = = I MH= @=M = = @, H< HX = MH H< H H< =H=XH= <= . @=M = = @, H< ++$ MH= = H @M. ' H< @=H= = =H=X, H@ M @=M, H<H JH= X@ @= H< HX = H< @=J H =H H=H=. A ==@ < = I K=H< ++ H H= = H K= = = I H HI@ HX J ++. +I< HI@ HX = =H=X <-HI@ H@@ J= I=HM @=M.
A==<; %<<< D<; D K H@ I H @M =H=@ HLH- =HI H HH H< @=H= H<H M HI@= == H< H@ (.., <! HH I ). D J@=H H< HX H H< H@ =XH= J= IH &A HJ@ = M= =<@ @=H= I< F. D I@ @=H= I H =H=M H< ==J=I@ IH= K=H<= H< @=H= K@@ (.., KLX@<=). =H= H =H=M= @=H=, @ =H=M X@ H< HH H<H <I@ H<H =H=J H.
H*8567(6 H= , J=J @=H= H=@@ H HH J H<I< J =HI H@ @M=. H< =HIH=, =H = M H @M =H=@ <I=H=, <J=@ @M= H =H=M H= @=H= I< -H- X@-<= @=H=
148 PALO ALTO NETWORKS®
H<H I =HM MH=. I=H= @M= = I , K=H< H< H< A-DW H<=I =I <, H J= J===@=HM =H @=H= H<H =
F 4-1: H< %< A< < A==-IDK @@L@ L
A-ID@: D*0 7 C867 5 ! A0(76 @ A@H &HK J XJ K @=H= H A-DW < K, MH H< K< IK @=H= HX K=@@ HH. < HM=@@M HK = K< IK HX K=@@ : =@@M J=@@ @=H= H<H H <J ADW =H@, IH @=H= = = I.
CYBERSECURITY SURVIVAL GUIDE149
;;<; C< A==<;@ = ACCW (A@=H= C CH) H< @ J=K, I I=@M H= H<H H< @=H= = I =@@M H. = H< H HI HI H< @ A@H &HK XK@@, IH H< HX I=H =H A-DW J@H. < K A-DW = J@, HH K=H< H< IH, H< H H< H @@ I = H< K@M IH.
I;; < C@< A==<;@ ' =H < H= K=H< ACCW H< @ J=K, H<H H< @=H= = IH= = =H@ IH, H< MI <J J@ H=. F=H , @=H= J= @=, H=J@M = H< @=H=. A@HH=J@M, MI J@ IH ADW H< @=H= I= H< L H@ . < H@ H<H <J L =@I: F, , (++$), A, +, *+, @H, IK-C, IK-D, X@ M (
150 PALO ALTO NETWORKS®
+ K=@@ @@K IK HX H H<I< K=H<IH J== M @ J===@=HM H@.
A E;0* + H A-ID@ #56: I)*7+< #*'E; < I ==H=H EL =, H< ==H=@ H= = ++$ I=H=. =H< A-DW, H< J= H< HX H< =HI H= H<H =H = I= ++$. < MH= = H@ H< ==H=H H MH H< ++$ HH H<H =H = HX. ' H< < H< H, A-DW @M HLHI@ =HI HH H<H H< @=H= = I = EL. EL = H< =@M K=H<= ACCW H@@ J= I=HM @=M. H< I K H ==H=H H< EL DH +<= HI, EL I T-<=HU H K< H< = < @H = @=H= H H @=H=. H<= =, H< <H=H= EL <J < A-DW K=@@ HH H< EL DH +<= HI K<=< = H< =@M = ACCW. AH H<= H, ==HH < @ IH H< @=H= I LH @=M H@ J H< I H< EL DH +<= HI H@M @ EL I. A@=H= H=HM: < H @=M CH@ H=M= H< @=H= = H< XH H = @= IH H< HX HJ= H< HK. $= K<H H< @=H= , H< H =H I, =H I@M= H<@M, =H <J=@ <H=H= = H< LH H HK = = == IH <K
CYBERSECURITY SURVIVAL GUIDE151
H HH H< @=H=. ' @H =HI I = =, =NH= @M @== K=H< H<H X-= H< @@K M. EL@ =@I: V A@@K M V A@@K IH L@=H, J=I H< H<H V A@@K <I@, I I V DMH =H V A@M HX <= H<I< + (I@=HM +J=) V A@M @=M- K= V A@@K H= @=H= IH= V AM =H= H< J
A==<; F;<; C<;< F M =NH=, I @=H= @H H== =H I=HM @=M @ M @= ==J=I@ @=H= IH=@=HM K<=@ @= H< IH= K=H<= H< @=H=. EL@ M =@I: V A@@K= +<=H DIH, IH @= H< I +<=H A==HH=. V B@ F-=@, -<H, -H= -, IH @@K F =H@, H=J@M @M @@K= I H K F. V E@ H< I +&, IH =@ H< I +&-X@ H @M @@K H= X@ HM H H I= H< X@ @= HI.
152 PALO ALTO NETWORKS®
= @=H= <=
A0(7 F8(7 C750 '0* $E: < XI H<H = H @@K M H< LH . @ =H H< @=HM = J=K= H< = =H H=@.
CYBERSECURITY SURVIVAL GUIDE153
F 4-2: A==<; F;<; C<;< @ =< @ ;; ==<; @ ("<@< '%<;) < ; ;<;@.
154 PALO ALTO NETWORKS®
C7500 M8070* A0(76: D<( F07*56 ) G586 < M K< IH M KH H H@ @=H= T= I@U, H H@@= H< ==J=I@@M. < HK <= H<H H<= @=H= I M= X@H.
A==<; <=@ A I @=H= = HH= @=H @=H= M H<H I H @ I H= I K<=@ @= H<= I H<. A L@ M H< I H H @=H= I< *D, @H, ++. E< H< @=H= K H I M IH @, MH @M H<H @@ IH= H< I @ K H I H< = H<= < HK. A I @=H= H = H IH H<I< -DW (=I @H = H<= I@), HM= H< I H H< @=M. A K @M , H<M @M H H H< =HM I. & IH H H< @=M =H@.
D; L@ A M= X@H = H @=H= H<H = H M =H= H< X@H =H=: HM, IHM, <J=@ <H=H=, I@M= H<@M = H. ' H< = I@H H< X@H <=J, @=M H<H @ @ H< HX @=. A K A-DW H<H I@X@@ H< X@H =H= = = H< K@M HH IH, H< X@H = IHH=@@M IH H< J= = IH, H<M ===N= H< ==HH=J H =H K=H< @=M H.
CYBERSECURITY SURVIVAL GUIDE155
F C< ; '< <=<;@: V BI=: AIH<H=H= J=, H, E*, @ H, X , HK IH, H/I V G@ HH: F=@ <=, HH IH=@=H= (K-K=, H@, H.) V C@@H=: E=@, =HH =, HH =, =@ HK=, =@ I=, /J=, K H= V =: AI= H=, =, <H/J= V &HK=: EMH HI@, =HIHI, H@, LM, H , IH= V A@ H H X@ HK H H< V H H @K V CI 1 I@@M H<I< @ I V EJ HH= I= H H@ H<= H< H< =H =H I =HH V K=@M @M V A@=H= < < K JI@=@=H= V H =I = =@M XI H L H< =H V I@ H< @=H= V C@=H-J V BK- V -H-
156 PALO ALTO NETWORKS®
V &HK H@
A0(7 B*950 C5(7*567(6
;; A==<; ;<< V C@=H-J V BK- V -H- V &HK H@
C7*7 I)*7(7 EH= @@ =N H = J=HM ==@M <=H=H HK- H<H H<H <J J@J H J= M H< =IHMS H=H=@ I=HM I. CHH =H=XH= = K < H HX H@ H< @H @M= @@ @@K HX I= I@H=@ H<H JH= H-@ JH= H<=I = =@ I=X =. @= H=H=@ @IH=, HH =H=XH= HI@@M H@ H< H<H JH H<@J H<I< H< H=
CYBERSECURITY SURVIVAL GUIDE157
@ A@H &HKS CHH-DW = I=@H =@- <=HHI, K<=< = I=I =HH= HK <K H<H =@=X H, H@= = L==N . < =@- <=HHI (+3) =HH I@H=@ H<H JH= ==@= (+, H=-@K, *$ X@H=, H.) =H =@ H = K=H< I= =HI H. <= @@K HX H I@@M @MN = =@ K=H<IH H< =H@ H= = H< I@H=-IH= HKM. < HK = H= =H@M H @@@ = <K @H H<H I IH= =X H<H JH= H L==N H<I<IH ===N @HM.
5*7 P5*9*7 EH= HK = =@M J@J= H<H @ I@@ @=H=, L@=H, @K HH HH= H<H @ J== H=H=@ H< HH=. <H @=J J= @=H= H<H M=@@M < H, I -H H, HI@ K=H<= H< @=H= <= K=H<= L=, ++$ H< HM MH=. < H<=I JH H=H=@ I=HM @IH= I< + XK@@ J =H= H< HX, H
158 PALO ALTO NETWORKS®
H<H I H <= I=HM H<I< H< @H @M= @@ HX, @@ H @ J=, HI@= =IJH= H<=I. +=@M IH, H<H JH= @IH= K=@@ H=J = =H H <J J===@=HM =H H< HX. @ A@H &HK I H<H J===@=HM H<I< H< =H=XH= H@ @@ HX. V A==<; <@. CHH-DW @J H< H< 100 @=H= H@ = A-DW H @ H<H <= K=H<= H @=H= H. <= @ H< XK@@ H HH JH H<H HI@ K=H<= J @=H= H<H KI@ M H=H=@ + LM @IH=. V '' =<;. K HX = MH K=H< ++$ M I@H. <= J= HH= H -I, IH =H @ J= HH K=H< MH <@ H @=J L@=H @K. @ A@H &HK I J===@=HM M =J= I=HM =NH= H< YL==@=HM H, M @=M, I@@M @ == ++$ HX @=H= *$ HM. V C<;< < ;; ;<<@. AHH @K <J ==@M HI H L=, M=N J=HM MH L= H <= H=H=@ HK I=HM IH. @ A@H &HK J= H< =@=HM H H=
CYBERSECURITY SURVIVAL GUIDE159
@ K= @K =@I= J=I, MK, JI@=@=HM L@=H = =@ .
M8070* S*(857< D6(0*6 +@M, @ A@H &HK = I@H=@ I=HM ==@= =H =@ HLH =@ H<H JH= =. <= HLH @ I=HM H H =@M M ==J=I@ I=HM JH =N H< I@@ LHH H<H. +I=HM K H< =HH= @=H=, L@=H, @K, *$, @I HK <J= H H= I =H@ M @MN= HX =H =J = = I@H=@ =.
I; D@; @ A@H &HK LH-H= XK@@ I-I=@H @H H<H IH=@=N =@ @@@ = <=HHI H L==N H<I<IH ===N @HM. =H=@ @ <=HHI H=I@M =HI @H= < HI H<H = @ I H H@M = HX < @ HI. @ A@H &HK = I=I < H<H CHHDW = =@ I=X = @J =HI H. <= H<H HH = @M , = HM J =H=@ CHH-DW HI @.
'; %@@ '< < =@ HK I H-, I= =HIH<= = HH =H=. H I= H = =HI H (I== I@H=- =) =H I=
160 PALO ALTO NETWORKS®
X@ L= (I== X@ K@ = H =), H< =@ <=HHI HX @@ =HI = H- <= H J= @HM =HIH=.
S75*- B6*) E* < I H- = @ J@ H @M I = H< @IH=- X@ LM H, J=I, MK, =HI = JI@=@=HM L@=H,
I;@<; %;<; CHH-DW HH HK @@ HM JI@=@=HM L@=H, I JYK, D+ HH H H<H @ H H< =
CYBERSECURITY SURVIVAL GUIDE161
H= =H= I. + <= =@I: V H@ @M HH= V +HHI@ HH H<= V +HH=H=@ @M HH= V I=H=- @M= V J@= @ H HH= V HH= C @M V CIH JI@=@=HM MK <-< =HI X = @=N H @==H =J@= @ H, K<=@ C @M -HH= = H I H< IHH IM HH= =H M H-@J@ J= H<=I.
S75*- '6*) M05* S( JH= K J=I @K = H<I< H< I H- =, H<=I H<H = = H< XH H H< X@ =J H K=H= IH=@ H< H= X@ = @ =H M H = =. <= H<H @HM =I ===N M =J=, =, = HX H =H =H H=H= ==H@M K=H<IH <J= H XH I H< H< X@ ( F=I 4-3).
162 PALO ALTO NETWORKS®
F 4-3: '-@ @;;; =@ ; ; ; <= =<;
@ A@H &HK =H= =H H =@@= @K @, K=H< H< 50,000 @ @MN =@M. =I MK =HI H@ K= @K =@I= DF, $ "J=H J=I, MK K@, MK < <, H>, M-@ HH. @ A@H &HK J= J =HI @@ HM @K H =H@M =@@= @=J J=I @ @@H M @ A@H &HK J@ I =@I= K@K= HK <MH @M I H< K@, H< =@F=W @K @M= J= H< @= H<=-HM < =NH= I H< K@. < @ A@H &HK H<H H @MN H< @ I=@M @==H I@=H I=. &K =HI K @K J=H H< H (I= I= =HI H) @=J H<I< <I@ =@M M IH.
CYBERSECURITY SURVIVAL GUIDE163
#0)F5*@: 5*7 I7*00*(* C08) 7 P5*9*7 ! 5*76 C==@ <J ==@M HI H IH=N HH @K H J= H=H=@ H=J=I H@. @ A@H &HK < H<= <@@ K=H< =@F=W, K<=< =H=X @K M J= H< HI@ <J= IH X@ = J=HI@=N J=H =H @M= @@M -L=H= =HI. V I;<; < F ; C<-=@F=W I IHS -= XK@@ = >IH= K=H< @ A@H &HK @I- @M= = H @=J =@ @ HH= . < =-@= XK@@ HI IK X@ =-@= H K<=@ =H== <=< HK H<I<IH @K @HM. < @M= IK X@ = Y H I @I = H =H=M IK @K IIH@M @=J HH= H @@ @H=. V +FW * ';<-< H< @ A@H &HK XK@@ IH IK X@ (==H=@@M H@ LIH@ X@, L= H H< X@ HM = H< IHI), H< X@ I=HH H H< <H =@F=W J=HI@=N L. +I== I@@M IHH=@@M @=M. < L J= J=HI@ HH H< IH @K K< @ A@H &HK =H@M J H< 100 @==I <J= H<H J@ H< @K. V A< '; G;<P< @ = =H=X @K, H< @ = H< H H< =HI H, K<=< IHH=@@M K=H =HI H< @ HH =H IM. V D= *@ ; A;@@ P =H= H J== HH=
164 PALO ALTO NETWORKS®
@K, I K@H< =H= IH H< HH @K = H J=@@ H< =@F=W H@. <= =@I H< =@=HM H @@ <J= H< @K: H< I H<H K HH, H< @=H= H<H @=J H< @K, =HM <, X@ /@H, D&+ IH , @@ *$ =J@J = @=JM <-< H< @K. V I;<; E;=<; '=@F= I MH @J@ = K<=< =< I H<H =H@@= I M =H I=HM IH. B=H9 = L@ LH-H= =H I=HM M K<=< < =HH K=H< H< =@F= @I H H X=, @=M, =H =H=. @ A@H &HK I= LH-H= L@=H HH= M CMJ, H I=@ IH =H =HH @H @I, =H, HK.
!RL F07*5 C@H= H< H<H JH= @=H= H@ =@=H= = I@@M =HH, -L *$ X@H= H H<H @ I=HM H H H @M H@ -I K IX H=J=H=, IH @ = *$ HLH K=H< @=H= I I@. < -L *$ H IH H I=H H< HX HH H< @@ I I=HM K=H< IH, =@@= *$ H. *$ H<H H H=N M H< @@ *$ H I@@ =H < <H, 180 =@@= *$ H. =H= H H IH=NH=, ==HH H IH *$ H= H IH< H=@ H< *$ H@ H I=H H<= =X .
CYBERSECURITY SURVIVAL GUIDE165
C<<; *$ H=NH= = K=H< @=H= I @=XH= H IH< HH X @==. F L@, ++$ MH= =J @H <=<-= *$ H= H I H<H L, + H@ @= H H= = =H, *$ X@H= J===@=HM @=M H@ H= H =X I H<I< H< HH =HH= K=H< H= =HM J= (AH=J D=HM, $DA, D=HM) K=H< =H=@ ==
C@<; C@< B< % A==HH XI IH @ H H=M I M @=M J=@H=. < =@I H H< I, , H< *$ H<M HHH= H H< *$ HM. H @ H< K H=J=HM K<= = H< IS <, ==HH @@K I H H=I H = H K=H< K= , I K H J= H< *$ X@H= @=M.
F0* ) D7 F07*5 DH X@H= HI @ ==HH H =@H @== H<H K=@@ I H< = =H K=H< H< H IIH<=N X@ H. V F <; =: CH@ H< YK K= X@ HM M @= K=H<= H< M@ H =H=M H< X@ HM ( H @= @M H H< X@ LH=). V D L;: CH@ H< H =H=J H HH I<
166 PALO ALTO NETWORKS®
=H =@ I=HM I = @=H= HH HH<H. V F ;@ ;<; <;<: CH@ H< X@ H IH=@=HM K=H<= ==J=I@ @=H=, @@K= @=H= I MH JH= I= =I IHI X@ H.
< C<<; ; =<; KI@ @ X@H= @ ==HH H I=@M =JH=H I=HM ==H M @H= H<H K=H< @=H= I =H=HM. < @ J=K @ ==HH H @= @@ J@I H ==H@M H X@H H<H K K IH< M == I@H=@ =H= I= L= I=@ =H=@ @ X@, J = H<M H J==@ = H< @ J=K. H= H< I =H=HM H H< H<H, H< @ J=K @J H< =HH= K=H< H= =HM J=. $ I@H LH H C+ X@ Y= <=J@ IH< @M=. < H = H@ @H = ==H =JH=H= K=H< H@=N, @H J=K @@ H< @ HX, H<H, *$, @=H= @H H ==J=I@ =.
=<; *H= = @ H<I< H X H H<H IH=N, I@@= H M H< @ H H< J= H< IHI I. ' H< = H = H, =H XI H I I@ =, =@= H DF H LH= H< H C+ DF.
CYBERSECURITY SURVIVAL GUIDE167
!6*5 I)*7( 7 CI= H< J===@=HM @ = ==@M =@ H=, K< @M H< HK J=HI@@M MK< I H< K@, =H@ K=@ HK -= I J N H N, HK I H @KM M @M. < I@H = H<H H< = K =IH <= =H= H@@= I H=J=HM.
@-IDK: I;; @ I;<<; ;< ' %<@ CH= = I=HM @== H< @=H= H< =H=HM H< I, @ J= @H=, = H=J HH= H< HK H< @M= @@M H . @ A@H &HKS -DW @ =NH= H @J I =H= H = K= =H= H< @@K= I: V *@: J J===@=HM =H @=H= I I I =H= <@ =NH= =H= IH =HI HK H=J=HM. V %< <;<: M= I =H= H H< I=HM @=M H @M @ @=H= =X @=H= IH= K<=@ I= H< ==HH=J H =H K=H< @M J, <. V <; ; =<;: H< JH H<H I=HM ==H I, = @M= H= =@I I =H=, =, J== @H =HI H< ==H.
H !6*5-ID @ #5 6 -DW @@M =HH @ A@H &HK LH-H=
168 PALO ALTO NETWORKS®
XK@@ K=H< K= I =H= H=@ J= J=H. D= H< HK J=H, I@H=@ H<=I XI H H< I =H=HM H . EJH =@I IH<H=H= JH, I IH<H=H=, H=@ J= =H=, @=H =, =HM J= =HH= KI@ $ A. ' H< @=H= I =H=X, I@@ J===@=HM H@ K=H<= ACCW, @=M =H=, @= H= = J=@@.
A;<; E;@ -DW XI H =H IH<H=H= JH =H AH=J D=HM, =H EL< &J@@ D=HM J=H. =H= H< IH<H=H= JH HK @@K -DW H =H I K=H< H< H< J= H< I @ = H @=M H< XK@@. V "<@< E; ': -DW XI H HH@M =H H< =H EL< @ JH I M @=H = H<= =@. = H<= H<=I, J AC '+ , A@ ='+, $=IL/& @=H MH H<H SH =H@M IH<H=H H =H AH=J D=HM =J =H=X. V < D<: -DW IM =H @ =H= H =H=M I I <= J= H $DA I= H< &J@@ D=HM J. V "<@< A D<: -DW HH@M =H = H@@ JH @ H =H=M I K< H<M @ H H< =. < I @ H H< =K =, K IH<H=H= JH
CYBERSECURITY SURVIVAL GUIDE169
= H< = =K D= CH@@. BM H@M =H= H< IH<H=H= JH =K D= CH@@, -D =N H< IH<H=H= JH H =H=M I H< HK H= H @=M.
@ A;<; <= H<=I @@K =NH= H XI <@@- IH<H=H= I H @@H I =H=. V C= =<: K< ==HH H H@=< I@ I K<=< I I= H IH<H=H H H< XK@@ = H = H< =HH, H=J H@ @M. CH=J H@ = I = K< H< I H =H=X I= H< <=. =H= H L@==H I K H, H=J H@ @ XI H &$ IH<H=H= IH H H< K K = H H< IH<H=H= HH H H< I. V G<%<W: *H I @= =H H< HK K=H< G@@HHW K=@@ J= I <H =H= H H< XK@@ H<H = HI, I @=M H@.
C0*7 5' ) 7*50 6*59(*6 <= H<=I @@K =NH= H XI -D H =H =K @=H <H H @@H H< =H=HM =H H H< . J=H K H< I =H=HM = IH M C=H=L A =H H=@ +J=, H< -DW =@ +J= AH @M H H= K<=< @=H= I =.
170 PALO ALTO NETWORKS®
V C; =<;: I H =H=X J= =H= IH<H=H= JH, -DW H=J@M =H =K @=H H< HK =H= H< IH@M @ I. = H<= <=, @H I K< H K=H< K= H K=@ HK @=@M =H=X. V H<@ =<;: -DW @ XI H =H =K J H=J HK = I. A I HK < H< J, -DW =H=X H< == =H H H< I J= H H@=< H< =. V ; @@: <= K= =H =K =@ +J= C=H=L =H=X. C@H@M HH H H< I, JM I = = = H= H H< J, K<=< @@K H< XK@@ H =H HK H= K=H< I I <= <H H< HK.
$ML API , =NH= M @M <J I =HM @=H= H<H = I H H =H= I H<= IH . H< =, H< $ A K=H<= -DW @ = =HH= I =H= K=H< I=HM @==. EL@ <K H< $ A I H @@H I =H= = @K. V +@@ ;<;;@: '=NH= I= 802.1L H I H K=@ HK @J M@ =HH= K=H< H< @ A@H &HK -DW $ A, H =H=M I H<M IH<H=H H H< K=@ =HIHI.
CYBERSECURITY SURVIVAL GUIDE171
V %<@: +==@@M, IH<H=H= H M LM J J= H @ A@H &HK -DW J= =H $ A M = H< IH<H=H= @ X@ I =H=. V < A@@ C<;< (AC): < $ A @@K IH H <JH I =H= &AC J=H. A L@, B &HK, &AC @IH= J= I H< -DW $ A H I@H I @ @ =H 802.1L @IH=. <= =HH= @@K =NH= H =H=M I H<M H H H< HK H I- @H @==.
D5*(75< I7*57 @@K =NH= H =M I=HM I@ I I @J H< I IHH=@@M, -DW =HH K=H< @M JM =HM J I= H- H@ YL=@ XIH=. ' XI, H< XK@@ IHH=@@M H=J I I I =H= H< =H= IH H IHH=@@M >IH H < = H< I =NH=. V "<@< A D<: M H< $DA =HM J=, H< XK@@ H=J I I =H= J= H $DA H $DA- =HM J. < =H= I H IH <=J H<I< H< , L@ CH=J H@ $ A.
172 PALO ALTO NETWORKS®
"6'07< 7 !6*56 A0(7 A(797< < K -DW J=H K< H I=@= @=H= = I H< HK M A-DW. = =H< ACCW H< @ J=K, ==HH = K<H H< @=H= =, K< = I= H< @=H=, H< K=H< = IH=, H< I H=H= H< @=H= HX K@@ M =H H<H. ===@=HM =H H< @=H= H=J=HM H I @J@, H >IH @J@, @@K =NH= H H=J@M @ H< @=H= HJ= H< HK. A==HH @= @=H= I K=H< H< I= I=H I=H = =H, < H = H< I H<H H<M = J=@H= H @=M, H =H < @= H< IS @=H= I IH=
@-@ %< C<;< - @=M H@ @ H< @=H=, K<=< HM IHM =H @ =, =H I@M= H<@M K<H H< @=H= <H=H= . @== I H @M @ @=H= I I, = =H< IHI =I =H=. EL@ I- @== =
CYBERSECURITY SURVIVAL GUIDE173
R*785 7* F5*00 7 7* C5*567* + S*(857< < =HH H<= = H J= IH= IH= K< LH-H= HK I=HM XH =H H< J@@ < +I=HM. @ A@H &HK < I=@H I=HM @H H=: =H, @I, HK I=HM. < @H H=X K= I=HM I=H H= IH=, < J H
H=J
K<
=HH
K=H<
H<
H=@
H<@= I< +I=HM H= EJH H, I@=@=HM H, =@ +I=HM, H@@=H +K=H<= *IH=, DH $ JH= MH. < LH-H= XK@@ H H< @ H< XK@@ H< H HK I=HM. < =HH =H =NH=S J@@ I=HM HHM, H< LH-H= XK@@ ==XH H=IH= = H YL==@=HM, =-@= H<H JH= H< @HH HH H<, =H@@= <=, J@@ H=J. +HIH =H= I=HM <I@ K H< =H= H<H HK I=HM H@ J@J= H =H= H< H IH =@@ H =@. H = H< < H<H H< H=@ H < K=@@ IH H<H @= H = H = IHH=-.
174 PALO ALTO NETWORKS®
S85< V < LH H= XK@@ X M H<= = <=H KM H H@ @@K/@ ==, HK @=H=, I HH H< @@K/@ == . V @H, I< =H +<=H F, H I@H=@ IH=, K< < IH= = =H=I=<@ M =H HX =HI. &LH-H= XK@@ J= J===@=HM I@ H@ J H< I-IH= I@H. V @ A@H &HK H =@- @@@ <=HHI K<=< I H- @K HH= H I L=I H<I<IH K=H< @@ I=HM IH= HI . V HH= HH =H=XH= IH= @@K IHH H<H =H@@= <=, -= HK IH= = @=M. V IH<H=H= =H=XH= J= @ HLH H HK HX H= H<I< H< I< = H@@ @ =, H=J H@, @=H =, H H< @H IH= MH J= $ A.
CYBERSECURITY SURVIVAL GUIDE175
D6(866 1. @==I H = @ H H= @=H=H H=@ =J HK, H<= HX KI@ H ==H= H<H @=H=H I. <H =H=@ H = I, =I MI X=. 5. K =HH I=HM @H @J H J@=H @=H= HX, IH H< = H = =I= IH= #4 J?
176 PALO ALTO NETWORKS®
K0*) * C*( 1. & H< H< =@=H= LH-H= XK@@. 2. <=< = H H<=I H== @=H= identification?
A) H .
C) H@ D= B) A@=H= +=HI D) B<J=@ A@M= 3. I F@: I@M @ I @=H=, =H M M H H=H H= IH=@=HM K=H<= H<H . 4. I F@: H I= JH= @@M H @ = J=I MK H H< HK @M. 5. =@F= H K<=< H< @@K= H?
A) F=@ = =H =HI H.
C) C@I IHH= J=
B) + +E H@ @H= D) =HI@=N L 6. F= H IJ M L L=H= H<H =H@@= H K<=< H< @@K= IH=? A) AH=-J=I =HI. C) @K HM *$ X@H=
B) @==I D&+ I=HM D) C H@ MK =HI 7. I F@: *$ X@H= L= H< IH K =H H=N H *$ H H= K<H< H @@K @. 8. & H< =@ H< = I =H=XH= =H= H K=H< LH-H= XK@@. 9. I F@: -D =@ K< I @ = H I@H=@ J= =I@HI@M. 10. <=< H< @@K= J@= @=M/<= =H= = LH-H= XK@@?
A) +@H=J@M MH= ++$ HX M L@I= H= *$ H= MH=.
B) A@@K= =@ = @=H= K<=@ @= H< I = =@ <H IH= H H X@ =X HM
C) A@@K= =H H =H H@ H H @M K< H< K=H< H= *$ D) B@= IK (-IH<H=H) I = H= H H< HK K<=@ @@K= H< H <J *$ X@H =HH CYBERSECURITY SURVIVAL GUIDE177
178 PALO ALTO NETWORKS®
K0*)* C*( A6*56 AN SW ER S– CH AP TE R 1 KN OW LE DG E CH EC K 1. *C = H @=H= I H HK, H< H HK ==HH H 143 @. 2. H <=, ++$ MH=, I -H H, HI@= K=H<= H< @@K J=PM HK. 3. BHH @@H=, L IH= = K@ <=PM HK. =H 'X 365, DBL, HH , +M, +=@ &HK ($=, F), ==, &KGH, G@ D, H< J@= L@ @I @=H=. 4. F@: < @I= @ H H K <@@ H HK I=HM. 5. I. 6. $H IH=J=HM, HH=@ =IH= H=, LI H H<H, I@HM @H=. 7. F@: $M 7 HH ==@M H< , = I L=H= HM =H H< HK @M H<H = @@K M H=H=@ XK@@. 8. I. B@ H<H @ K RJ=H.S 9. D=H=IH, I@H-H@H, I@H=IH=@, =HH, =H@@=HPM 3. 10. < H@, HK H H@.
CYBERSECURITY SURVIVAL GUIDE179
AN SW ER S– CH AP TE R 2 KN OW LE DG E CH EC K 1. F@: -M @M H H<H H<H IK H H< I=HM =IHM. 2. AJH: <J=@ @M HH= = HH H< I =HI HH=. D=JH: =XI@H @MH @IH @ =H=J. 3. A@=H= <=H@=H= @M @@K K @=H= H I, K<=@ EL@=H JH= =@@ =X H<M I H @=J HH. 4. F=K@@, LM J, =HI= HH=/JH=, K HH/ *$ X@H, J=HI@ =JH HK, H @ JH=, I=X H<H HPM H<. 5. C. &LH-H= HK I=HM @ @M H/H@ @@K/@ == = K=H< @=H=, I HH. 6. HH
180 PALO ALTO NETWORKS®
AN SW ER S– CH AP TE R 3 KN OW LE DG E CH EC K 1. A. D. HIH <@@ =H-H= I=HM @, H<H = I == H< I=HM =H H HIH, K<=@ H< IH= H IHIH. H @ H IH= =H@ I = H HIH, B. C. KI@ =H. 2. C H=H= H IH =H@@M -=IH=J@M, H= HI =HIH=@ K, H=H H @H =J=@, < I=HM HI, @= K=H< I@H=, H@ H I= =J ==H=H=J, I C'. 3. *@= HK I=H= = K=H< @ HH H@ HK. 4. I. 5. A, B, C HI. K H= @@ =H one H< three
scenarios. @H = ==H R=@HS = next-generation =K@@. 6. H@ HX, IK C/D, M= D&+ @==I D&+ IH, H=J=HM K @K =H, J==H= H@M =H =, I =H *$ K=, *C H= PM three. 7. B. <=@ K<=H@=H= + MH @J@ HH= <H, H<M H M= I< H =@M =@H H H< H < H<H I K=H<= J=HI@=N J J=H. 8. F@. H @I J=H =@M =J, I@=@@M =@ J=HI@=N H H sharing M similar I=HM <=HHI@ factors. 9. CH= ( D), =@ DJ= H, =HI@ =JH &HK. 10. I. < J= =H@ = H = L@, K<=@ =H=J H =H M H= = H.
CYBERSECURITY SURVIVAL GUIDE181
AN SW ER S– CH AP TE R 4 KN OW LE DG E CH EC K 1. A@=H= =H=XH=, HH =H=XH=, I = H=XH=. 2. A. +=@M <= H < = H I H< H== @=H=. 3. I. + IH= @=H= M <=< = H @, =I, / H H<H JH, H< H< IH=. 4. F@. HI= JH= @@M H L@=H HH=, K<=< = =H M@ HH=. 5. D. A, B, C @HH=J I=HM H<, IH H H< = =@F=. 6. A, B, C, D HI. =@F= J@ IK H<H, I@M M <J=, H< K H<H M M@= H<= <J= H =HI H<. 7. I. < =H @=H=, *$ X@H= =@H K=H< H HLHI@ IM, IH H< I@M= <= = H H< *$ =H K, H=N @=H. 8. +I=HM JH @ =H= (AH=J D=HM, &J@@, + EL<), I J= H=@, @=H =, =J I =H= H<I< $ A LH@ MHPM 3. 9. F@. J= H<H H< IH<H=H= <= I =HH K=H< H< LH-H= XK@@, =J I M <J M , H<= M <, IH H=@@ @ K=@@ YH H< I =H K=H< =J H H< =J H=. 10. A, B, C, D @@ J@= L@ <K LH-H= XK@@ HI I = =H= H J= YL=@ H I=HM @=M.
182 PALO ALTO NETWORKS®
A(0*)**76
C@ ' G-;=@ & B@ @ KI@ H <J =@ K=H<IH H< < K, =H=, LH= HH<K A@=P M H=IH H H<= HLH. < MI HH<K! KI@ @ @= H H< +< =J= K< H=, IH=, J== H<I<IH H<= < @IH@M =H=@ H H< I H< H= >H. F=@@M, S @= H H< * C@@M, "I=H< B@, "M M, @@ H< H @ H @ A@H &HK H<= H=IH= LH=. @ K H H< HI=HM H K HH< =! AIH<
La/#+!# M'#/
CYBERSECURITY SURVIVAL GUIDE183
A FINAL WORD < = = == H<= H MI = H =J MI H=J H< J=I @J@ H<H K<H MI H JH, , @==H =H. =J=H MI H I MI H IH= H<H K = H =H @=@ = H< LH J= H< .
S&a T/'a"'
184 PALO ALTO NETWORKS®