Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
THE THREAT:
On June 29th, 2020, Palo Alto announced an authentication-bypass vulnerability (CVE-2020-2021) affecting multiple PAN-OS versions used in VPN appliances and Firewalls [1]. The vulnerability affects Security Assertion Markup Language (SAML) authentication. If exploited, threat actors with unauthenticated network access may gain access to protected resources. Additionally, attackers with access to PAN-OS or Panorama web interfaces could perform administrative actions. The vulnerability has not been identified as being exploited in the wild at this time but attacks are expected in the immediate future, given the simplicity of exploitation [2].
What we’re doing about it
What you should do about it
Detailed instructions for upgrades and workarounds can be found here.
Additional information
Palo Alto devices are impacted if all of the following configurations are in place:
Impacted PAN-OS versions (Source: Palo Alto Networks):
Vulnerable configurations of Security Assertion Markup Language (SAML) authentication on impacted PAN-OS devices could allow unauthenticated, network-based attacker to access protected resources.
In their advisory, Palo Alto Networks identified the following resources which can be protected by SAML:
For instructions on identifying vulnerable SAML configurations in PAN devices, see Palo Alto Networks’ advisory and associated knowledge base articles. Customers are encouraged to apply upgrades or workarounds as soon as possible.
References:
[1] https://security.paloaltonetworks.com/CVE-2020-2021
[2] https://twitter.com/CNMF_CyberAlert/status/1277674547542659074