Introduction

Palo Alto GlobalProtect is a network security for endpoints that protects mobile workforce by extending the Next-Generation Security Platform to all users geographically anywhere. GlobalProtect secures traffic by applying security policies with Palo Alto next-generation to the application.

GlobalProtect enables security policies that are implemented whether the users re internal or remote. Security policy can prevent cyberattacks by GlobalProtect polices in Palo Alto.

• App-ID™ technology identifies type of application traffic, regardless of port number, and establishes policies to manage application usage based on users and devices.
• User-ID™ technology identifies users and group membership implementation of role-based network security policies.
• SSL Decryption inspects and controls applications that are encrypted with SSL/TLS/SSH traffic and stops attacks within the encrypted traffic.
• WildFire® Malware prevention service automates the analysis of content to identify the threat to prevent it in near-real time.
• Threat Prevention for IPS and antivirus blocks network based vulnerable applications, denial-of-service (DoS) attacks and port scans. Antivirus profiles block malware and spyware from reaching the endpoint using a stream based engine.
• URL Filtering with PAN-DB categorizes URLs based on their content at the domain, file and page level and receives analysis from WildFire.
• File blocking stops the transfer of unwanted and virus infected files.
• Data filtering enables policies that can be used to stop the unauthorized movement of data, such as the transfer of customer information or other confidential content.

Palo Alto GlobalProtect Components:

• GlobalProtect Gateway: GlobalProtect delivers mobile threat prevention and policy implementation based on application, users, contents, device and device state. GlobalProtect Gateway establishes VPN connections to secure the traffic, implement policy to manage access to applications and data and provides secure connection with mobile from attacks. GlobalProtect Gateways runs on the Palo Alto Networks next-generation security platform.
• GlobalProtect App: GlobalProtect App enables device management and establishes secure VPN connectivity for mobile client devices and interacts with GlobalProtect Mobile Security Manager. GlobalProtect App uses the GlobalProtect Gateway for a prescribed location to provide a transparent user experience for security.
• GlobalProtect Mobile Security Manager: GlobalProtect Mobile Security Manager ensures that devices are fully configured for use in a business environment. It delivers configuration and ongoing management of mobile device settings and checkout for compliance with policy and monitors application usage in mobile. GlobalProtect Mobile Security Manager combines with the WildFire cloud service to know the android devices that are impacted with malware and spyware, it runs on the GP-100 appliance.

Palo Alto GlobalProtect : Key Usage Scenarios and Benefits

Remote Access VPN:

• Provides secure access to internal and external cloud-based business applications.

Advanced Threat Prevention:                                                   

• Stops threats from reaching the endpoint.
• Protects against phishing and credential theft.

URL Filtering   (Check: What is URL Filtering?)

• Enforces acceptable use policies.
• Filters access to malicious and spyware domains and adult content.
• Prevents the use of avoidance and evasion tools.
• Secures access to SaaS applications.
• Controls access and implement policies for SaaS applications while blocking unsanctioned applications.

BYOD

• Supports app-level VPN for user privacy.
• Enables secure, clientless access for partners, business associates, and contractors and guests.
• Supports automated identification of unmanaged devices.
• Supports customized authentication mechanisms for managed and unmanaged devices like mobiles.

Zero Trust Implementation

• Delivers reliable user identification.
• Delivers immediate and accurate HIP for visibility and policy implement.
• Enforces step up multi factor authentication to get access sensitive resources.

Host Information Profile

Palo Alto GlobalProtect checks the endpoint to get details configured in a host information profile (HIP) that’s shared with the next-generation firewall. Next-generation firewall uses the host information profile to implement application policies that only allow access when the endpoint is properly configured and secured. These principles help implement compliance with policies that govern the amount of access a given user should have with a particular device. Below are attributes of host information profile policy: –

• Managed/Unmanaged device identification
• Machine certificates present on device
• Device information received from mobile device manager
• Operating system and application patch level
• Host anti-malware version and state
• Host firewall version and state
• Disk encryption configuration
• Data backup product configuration
• Customized host conditions

Conclusion

Plao Alto GlobalProtect provides an unmatchable mobile security solution by combining traditionally distinct technologies, to manage the device, protect the device and control the application data. GlobalProtect uses the next-generation security platform to implement mobile app policies and to identify and secure mobile threats. Using the next-generation security platform, organizations can implement policies at the network layer, thus securing connection for both corporate and personally owned devices. Mobile device application data will be more secured with GlobalProtect.