Skip to main content

Help us improve the Digital Marketplace - send your feedback

ANSecurity

ANSecurity Palo Alto Networks VM-Series Next-Generation Firewall Service

Palo Alto Networks Next-Generation Firewalls and Security Operating Platform is the industry’s most advanced prevention solution for highly evasive zero-day malware/exploits. Our service uses unique approaches that combine dynamic/static analysis, innovative machine learning (AI) techniques, and an advanced analysis environment to detect and prevent evasive cyber threats.

Features

  • AppID: Complete network visibility of all applications
  • UserID: Visibility of all users/groups for policy
  • ContentID: Identify files moving through the network
  • Advanced Threat Prevention: Prevent known threats
  • WildFire: Identification and analysis of unknown malware
  • Advanced URL Filtering: URL filtering with malware detection
  • DNS Security: detection of threats/anomalies in DNS traffic
  • GlobalProtect: Extend NGFW policies to remote endpoints
  • Available as hardware, VMs - private or multiple public clouds
  • Built for automation, scalability and reliability at all times

Benefits

  • Reduce risk of attack by identifying/blocking zero-day malware
  • Collapse multiple separate security services onto a single platform
  • Cost effective service supporting all environments (small or large)
  • Flexible policy-based access for different user group requirements
  • Proactive approach to detection and prevention of cyber-attacks
  • Detailed malware and threat analysis and reporting
  • Identify application usage; type, what/who is using it
  • Enhance work efficiencies by enabling the right applications
  • Prevent data leakage through unauthorised file transfer
  • Automated protection against attacks

Pricing

£126.94 to £238.01 a unit a year

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ansecurity.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

3 7 1 0 4 8 5 7 4 6 6 5 8 3 8

Contact

ANSecurity David Hood
Telephone: 0845 226 0462
Email: sales@ansecurity.com

Service scope

Service constraints
None
System requirements
  • For Hardware: Racking, Power, Cabling etc.
  • For Virtual: A supported hypervisor/public cloud environment
  • For Cloud-Delivered: A Panorama and Cortex Data Lake instance

User support

Email or online ticketing support
Email or online ticketing
Support response times
24x7x365 Support,
Priority 1 (Critical) - < 1 Hour.
Priority 2 (High) - 2 Hours.
Priority 3 (Medium) - 4 Hours.
Priority 4 (Low) - 8 Business Hours.
Support Service Level Agreements (SLA) are identical for Monday to Friday and Weekends/Public Holidays.
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
None or don’t know
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Onsite support
Support levels
All products come with a standard support offering included which entitles the customer to 24x7x365 email, telephone and web support.
A dedicated ""Resident Engineer"" is available as an additional purchase at between £300,000 and £385,000 per year.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Palo Alto Networks offers on-site training and online training.
In addition, publicly accessible user-documentation which details everything from initial setup through to ongoing maintenance & usage and how to use the API.
Professional Services are also available in the form of ""Quickstart"" packages to rapidly onboard organisations.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
All customer data is exportable should the contract come to an end.
Cloud data that Palo Alto Networks hold on an organisation/tenant can be exported and deleted by contacting Palo Alto Networks support. If no contact is made data will automatically be purged after 90 days post cessation of the contract(s).
End-of-contract process
At the end of the contract, the organisation keeps the VM-series firewall licenses with the data stored on them, and disposes of them in accordance with their own policies.
For hardware appliances the organisation decides on the disposal.

Using the service

Web browser interface
Yes
Using the web interface
The web interface is accessible either by the dedicated management interface or by enabling web management capabilities on a traffic-processing (dataplane) interface.

All features and functionality are primarily delivered through the web interface.
This includes the initial setup, system-configuration, network-configuration, supporting objects configuration, security policy creation, monitoring and reporting.

A role-based access control mechanism is available if desired to restrict certain users/roles to only certain configuration functions or views.
Web interface accessibility standard
None or don’t know
How the web interface is accessible
The web interface is accessible either by the dedicated management interface or by enabling web management capabilities on a traffic-processing (dataplane) interface.

Access to this management interface can be restricted by IP address if desired.

Most modern browsers are supported for accessing the UI.
Web interface accessibility testing
None
API
Yes
What users can and can't do using the API
The RESTful API has near full-functionality of what is available through the command-line interface (CLI) or the web-interface. The API can be used to program practically any aspect of the platform and then be used to monitor and report the health and data the platform itself holds. The API can also be used to “Bootstrap” or provision the NGFW to cut-down on deployment time. There are prebuilt examples of using the API to integrate with other third-party services to streamline operations and improve efficiency.
API automation tools
  • Ansible
  • Chef
  • OpenStack
  • SaltStack
  • Terraform
  • Puppet
  • Other
Other API automation tools
Python
API documentation
Yes
API documentation formats
  • HTML
  • PDF
Command line interface
Yes
Command line interface compatibility
  • Linux or Unix
  • Windows
  • MacOS
  • Other
Using the command line interface
The command-line interface (CLI) used by the NGFW is accessible via telnet, SSH and serial. The CLI can be utilised to configure and manage all aspects of the platform. The CLI has two primary operating modes, an “operator” read-only mode which is used to display information and configuration, the other being a “configurator” read-write mode which can be used to make configuration changes. The CLI also supports role-based access control (RBAC) allowing for more granular control over what can and cannot be done per user.

Scaling

Scaling available
Yes
Scaling type
  • Automatic
  • Manual
Independence of resources
Cloud-delivered NGFW are deployed in a public cloud environment, each service user has their own resources dedicated to them in the public cloud environment. There is no "shared tenancy" capability
Usage notifications
Yes
Usage reporting
  • API
  • Email
  • Other

Analytics

Infrastructure or application metrics
Yes
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Reseller (no extras)
Organisation whose services are being resold
Palo Alto Networks

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
Other locations
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
Other data at rest protection approach
Service are supplied from Google and Amazon Data centers (further information to follow)
Google Security statement
https://cloud.google.com/security/overview/
https://cloud.google.com/security/

AWS Security Statement
https://aws.amazon.com/compliance/data-center/controls/
https://d1.awsstatic.com/whitepapers/aws-security-whitepaper
https://aws.amazon.com/compliance/data-center/data-centers/

All logs can be stored in the customer's instance of a Palo Alto Networks' Cortex Data Lake, user activity is monitored and stored in the Cortex data lake for the agreed retention period.
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
  • Hardware containing data is completely destroyed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery
Yes
What’s backed up
  • Only data within the service provided can be backedup
  • Only data within the service provided can be restored
  • No external entity can be backed up/restored
Backup controls
The service configuration can be backed up via API on demand or via the CLI or web interface.
The central managed platform (Panorama) can be scheduled to export configuration data of managed devices via SCP or FTP to an external storage repository.
Datacentre setup
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
  • Single datacentre with multiple copies
  • Single datacentre
Scheduling backups
Users schedule backups through a web interface
Backup recovery
Users can recover backups themselves, for example through a web interface

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
Other protection between networks
Palo Alto Networks uses standard encryption for telemetry and update services, with separate deployment-specific certificates
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

Guaranteed availability
N/A - responsibility of the cloud provider
Approach to resilience
N/A - responsibility of the cloud provider, and also dependent on the configuration of the NGFW deployment
Outage reporting
Not Applicable

Identity and authentication

User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
Users predominately authenticate using a username and password combination, a role-based access control (RBAC) system is in place to specify what each user has access too.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Devices users manage the service through
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
Accredited by PECB MS
ISO/IEC 27001 accreditation date
25/08/2021
What the ISO/IEC 27001 doesn’t cover
Nothing
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
Yes
Any other security certifications
For Certifications see: www.paloaltonetworks.com/legal-notices/trust-center/technical-certifications

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Palo Alto Networks has a formal Enterprise Risk Management program, which includes the performance of an annual risk assessment, with periodic updates, as applicable, to identify and assess key risks and their mitigation approaches. The scope of the program encompasses information security risks and product risks. Our security program consists of a risk-based approach that includes administrative, technical and physical safeguards reasonably designed to protect the confidentiality, integrity and availability of customer data. Palo Alto Network's information security program is aligned to ISO 27001/2, and includes key controls from HIPAA, PCI and SOC2.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Both Palo Alto Networks and the end-user organisation are in full control of their relevant and respective change control processes.
Additional details are available upon request.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.

Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.

Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
This information is available upon request

Secure development

Approach to secure software development best practice
Supplier-defined process

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart
No

Energy efficiency

Energy-efficient datacentres
No

Social Value

Fighting climate change

Fighting climate change

Fighting Climate Change - Both Palo Alto Networks and ANSecurity continuously strive to minimize the impact of our operations on the environment, while maximizing sustainable business practices to better serve our employees, customers, partners, shareholders and communities.
Tackling economic inequality

Tackling economic inequality

Tackling economic inequality - Palo Alto Networks support and strengthen our local communities by enabling employees to donate time and resources where they are most passionate, by investing in causes that have a positive social impact, and by providing skills to people around the world to help maximize their full potential. Through our giving back program, our employees have helped hundreds of students realize more of their limitless potential with consistent, hands on mentoring in life skills and academic subjects.

Pricing

Price
£126.94 to £238.01 a unit a year
Discount for educational organisations
No
Free trial available
No

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ansecurity.com. Tell them what format you need. It will help if you say what assistive technology you use.