ANSecurity

ANSecurity Palo Alto Networks VM-Series Next-Generation Firewall Service

Palo Alto Networks Next-Generation Firewalls and Security Operating Platform is the industry’s most advanced prevention solution for highly evasive zero-day malware/exploits. Our service uses unique approaches that combine dynamic/static analysis, innovative machine learning (AI) techniques, and an advanced analysis environment to detect and prevent evasive cyber threats.

Features

• AppID: Complete network visibility of all applications
• UserID: Visibility of all users/groups for policy
• ContentID: Identify files moving through the network
• Advanced Threat Prevention: Prevent known threats
• WildFire: Identification and analysis of unknown malware
• Advanced URL Filtering: URL filtering with malware detection
• DNS Security: detection of threats/anomalies in DNS traffic
• GlobalProtect: Extend NGFW policies to remote endpoints
• Available as hardware, VMs - private or multiple public clouds
• Built for automation, scalability and reliability at all times

Benefits

• Reduce risk of attack by identifying/blocking zero-day malware
• Collapse multiple separate security services onto a single platform
• Cost effective service supporting all environments (small or large)
• Flexible policy-based access for different user group requirements
• Proactive approach to detection and prevention of cyber-attacks
• Detailed malware and threat analysis and reporting
• Identify application usage; type, what/who is using it
• Enhance work efficiencies by enabling the right applications
• Prevent data leakage through unauthorised file transfer
• Automated protection against attacks

£126.94 to £238.01 a unit a year

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ansecurity.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

371048574665838

Contact

David Hood
0845 226 0462
sales@ansecurity.com

Service scope

• Service constraints: None
• System requirements:
  • For Hardware: Racking, Power, Cabling etc.
  • For Virtual: A supported hypervisor/public cloud environment
  • For Cloud-Delivered: A Panorama and Cortex Data Lake instance

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: 24x7x365 Support,; Priority 1 (Critical) - < 1 Hour. ; Priority 2 (High) - 2 Hours.; Priority 3 (Medium) - 4 Hours.; Priority 4 (Low) - 8 Business Hours.; Support Service Level Agreements (SLA) are identical for Monday to Friday and Weekends/Public Holidays.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Onsite support
• Support levels: All products come with a standard support offering included which entitles the customer to 24x7x365 email, telephone and web support.; A dedicated ""Resident Engineer"" is available as an additional purchase at between £300,000 and £385,000 per year.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Palo Alto Networks offers on-site training and online training.; In addition, publicly accessible user-documentation which details everything from initial setup through to ongoing maintenance & usage and how to use the API.; Professional Services are also available in the form of ""Quickstart"" packages to rapidly onboard organisations.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: All customer data is exportable should the contract come to an end.; Cloud data that Palo Alto Networks hold on an organisation/tenant can be exported and deleted by contacting Palo Alto Networks support. If no contact is made data will automatically be purged after 90 days post cessation of the contract(s).
• End-of-contract process: At the end of the contract, the organisation keeps the VM-series firewall licenses with the data stored on them, and disposes of them in accordance with their own policies.; For hardware appliances the organisation decides on the disposal.

Using the service

• Web browser interface: Yes
• Using the web interface: The web interface is accessible either by the dedicated management interface or by enabling web management capabilities on a traffic-processing (dataplane) interface.; ; All features and functionality are primarily delivered through the web interface.; This includes the initial setup, system-configuration, network-configuration, supporting objects configuration, security policy creation, monitoring and reporting.; ; A role-based access control mechanism is available if desired to restrict certain users/roles to only certain configuration functions or views.
• Web interface accessibility standard: None or don’t know
• How the web interface is accessible: The web interface is accessible either by the dedicated management interface or by enabling web management capabilities on a traffic-processing (dataplane) interface.; ; Access to this management interface can be restricted by IP address if desired.; ; Most modern browsers are supported for accessing the UI.
• Web interface accessibility testing: None
• API: Yes
• What users can and can't do using the API: The RESTful API has near full-functionality of what is available through the command-line interface (CLI) or the web-interface. The API can be used to program practically any aspect of the platform and then be used to monitor and report the health and data the platform itself holds. The API can also be used to “Bootstrap” or provision the NGFW to cut-down on deployment time. There are prebuilt examples of using the API to integrate with other third-party services to streamline operations and improve efficiency.
• API automation tools:
  • Ansible
  • Chef
  • OpenStack
  • SaltStack
  • Terraform
  • Puppet
  • Other
• Other API automation tools: Python
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• Command line interface: Yes
• Command line interface compatibility:
  • Linux or Unix
  • Windows
  • MacOS
  • Other
• Using the command line interface: The command-line interface (CLI) used by the NGFW is accessible via telnet, SSH and serial. The CLI can be utilised to configure and manage all aspects of the platform. The CLI has two primary operating modes, an “operator” read-only mode which is used to display information and configuration, the other being a “configurator” read-write mode which can be used to make configuration changes. The CLI also supports role-based access control (RBAC) allowing for more granular control over what can and cannot be done per user.

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: Cloud-delivered NGFW are deployed in a public cloud environment, each service user has their own resources dedicated to them in the public cloud environment. There is no "shared tenancy" capability
• Usage notifications: Yes
• Usage reporting:
  • API
  • Email
  • Other

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Palo Alto Networks

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Service are supplied from Google and Amazon Data centers (further information to follow); Google Security statement; https://cloud.google.com/security/overview/ ; https://cloud.google.com/security/; ; AWS Security Statement; https://aws.amazon.com/compliance/data-center/controls/ ; https://d1.awsstatic.com/whitepapers/aws-security-whitepaper; https://aws.amazon.com/compliance/data-center/data-centers/; ; All logs can be stored in the customer's instance of a Palo Alto Networks' Cortex Data Lake, user activity is monitored and stored in the Cortex data lake for the agreed retention period.
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
  • Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Only data within the service provided can be backedup
  • Only data within the service provided can be restored
  • No external entity can be backed up/restored
• Backup controls: The service configuration can be backed up via API on demand or via the CLI or web interface.; The central managed platform (Panorama) can be scheduled to export configuration data of managed devices via SCP or FTP to an external storage repository.
• Datacentre setup:
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
  • Single datacentre with multiple copies
  • Single datacentre
• Scheduling backups: Users schedule backups through a web interface
• Backup recovery: Users can recover backups themselves, for example through a web interface

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: Palo Alto Networks uses standard encryption for telemetry and update services, with separate deployment-specific certificates
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: N/A - responsibility of the cloud provider
• Approach to resilience: N/A - responsibility of the cloud provider, and also dependent on the configuration of the NGFW deployment
• Outage reporting: Not Applicable

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Users predominately authenticate using a username and password combination, a role-based access control (RBAC) system is in place to specify what each user has access too.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Accredited by PECB MS
• ISO/IEC 27001 accreditation date: 25/08/2021
• What the ISO/IEC 27001 doesn’t cover: Nothing
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: For Certifications see: www.paloaltonetworks.com/legal-notices/trust-center/technical-certifications

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Palo Alto Networks has a formal Enterprise Risk Management program, which includes the performance of an annual risk assessment, with periodic updates, as applicable, to identify and assess key risks and their mitigation approaches. The scope of the program encompasses information security risks and product risks. Our security program consists of a risk-based approach that includes administrative, technical and physical safeguards reasonably designed to protect the confidentiality, integrity and availability of customer data. Palo Alto Network's information security program is aligned to ISO 27001/2, and includes key controls from HIPAA, PCI and SOC2.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Both Palo Alto Networks and the end-user organisation are in full control of their relevant and respective change control processes.; Additional details are available upon request.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.; ; Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.; ; Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: This information is available upon request

Secure development

• Approach to secure software development best practice: Supplier-defined process

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: No

Energy efficiency

• Energy-efficient datacentres: No

Social Value

• Fighting climate change:

  Fighting climate change

  Fighting Climate Change - Both Palo Alto Networks and ANSecurity continuously strive to minimize the impact of our operations on the environment, while maximizing sustainable business practices to better serve our employees, customers, partners, shareholders and communities.
• Tackling economic inequality:

  Tackling economic inequality

  Tackling economic inequality - Palo Alto Networks support and strengthen our local communities by enabling employees to donate time and resources where they are most passionate, by investing in causes that have a positive social impact, and by providing skills to people around the world to help maximize their full potential. Through our giving back program, our employees have helped hundreds of students realize more of their limitless potential with consistent, hands on mentoring in life skills and academic subjects.

Pricing

• Price: £126.94 to £238.01 a unit a year
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ansecurity.com. Tell them what format you need. It will help if you say what assistive technology you use.