Re: IPS Solution

["Biddle, Rob" <Rob_Biddle () MAIL MSJ EDU>]

I'm happy with our PaloAlto purchase.  I was able to move user data from Cisco NAC into PaloAlto via the UserID API to 
get user visibility for BYOD users, which makes tracking down issues much easier.
The only additional feature we've purchased is the full GlobalProtect license, which I'm also very happy with so far.  
Initially I was just going to deploy GlobalProtect for users who specifically needed remote access.  I later decided 
that a persistent VPN connection (forcing the internet traffic through PA) for college owned devices should 
significantly reduce (no metrics yet) the likelihood of those devices downloading known malware when they leave campus, 
as well as allowing for easier remote management.
_____________________________
Rob Biddle
Network Systems Engineer / Administrator College of Mount St. Joseph


From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Benjamin 
Parker
Sent: Tuesday, February 05, 2013 11:30 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] IPS Solution

For those who have Palo Alto's what additional features are you using and do you think it is worth the added cost.

For example, we have been seeing some more encrypted botnet traffic here that I can't detect because I have not wanted 
to use the SSL decryption aspects because we don't have URL filtering so I have no way not to break the chain on things 
like legitimate banking or shopping. Are you doing things like this?  Also are you using the wildfire subscriptions, 
and are there any metrics of how cost effective it has been in blocking malware? I know their sales pitches are pretty 
spectacular regarding wildfire but is that what real world edu's are seeing?

On Tue, Feb 5, 2013 at 10:58 AM, O'Callaghan, Daniel <Daniel.OCallaghan () sinclair edu<mailto:Daniel.OCallaghan () 
sinclair edu>> wrote:
We've been using PaloAlto since 2008.  We initially piloted in 'tap only' mode in conjunction with our primary 
CheckPoint FWs, and gradually turned on blocking rules and controls of the PA as threats were identified.  In 2010, we 
completely migrated to using the PA. They provide excellent visibility and control into Internet/network traffic and 
permit really granular control over applications and protocols, and they still support 'traditional' FW rules.
The IPS features have significantly helped to reduce compromised machines, and the logging/reporting features are 
really useful to identify the few that do get compromised. We have had a couple of false positive threats detected over 
the years, but PA support has been easy to work with and very responsive.
We have SIEM, NAC, Mail filtering, etc., but the PA visibility is such that it is where I start most days...power-up 
the PC, start the coffee, check the PA traffic and threat monitor.

_________________________
Dan O'Callaghan
CISO, Sinclair Community College
937.512.2452<tel:937.512.2452>