The deterministic controls
532
Controls
184
PAN-OS
15
Panorama
17
Prisma Access
51
FortiGate
77
Check Point
69
Cisco ASA
52
Cisco FTD
29
Cisco Catalyst and Nexus
38
Cisco Meraki
142
With a CIS reference
Analyzer panos-analysis-1.32.0
Showing 532 of 532
System and Metadata
45- PAN-SEC-031 MediumNTP server missingPAN-OSCIS 1.6.2
- PAN-SEC-033 LowLogin banner missingPAN-OSCIS 1.1.2
- PAN-SEC-101 MediumAntivirus updates are not installed hourlyPAN-OSCIS 4.1
- PAN-SEC-102 MediumApplications and threats updates are not installed dailyPAN-OSCIS 4.2
- PAN-SEC-103 MediumWildFire updates are not installed in real timePAN-OSCIS 5.6
- PAN-SEC-130 MediumUpdate server identity is not verifiedPAN-OSCIS 1.6.1
- PAN-SEC-160 LowThe device is configured with a single DNS serverPAN-OS
- FGT-SEC-020 MediumStrong cryptography is disabledFortiGateCIS 2.1.9
- PAN-SW-001 MediumSoftware version is out of vendor supportPAN-OS
- FGT-SW-001 MediumSoftware version is out of vendor supportFortiGate
- FTD-MGT-007 MediumNTP missing or a single sourceCisco FTD
- FTD-MGT-009 HighSoftware release near end of maintenanceCisco FTD
- FTD-MGT-011 MediumHardware model at end of lifeCisco FTD
- FTD-MGT-012 MediumChanges on the manager not deployedCisco FTD
- FTD-MGT-018 MediumDevice health alarmsCisco FTD
- FTD-MGT-020 MediumA managed device out of contact with its managerCisco FTD
- CKP-MGT-015 MediumGlobal assignment out of dateCheck Point
- CKP-MGT-010 HighSoftware or appliance past the vendor's end of supportCheck Point
- CKP-MGT-011 CriticalVersion listed as affected by a Check Point advisoryCheck Point
- CKP-MGT-012 MediumPolicy installed more than 90 days agoCheck Point
- CKP-MGT-014 HighLicense or service contract expiredCheck Point
- CKP-MGT-019 LowGaia login banner missingCheck PointCIS 2.1.1
- CKP-MGT-020 LowGaia message of the day missingCheck PointCIS 2.1.2
- CKP-MGT-009 MediumGaia time is not synchronized to two NTP serversCheck PointCIS 2.3.1
- CKP-MGT-034 LowGaia has no DNS serverCheck PointCIS 2.1.6
- CKP-MGT-016 LowGaia boot loader has no passwordCheck Point
- CKP-MGT-038 LowGaia has no scheduled backupCheck PointCIS 2.4.3
- ASA-MGT-017 MediumNTP not authenticatedCisco ASA
- ASA-MGT-018 LowSingle NTP sourceCisco ASA
- ASA-MGT-028 LowContext in no resource classCisco ASA
- ASA-MGT-029 HighHardware past end of saleCisco ASA
- ASA-MGT-030 HighSoftware near or past end of supportCisco ASA
- ISE-MGT-009 LowAdministration node runs an older patch than one installedPAN-OS
- ISE-MGT-010 MediumNo successful configuration backup within seven daysPAN-OS
- ISE-MGT-011 MediumRepository uses a clear-text protocolPAN-OS
- ISE-MGT-012 MediumLicense out of compliance or evaluation endingPAN-OS
- ISE-MGT-017 MediumLast configuration backup attempt failedPAN-OS
- FMG-SEC-008 LowFortiManager clock is not synchronizedFortiGate
- FMG-SEC-011 MediumNo scheduled backup of the FortiManagerFortiGate
- FMG-MGT-001 MediumManaged FortiGate out of sync with the FortiManagerFortiGate
- FMG-MGT-002 LowChanges on the FortiManager not installed on a FortiGateFortiGate
- FMG-MGT-003 MediumManaged FortiGate disconnected from the FortiManagerFortiGate
- FMG-MGT-006 MediumFortiGate runs a newer FortiOS than its ADOMFortiGate
- FMG-SW-001 MediumFortiManager software version is out of vendor supportFortiGate
- MRK-MGT-009 MediumLicensing needs attentionCisco Meraki
Administrators and Access
101- PAN-SEC-026 CriticalManagement access allows HTTP or TelnetPAN-OSCIS 1.2.4
- PAN-SEC-028 MediumMore superuser administrators than a small team needsPAN-OS
- PAN-SEC-029 HighWell known administrator account is active with full privilegePAN-OS
- PAN-SEC-046 MediumAdministrator has no central authentication profilePAN-OS
- PAN-SEC-096 MediumManagement interface accepts HTTPS or SSH from any addressPAN-OSCIS 1.2.1
- PAN-SEC-097 CriticalManagement interface allows HTTP or TelnetPAN-OSCIS 1.2.3
- PAN-SEC-118 MediumMinimum password complexity is not enabledPAN-OSCIS 1.3.1
- PAN-SEC-119 MediumMinimum password length is below 12PAN-OSCIS 1.3.2
- PAN-SEC-120 LowPasswords need no uppercase letterPAN-OSCIS 1.3.3
- PAN-SEC-121 LowPasswords need no lowercase letterPAN-OSCIS 1.3.4
- PAN-SEC-122 LowPasswords need no digitPAN-OSCIS 1.3.5
- PAN-SEC-123 LowPasswords need no special characterPAN-OSCIS 1.3.6
- PAN-SEC-124 LowPasswords do not expire within 90 daysPAN-OSCIS 1.3.7
- PAN-SEC-125 LowA new password may differ from the old by fewer than 3 charactersPAN-OSCIS 1.3.8
- PAN-SEC-126 LowFewer than 24 previous passwords are blocked from reusePAN-OSCIS 1.3.9
- PAN-SEC-127 LowPassword profile expires passwords later than 90 days, or neverPAN-OSCIS 1.3.10
- PAN-SEC-128 MediumAdministrative idle timeout is longer than 10 minutesPAN-OSCIS 1.4.1
- FGT-SEC-013 CriticalHTTP or Telnet administration allowed on an interfaceFortiGateCIS 2.4.5
- FGT-SEC-014 HighAdministrator may log in from any addressFortiGateCIS 2.4.2
- FGT-SEC-015 MediumDefault administrator account admin is presentFortiGateCIS 2.4.1
- FGT-SEC-017 LowAdministration listens on the default portsFortiGateCIS 2.4.7
- FGT-SEC-018 LowAdministrator idle timeout above 15 minutesFortiGateCIS 2.4.4
- FGT-SEC-019 MediumAdministration accepts TLS below 1.2FortiGateCIS 2.1.10
- FTD-MGT-001 CriticalSSH to the device allowed from any addressCisco FTD
- FTD-MGT-002 HighHTTPS management allowed from any address or the outsideCisco FTD
- FTD-MGT-003 HighTelnet management enabledCisco FTD
- FTD-MGT-008 LowNo login bannerCisco FTD
- FTD-MGT-014 MediumNo external authentication for the device CLICisco FTD
- FTD-MGT-015 LowManagement session timeouts too longCisco FTD
- FTD-MGT-016 HighWeak TLS for management or VPNCisco FTD
- FTD-MGT-019 MediumSeveral local CLI users with Config accessCisco FTD
- CKP-MGT-001 HighSmartConsole trusted clients allow AnyCheck Point
- CKP-MGT-002 HighManagement API accepts calls from every addressCheck Point
- CKP-MGT-003 MediumExpired administrator account still presentCheck Point
- CKP-MGT-004 HighSuper User signs in with a local passwordCheck Point
- CKP-MGT-007 MediumInternal user passwords may be shorter than 12 charactersCheck Point
- CKP-MGT-005 HighGaia accepts administration from any hostCheck PointCIS 2.5.5
- CKP-MGT-006 MediumGaia SSH server allows weak settingsCheck Point
- CKP-MGT-017 LowGaia CLI session never times out or times out after more than 10 minutesCheck PointCIS 2.5.1
- CKP-MGT-018 LowGaia Portal session times out after more than 10 minutesCheck PointCIS 2.5.2
- CKP-MGT-031 MediumGaia minimum password length below 14Check PointCIS 1.1
- CKP-MGT-021 LowGaia allows palindrome passwordsCheck PointCIS 1.2
- CKP-MGT-022 LowGaia password complexity below three character typesCheck PointCIS 1.3
- CKP-MGT-023 LowGaia password reuse check off or shorter than 12Check PointCIS 1.4
- CKP-MGT-024 LowGaia passwords do not expire within 90 daysCheck PointCIS 1.5
- CKP-MGT-025 LowGaia warns fewer than 7 days before a password expiresCheck PointCIS 1.6
- CKP-MGT-029 LowGaia does not lock unused accountsCheck PointCIS 1.8
- CKP-MGT-030 LowGaia allows more than 30 days of non-use before lockCheck PointCIS 1.9
- CKP-MGT-026 MediumGaia does not lock accounts after failed loginsCheck PointCIS 1.11
- CKP-MGT-027 LowGaia allows more than 5 failed loginsCheck PointCIS 1.12
- CKP-MGT-028 LowGaia unlocks an account in under 300 secondsCheck PointCIS 1.13
- CKP-MGT-039 MediumGaia administrators are not authenticated by RADIUS or TACACS+Check PointCIS 2.5.4
- ASA-SEC-016 LowICMP to the device allowed from any address on an untrusted interfaceCisco ASACIS 2.5
- ASA-MGT-001 CriticalASDM and HTTPS management exposedCisco ASA
- ASA-MGT-002 CriticalSSH management exposedCisco ASA
- ASA-MGT-003 HighTelnet management enabledCisco ASACIS 1.6.5
- ASA-MGT-004 MediumManagement on a data interfaceCisco ASA
- ASA-MGT-005 HighSSH version 1 allowedCisco ASACIS 1.6.2
- ASA-MGT-006 HighWeak TLS for management and SSL VPNCisco ASA
- ASA-MGT-007 MediumSSH key exchange with SHA-1Cisco ASA
- ASA-MGT-008 MediumConsole timeout too longCisco ASACIS 1.8.1
- ASA-MGT-009 LowSSH timeout too longCisco ASACIS 1.8.2
- ASA-MGT-010 LowASDM idle timeout too longCisco ASACIS 1.8.3
- ASA-MGT-011 HighWeak or default stored passwordCisco ASA
- ASA-MGT-012 HighDefault or generic local accountCisco ASACIS 1.4.1.3
- ASA-MGT-013 LowBanner missingCisco ASA
- ASA-MGT-025 MediumNo master passphraseCisco ASACIS 1.1.3
- ISE-MGT-001 HighTACACS+ command set permits every commandPAN-OS
- ISE-MGT-002 MediumTACACS+ command set permits every command it does not listPAN-OS
- ISE-MGT-003 HighPrivilege 15 shell profile on a broad rulePAN-OS
- ISE-MGT-004 LowNetwork device without TACACS+ settingsPAN-OS
- ISE-MGT-013 MediumMore Super Admin accounts than neededPAN-OS
- ISE-MGT-014 LowSeveral local administrators with Inactive account never disabledPAN-OS
- ISE-MGT-015 LowEvery administrator is a local accountPAN-OS
- FMG-SEC-001 HighFortiManager administrator may log in from any addressFortiGate
- FMG-SEC-002 MediumLocal FortiManager administrator without a second factorFortiGate
- FMG-SEC-003 HighHTTP or Telnet administration allowed on a FortiManager interfaceFortiGate
- FMG-SEC-004 LowFortiManager administrator sessions stay open more than 15 minutes when idleFortiGate
- FMG-SEC-005 LowFortiManager lockout allows more than five failed loginsFortiGate
- FMG-SEC-006 MediumFortiManager password policy is offFortiGate
- FMG-SEC-007 MediumFortiManager accepts TLS below 1.2 or low-strength ciphersFortiGate
- FMG-MGT-007 LowFortiManager workspace mode is offFortiGate
- SW-MGT-001 HighTelnet accepted for switch managementCisco Catalyst and NexusCIS 1.2.2
- SW-MGT-002 MediumManagement lines open to any source addressCisco Catalyst and NexusCIS 1.2.5
- SW-MGT-003 MediumManagement session timeout disabled or longCisco Catalyst and Nexus
- SW-MGT-004 MediumSSH version 1 not refusedCisco Catalyst and NexusCIS 2.1.1.2
- SW-MGT-005 MediumPlain HTTP management enabledCisco Catalyst and Nexus
- SW-MGT-006 HighEnable password stored in clear text or reversible formCisco Catalyst and NexusCIS 1.4.1
- SW-MGT-007 MediumPassword hashed with MD5 (type 5)Cisco Catalyst and Nexus
- SW-MGT-008 HighLocal account password stored in clear text or reversible formCisco Catalyst and NexusCIS 1.4.3
- SW-MGT-011 LowNo login bannerCisco Catalyst and NexusCIS 1.3.2
- SW-MGT-012 MediumManagement line without authenticationCisco Catalyst and Nexus
- MX-MGT-001 HighAppliance management reachable from any addressCisco Meraki
- MX-MGT-002 MediumLocal status page without authenticationCisco Meraki
- MRK-MGT-001 HighTwo-factor authentication not enforced for the organizationCisco Meraki
- MRK-MGT-002 MediumFull administrator without two-factor authenticationCisco Meraki
- MRK-MGT-003 LowMany full organization administratorsCisco Meraki
- MRK-MGT-004 MediumAdministrator inactive for a long timeCisco Meraki
- MRK-MGT-005 MediumAPI keys usable from any addressCisco Meraki
- MRK-MGT-006 LowAccount lockout not enforcedCisco Meraki
- MRK-MGT-007 LowDashboard sign-in not limited by addressCisco Meraki
Certificates and PKI
7- PAN-SEC-047 HighCertificate has passed its validity datePAN-OS
- PAN-SEC-048 MediumCertificate expires within the renewal windowPAN-OS
- PAN-SEC-049 MediumTLS service profile names a certificate that is not definedPAN-OS
- PAN-SEC-050 MediumTLS service profile permits an obsolete protocol versionPAN-OS
- PAN-SEC-116 MediumCertificate profile checks no revocationPAN-OS
- ISE-MGT-007 HighSystem certificate expired or expiring within 90 daysPAN-OS
- ISE-MGT-008 MediumSelf-signed certificate used for Admin or EAPPAN-OS
Interfaces and Segmentation
36- PAN-SEC-027 HighInterface management profile has no permitted IP restrictionPAN-OSCIS 1.2.2
- PAN-SEC-044 MediumZone has interfaces and no zone protection profilePAN-OS
- PAN-SEC-045 LowAddressed interface belongs to no security zonePAN-OS
- PAN-SEC-098 MediumManagement services enabled on an interface in an internet-facing zonePAN-OS
- PAN-SEC-105 MediumUser-ID is enabled on an internet-facing zonePAN-OSCIS 2.3
- FGT-SEC-012 HighAdministration enabled on a WAN interfaceFortiGateCIS 1.3
- FGT-SEC-016 MediumWAN administration with no local-in policy on the interfaceFortiGateCIS 2.4.6
- FTD-SEC-027 MediumNamed interface without a security zoneCisco FTD
- FTD-SEC-028 LowAnti-spoofing off on the internet-facing interfaceCisco FTD
- CKP-SEC-018 HighAnti-spoofing off or detect onlyCheck PointCIS 3.12
- CKP-SEC-022 LowInternal interface topology calculated from routesCheck Point
- ASA-SEC-003 MediumInterface with no inbound access listCisco ASA
- ASA-SEC-010 LowUnused interface not shut downCisco ASACIS 1.2.4
- ASA-SEC-011 LowProxy ARP on an untrusted interfaceCisco ASACIS 2.2
- ASA-SEC-013 LowSame security level traffic permittedCisco ASA
- ISE-SEC-014 LowCustom SGACL permits all trafficPAN-OS
- ISE-SEC-015 MediumEnforced egress matrix cell permits all trafficPAN-OS
- ISE-SEC-016 MediumSXP connection without a passwordPAN-OS
- SW-SEC-006 MediumEdge ports without BPDU guardCisco Catalyst and Nexus
- SW-SEC-007 MediumPorts negotiating trunking (DTP)Cisco Catalyst and Nexus
- SW-SEC-008 MediumTrunk native VLAN is VLAN 1Cisco Catalyst and Nexus
- SW-SEC-009 LowTrunk carries every VLANCisco Catalyst and Nexus
- SW-SEC-010 MediumUser ports in the default VLANCisco Catalyst and Nexus
- SW-SEC-011 MediumDHCP snooping not enabledCisco Catalyst and Nexus
- SW-SEC-012 LowDynamic ARP inspection not enabledCisco Catalyst and Nexus
- SW-SEC-016 LowVTP in server or client modeCisco Catalyst and Nexus
- SW-SEC-017 MediumvPC peer link with no separate peer keepaliveCisco Catalyst and Nexus
- MS-SEC-001 MediumAccess ports without BPDU guardCisco Meraki
- MS-SEC-002 MediumTrunk native VLAN is VLAN 1Cisco Meraki
- MS-SEC-003 LowTrunk carries every VLANCisco Meraki
- MS-SEC-004 MediumUser ports in the default VLANCisco Meraki
- MS-SEC-005 MediumDHCP guard allows any DHCP serverCisco Meraki
- MS-SEC-006 LowDynamic ARP inspection offCisco Meraki
- MS-SEC-008 MediumRSTP disabledCisco Meraki
- MR-SEC-004 MediumGuest-style SSID bridged into the LANCisco Meraki
- MX-MGT-004 LowSpoofing protection not blockingCisco Meraki
Routing and Network Services
9- PAN-SEC-056 MediumPolicy-based forwarding rule has no path monitoringPAN-OS
- PAN-SEC-057 MediumTwo static routes to one destination with the same metricPAN-OS
- PAN-SEC-058 MediumExternal BGP peer has no authenticationPAN-OS
- PAN-SEC-166 LowA DHCP server is configured on an internet-facing zonePAN-OS
- PAN-SEC-167 MediumA DNS proxy is configured on an internet-facing zonePAN-OS
- ASA-SEC-018 MediumBGP neighbor without authenticationCisco ASACIS 2.1.3
- ASA-SEC-019 MediumRouting protocol without authenticationCisco ASA
- SW-SEC-014 LowIP source routing enabledCisco Catalyst and NexusCIS 3.1.1
- SW-SEC-015 LowTCP and UDP small servers enabledCisco Catalyst and Nexus
High Availability
18- PAN-SEC-060 MediumConfigured HA group has no path monitoringPAN-OS
- PAN-SEC-061 MediumConfigured HA group monitors no linksPAN-OS
- PAN-SEC-062 MediumConfigured HA control link has no backupPAN-OS
- PAN-SEC-063 HighConfigured HA group does not synchronize configurationPAN-OS
- PAN-SEC-113 LowConfigured HA group is preemptive or shuts the passive link downPAN-OSCIS 3.3
- FTD-SEC-029 MediumFailover link not encryptedCisco FTD
- FTD-SEC-030 HighHA pair not Active and Standby ReadyCisco FTD
- FTD-SEC-031 LowHA pair does not monitor every data interfaceCisco FTD
- FTD-MGT-021 MediumThe two units of an HA pair run different softwareCisco FTD
- CKP-MGT-013 HighCluster member not Active or StandbyCheck Point
- ASA-SEC-033 HighFailover link without a keyCisco ASA
- ASA-SEC-034 MediumFailover interface without a standby address or monitoringCisco ASA
- ASA-SEC-035 LowNo stateful failoverCisco ASA
- ASA-SEC-036 HighCluster control link without a keyCisco ASA
- ASA-MGT-024 LowNo failoverCisco ASACIS 1.2.3
- ISE-MGT-005 MediumPrimary Administration node has no secondaryPAN-OS
- ISE-MGT-006 MediumOnly one Policy Service nodePAN-OS
- FMG-SEC-012 LowFortiManager runs without high availabilityFortiGate
Security Policies
80- PAN-SEC-001 CriticalAllow rule matches any source and any destinationPAN-OS
- PAN-SEC-002 HighAllow rule matches any applicationPAN-OS
- PAN-SEC-003 HighAllow rule matches any servicePAN-OSCIS 7.2
- PAN-SEC-004 LowDisabled rule left in the rulebasePAN-OS
- PAN-SEC-005 LowRule has no description and no tagPAN-OS
- PAN-SEC-006 MediumTemporary rule with no schedule or expiryPAN-OS
- PAN-SEC-007 HighAllow rule with logging fully disabledPAN-OS
- PAN-SEC-008 MediumRule does not log at session endPAN-OS
- PAN-SEC-009 MediumRule has no log forwarding profilePAN-OS
- PAN-SEC-019 MediumEarlier rule covers this rule with different behaviorPAN-OS
- PAN-SEC-020 LowRule is redundantPAN-OS
- PAN-SEC-021 HighBroad allow rule generalizes earlier specific rulesPAN-OS
- PAN-SEC-022 HighPermissive allow rule is evaluated before restrictive rulesPAN-OS
- PAN-SEC-040 MediumTwo rules are exact duplicatesPAN-OS
- PAN-SEC-041 LowTwo rules differ in one dimension and could be reviewed for consolidationPAN-OS
- PAN-SEC-042 LowDuplicate rules log differentlyPAN-OS
- PAN-SEC-094 LowEnabled rule names a zone only a disabled tunnel feedsPAN-OS
- PAN-SEC-095 LowRules can be merged without changing what they permitPAN-OS
- PAN-SEC-104 MediumBuilt-in interzone default rule does not logPAN-OSCIS 7.4
- PAN-SEC-110 MediumNo deny rule names the Palo Alto Networks threat IP listsPAN-OSCIS 7.3
- PAN-SEC-164 MediumAn application override rule is configured to bypass App-IDPAN-OS
- FGT-SEC-001 CriticalAccept policy from every address to every addressFortiGate
- FGT-SEC-002 MediumAccept policy on service ALLFortiGateCIS 3.2
- FGT-SEC-003 MediumAccept policy does not log its trafficFortiGateCIS 3.4
- FGT-SEC-007 LowDisabled policy left in the tableFortiGate
- FGT-SEC-008 MediumPolicy covered by an earlier policyFortiGate
- PAN-SEC-170 LowEnabled rule with no hit in the counted windowPAN-OS
- FTD-SEC-001 HighDefault action allows unmatched trafficCisco FTD
- FTD-SEC-002 MediumDefault action does not logCisco FTD
- FTD-SEC-003 CriticalAllow rule with no conditionCisco FTD
- FTD-SEC-005 HighBroad Trust rule bypasses inspectionCisco FTD
- FTD-SEC-007 MediumRule does not logCisco FTD
- FTD-SEC-008 LowDisabled rule left in the policyCisco FTD
- FTD-SEC-009 LowRule with zero hits in the collected counterCisco FTD
- FTD-SEC-010 MediumRule covered by an earlier ruleCisco FTD
- FTD-SEC-011 HighCleartext or legacy service allowedCisco FTD
- FTD-SEC-012 CriticalRemote administration port open from the internet sideCisco FTD
- FTD-SEC-013 HighBroad prefilter Fastpath ruleCisco FTD
- FTD-SEC-020 LowAllow rule without a zoneCisco FTD
- CKP-SEC-001 HighAccept rule on Any serviceCheck PointCIS 3.7
- CKP-SEC-002 CriticalAccept rule from Any to Any on Any serviceCheck PointCIS 3.5
- CKP-SEC-003 HighAccept rule from Any source to internal or DMZ hostsCheck PointCIS 3.6
- CKP-SEC-004 MediumAccept rule does not logCheck PointCIS 3.8
- CKP-SEC-005 HighLayer has no logged cleanup ruleCheck PointCIS 3.2
- CKP-SEC-006 HighOrdered layer accepts what no rule matchedCheck Point
- CKP-SEC-007 LowDisabled rule kept in the policyCheck Point
- CKP-SEC-008 HighGateway reachable from AnyCheck PointCIS 3.1
- CKP-SEC-009 LowRule with no hits over the counting windowCheck Point
- CKP-SEC-010 HighAccept rule allows a clear-text protocolCheck Point
- CKP-SEC-011 HighInline layer accepts what its rules did not matchCheck Point
- CKP-SEC-012 HighAccept rule to Any destination on a lateral movement serviceCheck Point
- CKP-SEC-015 MediumRule covered by an earlier ruleCheck Point
- CKP-SEC-016 MediumImplied rules are not loggedCheck PointCIS 3.9
- CKP-SEC-017 MediumImplied rule accepts ICMP requestsCheck PointCIS 3.17
- CKP-SEC-031 MediumImplied rule accepts DNS queries over UDPCheck PointCIS 3.16
- CKP-SEC-032 MediumImplied rule accepts DNS zone transfers over TCPCheck PointCIS 3.15
- CKP-SEC-033 MediumImplied rule accepts RIPCheck PointCIS 3.14
- CKP-SEC-034 LowImplied rule accepts DHCP and DNS to the gatewayCheck Point
- CKP-SEC-019 MediumOut of state TCP packets are not droppedCheck PointCIS 3.10
- CKP-SEC-035 MediumOut of state ICMP packets are not droppedCheck PointCIS 3.11
- CKP-SEC-036 LowHit count is offCheck PointCIS 3.4
- ASA-SEC-001 CriticalInbound entry allows any destination or any serviceCisco ASA
- ASA-SEC-002 Highpermit ip any any entryCisco ASA
- ASA-SEC-004 LowUntrusted inbound list without an explicit logged denyCisco ASACIS 3.12
- ASA-SEC-005 MediumEntry covered by an earlier entryCisco ASA
- ASA-SEC-006 LowInactive entry left in a listCisco ASA
- ASA-SEC-009 HighRemote administration, file sharing or database port open inboundCisco ASA
- ASA-SEC-022 MediumEtherType list permits any EtherTypeCisco ASA
- ISE-SEC-001 HighAuthorization rule grants open access with no conditionPAN-OS
- ISE-SEC-002 HighDefault authorization rule grants open accessPAN-OS
- ISE-SEC-003 HighMAB rule grants open accessPAN-OS
- ISE-SEC-004 HighException rule grants open access ahead of the policyPAN-OS
- ISE-SEC-005 HighGuest result reaches the network with nothing narrowing itPAN-OS
- ISE-SEC-007 LowRule with zero hits in the ISE counterPAN-OS
- ISE-SEC-008 LowDisabled rule left in the policyPAN-OS
- FMG-MGT-004 LowManaged FortiGate with no policy package installedFortiGate
- FMG-MGT-005 LowPolicy package installed on no FortiGateFortiGate
- MX-SEC-001 HighFirewall rule allows any source to any destinationCisco Meraki
- MX-SEC-002 LowOutbound policy has no deny rulesCisco Meraki
- MRK-SEC-002 MediumSite-to-site VPN firewall allows everythingCisco Meraki
NAT
9- PAN-SEC-023 CriticalInbound destination NAT may lack a restrictive security rulePAN-OS
- PAN-SEC-024 HighDestination NAT published with a broad servicePAN-OS
- PAN-SEC-025 HighBidirectional static source NAT creates an implicit inbound pathPAN-OS
- FGT-SEC-010 MediumVIP published to every source on every serviceFortiGate
- FGT-SEC-011 MediumVIP forwards every portFortiGate
- FTD-SEC-021 HighStatic NAT publishes a host an inbound rule reachesCisco FTD
- FTD-SEC-022 MediumBroad manual NAT before auto NATCisco FTD
- MX-SEC-003 HighSensitive service published to any addressCisco Meraki
- MX-SEC-004 MediumPublished service open to any addressCisco Meraki
Decryption
8- PAN-SEC-014 MediumNo decryption policy covering outbound trafficPAN-OSCIS 8.1
- PAN-SEC-089 MediumDecryption profile permits a TLS version with published breaksPAN-OS
- PAN-SEC-090 MediumDecryption profile permits an invalid server certificatePAN-OS
- PAN-SEC-091 MediumDecryption rule excludes a high-risk URL category from decryptionPAN-OS
- PAN-SEC-106 MediumDecryption profile permits a legacy cipher, hash or key exchangePAN-OS
- PAN-SEC-107 LowDecryption profile lets undecryptable forward proxy sessions throughPAN-OS
- PAN-SEC-134 MediumDecrypted content is not forwarded to WildFirePAN-OSCIS 5.3
- FTD-SEC-017 MediumNo TLS decryption policyCisco FTD
Security Profiles
48- PAN-SEC-010 HighAllow rule without any security profilePAN-OSCIS 6.7
- PAN-SEC-011 CriticalInbound internet rule without threat preventionPAN-OSCIS 6.7
- PAN-SEC-012 HighOutbound internet rule without URL filteringPAN-OSCIS 6.12
- PAN-SEC-013 MediumAllow rule without WildFire analysisPAN-OSCIS 5.2
- PAN-SEC-043 MediumProfile group is missing part of the recommended baselinePAN-OS
- PAN-SEC-085 MediumURL filtering profile alerts on or allows a high-risk categoryPAN-OS
- PAN-SEC-086 MediumWildFire analysis profile forwards a narrowed set of file types or one directionPAN-OS
- PAN-SEC-087 MediumAnti-spyware profile has DNS lists and nothing set to sinkholePAN-OSCIS 6.4
- PAN-SEC-088 MediumAnti-spyware profile sinkholes DNS queries to no addressPAN-OSCIS 6.4
- PAN-SEC-099 MediumVulnerability protection profile does not block critical or high severityPAN-OSCIS 6.6
- PAN-SEC-100 MediumAnti-spyware profile does not block every severityPAN-OSCIS 6.3
- PAN-SEC-133 LowWildFire file size limit is below the documented defaultPAN-OSCIS 5.1
- PAN-SEC-135 LowWildFire session information is not all sentPAN-OSCIS 5.4
- PAN-SEC-136 MediumAntivirus profile does not reset both sides on every decoderPAN-OSCIS 6.1
- PAN-SEC-137 LowURL filtering profile allows categories without loggingPAN-OSCIS 6.10
- PAN-SEC-138 LowURL filtering profile does not log every HTTP header fieldPAN-OSCIS 6.11
- FGT-SEC-004 MediumAccept policy inspects nothingFortiGate
- FGT-SEC-005 MediumInternet-facing accept policy without an IPS sensorFortiGateCIS 4.1.2
- FGT-SEC-006 LowAccept policy without application controlFortiGateCIS 4.5.4
- PAN-LIC-001 MediumFeature is configured and no valid license backs itPAN-OS
- FGT-LIC-001 MediumFeature is configured and no valid license backs itFortiGate
- FTD-SEC-004 HighAllow rule without an intrusion policyCisco FTD
- FTD-SEC-006 MediumInbound allow rule without a file policyCisco FTD
- FTD-SEC-014 HighIntrusion policy in detection modeCisco FTD
- FTD-SEC-015 HighIntrusion policy built on a weak baseCisco FTD
- FTD-SEC-016 MediumVariable set leaves HOME_NET as anyCisco FTD
- FTD-SEC-018 MediumSecurity Intelligence block list missingCisco FTD
- FTD-SEC-019 MediumHigh-risk URL categories not blockedCisco FTD
- FTD-MGT-013 HighLicensing not compliant or features unlicensedCisco FTD
- FTD-MGT-017 MediumThreat content updates staleCisco FTD
- CKP-SEC-023 HighInternet-facing gateway with no Threat Prevention bladeCheck Point
- CKP-SEC-024 HighThreat Prevention blade on and no Threat Prevention policy installedCheck Point
- CKP-SEC-025 HighThreat profile only detects high confidence protectionsCheck Point
- CKP-SEC-026 MediumHTTPS inspection off with content blades onCheck Point
- CKP-SEC-027 LowThreat profile leaves protections inactiveCheck Point
- CKP-SEC-029 LowApplication Control or URL Filtering on and no layer uses itCheck Point
- ASA-SEC-017 MediumDefault inspection missing or weakenedCisco ASACIS 3.4
- ASA-SEC-021 MediumInspection module fails open or only monitorsCisco ASA
- FTD-LIC-002 MediumLicense has ended or ends within 90 daysCisco FTD
- ASA-LIC-001 MediumFeature is configured and no valid license backs itCisco ASA
- ASA-LIC-002 MediumLicense has ended or ends within 90 daysCisco ASA
- ASA-LIC-003 MediumDevice runs on an evaluation licenseCisco ASA
- CKP-LIC-001 MediumBlade is enabled and no valid license backs itCheck Point
- CKP-LIC-002 MediumLicense ends within 31 to 90 daysCheck Point
- CKP-LIC-003 MediumDevice runs on an evaluation licenseCheck Point
- MX-SEC-005 MediumIntrusion prevention not blockingCisco Meraki
- MX-SEC-006 MediumAdvanced Malware Protection disabledCisco Meraki
- MX-SEC-007 LowContent filtering blocks no categoryCisco Meraki
DoS and Zone Protection
9- PAN-SEC-059 MediumZone protection profile enables no protectionPAN-OS
- PAN-SEC-081 MediumDoS protection rule protects with no profilePAN-OS
- PAN-SEC-082 LowDoS protection rule is disabledPAN-OS
- PAN-SEC-108 MediumInternet-facing zone's protection profile leaves a flood type unprotectedPAN-OSCIS 6.16
- PAN-SEC-109 LowInternet-facing zone's protection profile has no reconnaissance protectionPAN-OSCIS 6.17
- ASA-SEC-012 LowDNS Guard offCisco ASACIS 2.3
- ASA-SEC-014 MediumNo reverse path verification on an untrusted interfaceCisco ASACIS 3.7
- ASA-SEC-015 MediumThreat detection offCisco ASA
- ASA-SEC-020 LowPublished server without connection limitsCisco ASACIS 3.5
Objects
15- PAN-SEC-015 LowDuplicate address objects with the same valuePAN-OS
- PAN-SEC-016 ObservationObject is defined but never referencedPAN-OS
- PAN-SEC-017 HighAddress group is dangerously broadPAN-OS
- PAN-SEC-018 CriticalAllow rule uses an object that resolves to the whole internetPAN-OS
- PAN-SEC-034 HighConfiguration references an object that does not existPAN-OS
- PAN-SEC-035 LowGroup has no membersPAN-OS
- PAN-SEC-036 HighGroup contains itself through a chain of nested groupsPAN-OS
- PAN-SEC-037 MediumOne object name is defined at more than one scopePAN-OS
- PAN-SEC-038 LowPolicy field holds a literal address instead of a named objectPAN-OS
- PAN-SEC-039 LowTwo address objects overlap under different namesPAN-OS
- PAN-SEC-163 MediumAn external dynamic list is configured without server authenticationPAN-OS
- CKP-SEC-013 MediumService with a wide port range or a long session timeoutCheck Point
- CKP-SEC-014 LowUnused or empty objectCheck Point
- ASA-SEC-007 LowAccess list nothing namesCisco ASA
- ASA-SEC-008 ObservationObject no entry namesCisco ASA
IPSec VPN
32- PAN-SEC-051 HighIKE crypto profile offers a weak algorithmPAN-OS
- PAN-SEC-052 HighIPSec crypto profile offers a weak algorithmPAN-OS
- PAN-SEC-053 MediumIKE gateway is configured for IKEv1PAN-OS
- PAN-SEC-054 LowIPSec tunnel has no tunnel monitoringPAN-OS
- PAN-SEC-055 LowIKE gateway has dead peer detection disabledPAN-OS
- PAN-SEC-092 LowWeak crypto profile is used by no gateway or tunnelPAN-OS
- PAN-SEC-093 MediumEnabled IPSec tunnel has no route into itPAN-OS
- PAN-SEC-141 MediumPrisma Access infrastructure subnet overlaps a reserved rangePrisma Access
- PAN-SEC-142 LowPrisma Access infrastructure subnet is smaller than a /24Prisma Access
- PAN-SEC-143 MediumPrisma Access remote network subnet overlaps another networkPrisma Access
- PAN-SEC-144 LowPrisma Access site receives a default route from Prisma AccessPrisma Access
- PAN-SEC-145 MediumPrisma Access service connection summarizes mobile user routes while remote networks existPrisma Access
- PAN-SEC-146 MediumPrisma Access service connection has no secondary tunnel or backupPrisma Access
- PAN-SEC-147 ObservationPrisma Access sends mobile user internet traffic to the data centersPrisma Access
- PAN-SEC-148 MediumPrisma Access BGP session has no secretPrisma Access
- PAN-SEC-149 MediumPrisma Access internal DNS server is 127.0.0.1Prisma Access
- PAN-SEC-150 LowPrisma Access has service connections and no internal domainsPrisma Access
- PAN-SEC-155 LowPrisma Access infrastructure BGP AS is not a private ASPrisma Access
- FGT-SEC-021 MediumIPsec proposal with a weak algorithm or DH groupFortiGate
- FGT-SEC-022 LowIPsec gateway on IKEv1FortiGate
- FGT-SEC-028 MediumIPsec dial-up in aggressive mode or on a shared pre-shared key aloneFortiGate
- FTD-SEC-023 HighSite-to-site VPN accepts IKEv1Cisco FTD
- FTD-SEC-024 HighWeak IKE or IPsec algorithmsCisco FTD
- FTD-SEC-025 MediumIPsec without Perfect Forward SecrecyCisco FTD
- CKP-SEC-020 HighVPN community with weak IKE settingsCheck Point
- CKP-SEC-021 MediumVPN community uses a pre-shared secretCheck Point
- ASA-SEC-023 HighWeak IKE policyCisco ASA
- ASA-SEC-024 HighWeak IPsec transform set or proposalCisco ASA
- ASA-SEC-025 MediumSite-to-site tunnel without Perfect Forward SecrecyCisco ASA
- ASA-SEC-030 MediumVPN traffic not filtered by an access listCisco ASA
- ASA-SEC-031 ObservationSite-to-site peer authenticated with a pre-shared keyCisco ASA
- MRK-SEC-001 HighThird-party VPN peer with weak cryptographyCisco Meraki
Remote access VPN
24- PAN-SEC-067 HighGlobalProtect agent configuration saves user credentialsPAN-OSAlso on Prisma Access
- PAN-SEC-068 MediumGlobalProtect gateway excludes the default route from the tunnelPAN-OSAlso on Prisma Access
- PAN-SEC-069 MediumGlobalProtect gateway is configured without a client certificate requirementPAN-OS
- PAN-SEC-111 MediumGlobalProtect presents a certificate that is expired, expiring or self-signedPAN-OSCIS 1.6.3
- PAN-SEC-112 MediumGlobalProtect accepts a TLS version below 1.2PAN-OS
- PAN-SEC-139 MediumPrisma Access mobile user IP pool overlaps another networkPrisma Access
- PAN-SEC-140 LowPrisma Access mobile user IP pool is smaller than a /23Prisma Access
- PAN-SEC-151 MediumPrisma Access agent profile does not collect HIP dataPrisma Access
- PAN-SEC-152 LowPrisma Access tunnel profile allows direct access to the local networkPrisma Access
- PAN-SEC-153 LowPrisma Access agent connects only on demandPrisma Access
- PAN-SEC-154 MediumPrisma Access tunnel profile excludes a route broader than an included onePrisma Access
- FGT-SEC-023 MediumSSL VPN open to every source or below TLS 1.2FortiGateCIS 6.1.2
- FGT-SEC-026 MediumRemote access VPN signs users in without a second factorFortiGate
- FGT-SEC-027 LowRemote access VPN idle timeout above 15 minutes or noneFortiGate
- FGT-SEC-029 MediumRemote access VPN has no login attempt limitFortiGate
- PAN-SEC-168 MediumTwo agent tunnel profiles draw from the same or overlapping addressesPAN-OS
- PAN-SEC-169 LowAn agent tunnel profile matches any user beside other profilesPAN-OS
- FGT-SEC-030 MediumTwo remote access profiles draw from the same or overlapping addressesFortiGate
- FTD-SEC-026 MediumRemote access VPN uses local users onlyCisco FTD
- ASA-SEC-026 HighRemote access with local users onlyCisco ASA
- ASA-SEC-027 HighDefault connection profile usableCisco ASA
- ASA-SEC-028 MediumVPN session never times outCisco ASA
- ASA-SEC-029 MediumClientless SSL VPN allowedCisco ASA
- ASA-SEC-032 HighNo brute force protection for remote accessCisco ASA
Identity and Authentication
30- PAN-SEC-064 HighLDAP server profile binds without transport securityPAN-OS
- PAN-SEC-065 HighAuthentication binding points at something that does not existPAN-OS
- PAN-SEC-066 LowAuthentication server profile is referenced by nothingPAN-OS
- PAN-SEC-078 LowLocal user database account is enabled beside external authenticationPAN-OS
- PAN-SEC-080 LowAuthentication sequence has a single memberPAN-OS
- PAN-SEC-114 MediumLDAP server profile does not verify the server certificatePAN-OS
- PAN-SEC-115 MediumRADIUS server profile authenticates with PAP or CHAPPAN-OS
- PAN-SEC-129 MediumAuthentication profile does not lock accounts after failed loginsPAN-OSCIS 1.4.2
- PAN-SEC-131 MediumUser-ID agent probes clients with WMIPAN-OSCIS 2.2
- PAN-SEC-132 LowUser-ID is enabled and no include or exclude network is listedPAN-OSCIS 2.4
- PAN-SEC-165 MediumAn authentication policy rule is configured with a single factorPAN-OS
- ASA-MGT-019 MediumManagement logins not on TACACS+ or RADIUSCisco ASACIS 1.4.2.1
- ASA-MGT-020 LowNo local fallback after the AAA groupCisco ASACIS 1.4.1.2
- ASA-MGT-021 MediumCommands not authorized or accountedCisco ASA
- ASA-MGT-022 MediumNo lockout for local accountsCisco ASACIS 1.4.1.1
- ASA-MGT-023 MediumNo password policyCisco ASACIS 1.1.5
- ISE-SEC-006 HighAuthentication continues after a failurePAN-OS
- ISE-SEC-009 HighAllowed protocols accept weak authenticationPAN-OS
- ISE-SEC-010 HighEAP-TLS accepts expired certificatesPAN-OS
- ISE-SEC-011 MediumNetwork device shared secret is short or simplePAN-OS
- ISE-SEC-012 MediumOne shared secret configured on several network devicesPAN-OS
- ISE-SEC-013 MediumNetwork device configured for RADIUS has no shared secretPAN-OS
- ISE-SEC-017 LowInternal user account never expiresPAN-OS
- SW-MGT-009 MediumNo central authentication for administratorsCisco Catalyst and Nexus
- SW-SEC-013 LowAccess ports without port access controlCisco Catalyst and Nexus
- MS-SEC-007 LowAccess ports without an access policyCisco Meraki
- MR-SEC-001 HighOpen SSID without encryptionCisco Meraki
- MR-SEC-002 HighSSID allows WEP or WPA1Cisco Meraki
- MR-SEC-003 MediumWeak pre-shared keyCisco Meraki
- MR-SEC-005 LowManagement frame protection offCisco Meraki
Logging and Integrations
40- PAN-SEC-030 HighSyslog forwarding missingPAN-OSCIS 1.1.1.1
- PAN-SEC-032 MediumSNMP v2c is enabledPAN-OSCIS 1.5.1
- PAN-SEC-074 LowSyslog destination is sent without TLSPAN-OS
- PAN-SEC-075 MediumSystem or configuration logs are forwarded nowherePAN-OS
- PAN-SEC-076 LowSNMP trap profile uses SNMP v2cPAN-OS
- PAN-SEC-077 MediumSNMP answers on management with no permitted IP listPAN-OS
- PAN-SEC-079 LowLog server profile is referenced by no log settingPAN-OS
- PAN-SEC-117 LowNo log entry when the data plane is fully loadedPAN-OSCIS 1.1.3
- PAN-SEC-161 LowLog forwarding profile does not forward traffic or threat logsPAN-OS
- PAN-SEC-162 LowNo log forwarding profile is configured to alert on malicious WildFire verdictsPAN-OSCIS 5.5
- FGT-SEC-024 MediumNo remote log destination enabledFortiGateCIS 7.2.1
- FGT-SEC-025 MediumSNMP v1 or v2c community configuredFortiGateCIS 2.3.1
- FTD-MGT-004 MediumNo external syslog serverCisco FTD
- FTD-MGT-005 LowLogging level or timestamps misconfiguredCisco FTD
- FTD-MGT-006 HighSNMP v1 or v2c in useCisco FTD
- CKP-SEC-030 HighGateway logs kept only on the gatewayCheck Point
- CKP-MGT-008 HighGaia SNMP accepts v1 or v2cCheck PointCIS 2.2.2
- CKP-MGT-032 LowGaia SNMP agent is onCheck PointCIS 2.2.1
- CKP-MGT-033 LowGaia SNMP sends traps to no receiverCheck PointCIS 2.2.4
- CKP-MGT-035 MediumGaia sends syslog to no remote serverCheck Point
- CKP-MGT-036 LowGaia does not log management audit eventsCheck PointCIS 2.6.1
- CKP-MGT-037 LowGaia does not send OS logs to the log serverCheck PointCIS 2.6.3
- ASA-MGT-014 HighSNMP version 1 or 2cCisco ASACIS 1.11.3
- ASA-MGT-015 MediumSNMPv3 without privacyCisco ASACIS 1.11.1
- ASA-MGT-016 MediumFewer than two syslog serversCisco ASA
- ASA-MGT-026 MediumLogging off, or without timestamps or a syslog levelCisco ASA
- ASA-MGT-027 LowLogging to the console or monitor sessionsCisco ASA
- FMG-SEC-009 MediumFortiManager does not send its own logs to a syslog serverFortiGate
- FMG-SEC-010 LowFortiManager syslog server reached without TLSFortiGate
- SW-MGT-010 LowAdministrator activity not accountedCisco Catalyst and NexusCIS 1.1.6
- SW-SEC-001 HighSNMP community with write accessCisco Catalyst and NexusCIS 1.5.4
- SW-SEC-002 HighSNMP community with a well-known nameCisco Catalyst and Nexus
- SW-SEC-003 MediumSNMP community not limited to management stationsCisco Catalyst and NexusCIS 1.5.5
- SW-SEC-004 MediumNo remote syslogCisco Catalyst and NexusCIS 2.2.4
- SW-SEC-005 MediumNo NTP serverCisco Catalyst and NexusCIS 2.3.2
- MS-MGT-001 MediumNo syslog server for the networkCisco Meraki
- MS-MGT-002 MediumSNMP v2c community for the networkCisco Meraki
- MR-MGT-001 MediumNo syslog server for the networkCisco Meraki
- MX-MGT-003 MediumNo syslog server for the networkCisco Meraki
- MRK-MGT-008 LowOrganization SNMP v2c enabledCisco Meraki
QoS
6- PAN-SEC-070 LowQoS is enabled on an interface that shapes nothingPAN-OS
- PAN-SEC-071 LowQoS rule assigns a class with no bandwidth anywherePAN-OS
- PAN-SEC-072 MediumQoS class has a priority and no guaranteed bandwidthPAN-OS
- PAN-SEC-073 MediumQoS rule matches all trafficPAN-OS
- PAN-SEC-083 LowQoS policy rules exist and QoS is enabled on no interfacePAN-OS
- PAN-SEC-084 LowQoS is enabled on an interface and no QoS policy rule classifies trafficPAN-OS
Panorama Advanced
15- PAN-MGT-001 MediumRule restated in a device group that already inherits itPanorama
- PAN-MGT-002 MediumRule an inherited pre-rule already matchesPanorama
- PAN-MGT-003 LowIdentical rule defined in several device groupsPanorama
- PAN-MGT-004 LowRule defined in every child of a device groupPanorama
- PAN-MGT-005 MediumInherited rule treated differently in a child device groupPanorama
- PAN-MGT-006 LowRule references an object outside its inheritance chainPanorama
- PAN-MGT-007 MediumObject redefined in a device group that inherits one with the same namePanorama
- PAN-MGT-008 MediumTemplates in one stack set the same value differentlyPanorama
- PAN-MGT-009 MediumTemplate stack member whose settings are all supplied above itPanorama
- PAN-MGT-010 MediumTemplate stack names a template that does not existPanorama
- PAN-MGT-011 MediumTemplate variable used with no declarationPanorama
- PAN-MGT-012 LowTemplate variable declared and never usedPanorama
- PAN-MGT-013 LowDevice group with no managed devices assignedPanorama
- PAN-MGT-014 LowManaged device in a device group but in no template stackPanorama
- PAN-MGT-015 MediumRule names a zone the template stack of its firewalls does not definePanorama
Where a control aligns with a recommendation of the CIS Palo Alto Firewall 11 Benchmark v1.2.0, the CIS FortiGate 7.4.x Benchmark v1.0.1 or the CIS Cisco ASA 9.x Firewall Benchmark v1.1.0, that recommendation is cited as a reference. Only that version was checked. A reference is not a certification.