AI Access Security
Risky Applications
Table of Contents
Expand All
|
Collapse All
AI Access Security Docs
Discover Risks Posed by GenAI Apps by Risky Apps
Discover risky generative AI (GenAI) applications accessed on your
network.
- Log in toStrata Cloud Manager.
- Select.InsightsApplications
- Configure the filters for the application list to narrow down the GenAI apps you want to investigate.
- Configure theTime RangeandScope Selectionto filter for the specific time range and enforcement point you want to investigate.
- Add Filterand add the following filters.
- Source Type - Users—Filters the list of applications to only display GenAI apps accessed by users in your organization. This is a required filter.
- GenAI Application - TRUE—Filters the list of application to only display GenAI apps. This is a required filter.
- App Risk Score—For theApp Risk Scorefilter, select the specific risk score you want to investigate. All GenAI applications are displays if you don't select at least one risk score.In this example, we are investigating applications with a risk score of4and5because these are the risk scores attributed to the riskiest applications.
- Review the list filtered GenAI applications.Some important information to review is:
- Application Name—App-ID of the GenAI app.
- Data Usage—Amount of data uploaded to or downloaded from the GenAI app. This can help you understand the GenAI app usage; a GenAI app with a large volume of data usage could mean that this app is widely used and might need strict controls to prevent exfiltration of sensitive data and malicious actors.
- Tags—Current application tag for the GenAI app. If some of the listed GenAI apps are approved for use, you can modify the tag toToleratedorSanctioned.Palo Alto Networksgroups the child app-IDs for app functionality in a container App-ID. However, tagging an App-ID container is not supported. You must individually tag the specific child App-ID that are sanctioned, unsanctioned, or tolerated within your organization.
- Create a custom Security policy rule to control access to a GenAI application for specific users.For example, based on your investigation you discover that there are multiple unsanctioned GenAI apps with a large volume of data usage. This poses a security risk because there are users accessing an unapproved app on the network and you don't know what data is being downloaded or uploaded. Until you can perform proper due diligence to understand the GenAI app purpose and who is permitted to use the GenAI app, you canBlockthe GenAI app for all users.Conversely, you notice there are someUnsanctionedGenAI apps listed that but they are GenAI apps approved for use on your network by specific users with a large volume of data usage. In this case, you can change the tag toSanctionedand write a policy rule toAllowusage of the application but only for users in specific roles or departments. In the policy rule you can associate anEnterprise Data Loss Prevention (E-DLP)data profile to prevent exfiltration of sensitive data and a Vulnerability profile to stop attempts to exploit system flaws or gain unauthorized access to systems.