AI Access Security Recommendations
AI Access Security Recommendations give your network security
administrators clear calls to action to strengthen your security posture when allowing GenAI
app usage on your network.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Managed by Panorama or Strata Cloud Manager)
- Prisma Access (Managed by Panorama or Strata Cloud Manager)
- Prisma Access Browser
|
One of the following:
- AI Access Security license
- CASB-PA license
- CASB-X license
- Prisma Access Browser standalone license
|
Your network security admins gain valuable data into GenAI app usage on your
organization's network using the
AI Access Security
dashboard and
Strata Command Center. To enable your network
security admins to quickly address gaps and strengthen your security posture when
adopting GenAI apps,
Palo Alto Networks introduces
AI Access Security
Recommendations.
AI Access Security offers manual and automated recommendations. Manual
recommendations are those you need to manually implement. AI Access Security
offers step-by-step instructions and provides links to all relevant documentation to
help you successfully implement the recommended changes. The Palo Alto Networks Copilot
on Strata Cloud Manager implements the automated recommendations rather than the admin.
However, the admin who initiated the recommendation proposed by AI Access Security must approve all changes.
Recommendations for NGFW and Prisma Access (Managed by Strata Cloud Manager)— AI Access Security recommendations
update in real time as your admins make configuration changes and AI Access Security analyzes traffic on your network. This allows you
to quickly respond to any configuration changes or risky GenAI app traffic that
might compromise your organization if not immediately addressed. Any
recommendation that analyzes traffic on your network has a seven day look back
period that informs the recommendation.
If you have NGFW and Prisma Access
(Managed by Strata Cloud Manager) as well as Prisma Access Browser, AI Access Security displays recommendations only for your NGFW and Prisma Access tenants. In this case, AI Access Security does not display recommendations for Prisma Access Browser.
Recommendations for NGFW and Prisma Access (Managed by Panorama)— AI Access Security recommendations update
every 24 hours on Strata Cloud Manager.
If you have NGFW and Prisma Access
(Managed by Panorama) as well as Prisma Access Browser, AI Access Security displays recommendations only for your NGFW and Prisma Access tenants. In this case, AI Access Security does not display recommendations for Prisma Access Browser.
Recommendations for Prisma Access Browser—AI Access Security
recommendations are static and persist after your implementation. Palo Alto Networks recommends to continue monitoring these recommendations
after implementation to ensure your security administrators address any gaps in
your GenAI app adoption strategy.
AI Access Security displays recommendations for
Prisma Access Browser only when you have a standalone Prisma Access Browser
license and don't have any NGFW or Prisma Access tenants
deployed.
If you have NGFW and Prisma Access
(Managed by Panorama or Strata Cloud Manager) as well as Prisma Access Browser, AI Access Security displays recommendations only
for your NGFW and Prisma Access tenants. In this case, AI Access Security does not display recommendations for Prisma Access Browser.
AI Access Security provides recommendations for the following scenarios.
GenAI App Classification Recommendations
Focused on providing recommendations based on the GenAI app usage on your network
and their app classification (Sanctioned, Tolerated, or Unsanctioned)
For example, if AI Access Security notices that your organization
allows traffic to Unsanctioned GenAI apps. In this case, AI Access Security provides a recommendation to reclassify these
GenAI apps as Sanctioned or Tolerated.
Best Practices Checks and Policy Recommendations
AI Access Security uses the
Best Practice Assessment (BPA) service to analyze
your existing
NGFW and
Prisma Access policy rulebase to offer
recommendations to strengthen your security posture to safely adopt GenAI
apps.
For example, if the BPA service discovers that you have a Security policy rule
allowing access to Unsanctioned GenAI apps.
Data Loss Prevention Recommendations
To prevent exfiltration of sensitive data to Sanctioned and Tolerated GenAI apps,
AI Access Security analyzes your Security policy rules to
determine if you're forwarding traffic to Enterprise DLP for inline
inspection and for data at rest. This can also include config recommendations
required to forward traffic to Enterprise DLP
Onboarding and Maximizing AI Access Security
These focus on providing actionable recommendations to better leverage
capabilities across the platform. These recommendations focus on user
connectivity to various marketplaces or for GenAI app supported for data at
rest.
Prisma Access Browser Recommendations
The recommendations for Prisma Access Browser focus on providing targeted guidance
to help Prisma Access Browser standalone users secure and optimize their GenAI app
usage. These recommendations can include configuring GenAI app access,
activating predefined Security policy rules to secure access to GenAI apps
accessed through Prisma Access Browser, and reviewing suspected incidents of
sensitive data exfiltration to Unsanctioned GenAI apps.
