>
    Configure Prisma Access Browser Device Posture Attributes
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Browser
    3. Manage Prisma Access Browser Devices
    4. Configure Prisma Access Browser Device Posture Attributes
    Download PDF
    Prisma Access Browser

    Configure Prisma Access Browser Device Posture Attributes

    Table of Contents

    Configure
    Prisma Access Browser
     Device Posture Attributes

    Define the device posture attributes that determine device group membership.
    Where Can I Use This?
    What Do I Need?
    • Strata Cloud Manager
    • Prisma Access Browser
       standalone
    • Prisma Access
       with
      Prisma Access Browser
       bundle license or
      Prisma Access Browser
       standalone license
    • Superuser or
      Prisma Access Browser
       role
    In
    Prisma Access Browser
    , you can add attributes as match criteria when you add or edit a device group. Because
    Prisma Access Browser
     policy rules are enforced at the device group level, the attributes provide granular security that ensures the devices that
    Prisma Access Browser
     allows to access your apps are adequately maintained and adhere with your security standards before they are allowed access to your network resources. For example, before allowing access to your most sensitive apps, you might want to ensure that the devices accessing the apps have encryption enabled on their hard drives. In this case, you would create a device group with an attribute that only allows devices that have encryption enabled. The following sections detail the attributes you can use to determine device group membership for Windows and macOS devices. To learn about the attributes for controlling device group membership for mobile devices, see Configure Prisma Access Browser Mobile Device Posture Attributes.

    Windows and macOS OS Versions

    Creating a device group that uses the device's operating system as a posture is a good way to make sure that users have specific versions of the OS. If you add an OS version attribute as match criteria for a device group,
    Prisma Access Browser
     checks the device OS version matches the attribute you defined before allowing membership in the device group.
    Define the list of acceptable operating system versions for the
    Prisma Access Browser
     posture mechanism to check as follows.
    1. When you add or edit a device group, add the OS version attribute.
    2. Select the Windows or macOS versions, editions, and build numbers to allow into the device group and then click
      Save
      .

    Serial Number

    Creating a device group that uses device serial numbers as match criteria is a good way to ensure that only specific devices have access to the
    Prisma Access Browser
    . Before you can add a serial number attribute to a device group, you must create a .txt or .csv file containing the list of serial numbers. The file you create can't exceed 600 KB.
    While the serial number often appears on a sticker or label on the device, these numbers aren't always accurate. Use the following methods to get the correct serial number.
    • Windows devices
      —Enter the
      wmic bios get serialnumber
       command from the command line.
    • macOS devices
      —Find the serial number in the System Settings.
    1. When you add or edit a device group, add the serial number attribute.
    2. Drag and drop or browse for the file containing the list of serial numbers.
    3. If necessary, remove any serial numbers that you do not want to include in the group.
    4. Click
      Set
      .

    Client Certificate

    To ensure that only devices that use a client certificate signed by your organization for authentication, create a client certificate attribute as match criteria for your device groups so that you can distinguish between managed and unmanaged devices. To use a client certificate attribute, you must upload the intermediate certificate or intermediate or root certificate to create the attribute. When determining if a client certificate matches the issuer certificate in the attribute,
    Prisma Access Browser
     matches against the
    authorityKeyIdentifier
    . If you need to trust multiple CAs, you can upload multiple certificates. For the device to match the client certificate attribute it must meet the following requirements:
    • Windows devices
      —The client certificate must reside in the personal certificates store (
      Start
      Manage user certificates
      Personal
      Certificates
      ). The certificate must contain a private key and the issuer must match the issuer certificate. You can compare the thumbprint of the certificates. The authroity key identifier must also match the issuer certificate identifier.
    • macOS devices
      —From the Launcher, search for Keychain Access. Click Certificates, and search for the required certificate. Validate that the company client certificate exists and that the authority key identifier matches the issuer certificate identifier.
    Device groups can match against multiple certificates. To add a new Issuer (root or intermediate) certificate:
    1. When you add or edit a device group, add the client certificate attribute.
    2. Drag and drop one or more certificate .PEM files to the Issuer certificates dialog.
    3. Click
      Set
      .

    System Encryption

    File system encryption protects data-at-rest, protecting against a range of potential attacks and cybersecurity risks. When you enable the
    File system encryption
     attribute in a device group,
    Prisma Access Browser
     verifies that encryption is enabled on the device OS before allowing access to the device group. If you enable this attribute,
    Prisma Access Browser
     will only allow devices with BitLocker (Windows) or FileVault (macOS) enabled into the device group. For the device to pass the file system encryption check it must meet the following requirements:
    • Windows devices
      —The BitLocker status must be On, Locked, or Encryption in Progress. Note that when Windows Update runs it temporarily disables BitLocker and it won't pass the
      Prisma Access Browser
       check during this time.
    • macOS devices
      —Turn on FileVault on the Security & Privacy screen to enable file encryption or toggle it using
      sudo fdesetup status
      .

    Active Screen Lock

    Active screen lock mechanisms limit device access to authorized users only, preventing malevolent players from gaining access to confidential information on the device in the event that the user steps away from the device. When you enable the
    Active screen lock
     attribute in a device group,
    Prisma Access Browser
     verifies that the device is enabled with an automatic screen lock, password, PIN, biometric, or similar lock feature before allowing access to the group. To pass this check, a device must meet the following requirements:
    • Windows devices
      —To pass the
      Prisma Access Browser
       check the Windows device must be enabled with either Windows power options that require login to resume or sign-in options to enable the screen lock.
    • macOS devices
      —On macOS devices, the active screen lock is based on code that the
      Prisma Access Browser
       developers contributed to the Chromium project. Find this setting under
      System Preferences
      Security & Privacy
      General
       in the Lock Screen section and ensure that
      Require password after screen saver begins or display is turned off
       has a value.

    Active Endpoint Protection

    Devices secured with active endpoint protection have antivirus, anti-malware, firewall protection, and intrusion detection and prevention features, which work in concert to identify and block malicious activity. If you enable the endpoint protection attribute within the device group,
    Prisma Access Browser
     checks for active endpoint protection before allowing the device into the device group. A device must meet the following requirements to pass this check:
    • Windows devices
      —
      Prisma Access Browser
       checks that Virus & threat protection is turned on in the Windows Security Center.
    • macOS devices
      —
      Prisma Access Browser
       checks
      System Preferences
      Extensions
       to ensure that the device has active endpoint protection.
    When configuring attributes to check for endpoint protection, you can select specific endpoint protection vendors to check for on the device as follows:
    1. When you add or edit a device group, enable the endpoint protection attribute.
    2. Select the endpoint protection vendors you require devices accessing your network to use.
    3. (
      Optional
      ) Enable
      Verify definitions are up to date (supported vendors only)
       to add an additional check to ensure that the endpoint protection software on the device is up-to-date.
    4. Click
      Set
      .

    Device Type

    Use the device type attribute to ensure that the device group only contains specific types of devices—such as laptops or desktops—as follows:
    • Windows devices
      —
      Prisma Access Browser
       checks to see if the device is a laptop or desktop based on whether or not it has a battery.
    • macOS devices
      —
      Prisma Access Browser
       checks the hardware device machine type.
    If
    Prisma Access Browser
     can not determine the device type it identifies it as unknown.

    CrowdStrike ZTA Scores

    CrowdStrike Zero Trust Assessment (ZTA) delivers real-time security posture assessments across all endpoints regardless of location, network, or user. CrowdStrike ZTA enables enforcement of dynamic conditional access based on device health and compliance checks that mitigate the risk to users and the organization.
    Prisma Access Browser
     can use the ZTA assessment score as access criteria.
    To use the ZTA score as part of the device posture assessment for determining access to
    Prisma Access Browser
     you must:
    1. Enable the ZTA score calculation for all devices (
      Host setup and management
      Zero trust assessment
      hosts
      ).
    2. Find your CrowdStrike Customer ID.
      You can find this inside your CrowdStrike user profile.
    3. Open a support ticket with CrowdStrike to enable the ZTA feature flag.
      This allows
      Prisma Access Browser
       to access the CrowdStrike Agent ID. To open the support ticket, you will need the customer ID you just obtained.
    4. Integrate the ZTA score with
      Prisma Access Browser
      .
      After CrowdStrike enables the ZTA feature flag, you can integrate with
      as follows:
      1. When you add or edit a device group, select
        CrowdStrike ZTA Score
        .
      2. Select the type of score you want to use:
        • Basic
          —Use the overall score that CrowdStrike assigns to the device, based on a range of
          Low
           (at least 65),
          Medium
           (at least 70),
          Strict
           (at least 80), or
          Very Strict
           (at least 95).
        • Advanced
          —Fine-tune the configuration to select either a specific
          Overall security score
          , or a
          Score breakdown
          , based on the OS and sensor values. Use the sliders to select the required score.
    5. Enter the
      CrowdStrike customer identification
       number associated with the CrowdStrike agent.
      Add
       additional CrowdStrike IDs as needed to connect to all agents.
    6. Click
      Set
      .

    OS Password Policy

    Use the OS password protection attribute to restrict device group membership to devices that are password protected. You can also specify that the device must have additional password policy enforced, such as password complexity, maximum age, or maximum length. To determine this,
    Prisma Access Browser
     looks for the following settings on the device:
    • Windows devices
      —
      Prisma Access Browser
       checks the following Password Policy settings in the local Security Settings (
      Security Settings
      Account Policy
      Password Policy
      ):
      Maximum password age
      ,
      Minimum password length
      , and
      Password must meet complexity requirements
      .
    • macOS devices
      —
      Prisma Access Browser
       checks the local password requirements in the management configuration profile (
      Management
      Configuration profiles
      Add
      macOS
      Password
      ):
      Allow simple value
      ,
      Require alphanumeric value
      ,
      Minimum length
      ,
      Munimum number of complex characters
      ,
      Expiration age
      , or
      History restriction
      .
    1. When you add or edit a device group, enable the OS password policy attribute.
    2. Select the endpoint protection vendors you require devices accessing your network to use.
    3. Select the password policy settings that must be enforced on devices for inclusion in the device group.
    4. Click
      Save
      .

    Device Manufacturer

    Use the device manufacturer attribute to restrict device group membership to Windows or macOS devices from selected manufacturers.
    1. When you add or edit a device group, enable the device manufacturer attribute.
    2. Select the device manufacturers you want to support in the device group.
    3. Click
      Save
      .

    System Integrity

    Use the system integrity attribute to ensure that the device group only allows devices that have advanced system integrity protection enabled.
    Prisma Access Browser
     determines if a device qualifies as follows:
    • Windows devices
      —
      Prisma Access Browser
       checks to ensure that driver test signing is off and no kernel debugger is present. Additionally, on UEFI computers, it verifies that secure boot is enabled.
    • macOS devices
      —
      Prisma Access Browser
       checks to ensure that System Integrity Protection (SIP) and Gatekeeper are enabled.

    Full OS Boot Mode

    Enable this attribute to create a device group that requires the devices to run in full boot mode. This excludes devices that are running in safe mode, recovery mode, or devices running in a pre-installation environment.

    Unprivileged Process

    This attribute allows you to create device groups where the
    Prisma Access Browser
     runs without any elevated or root permissions.

    Device Management

    This attribute allows you to create device groups that use approved device management systems. The
    Prisma Access Browser
     supports the following systems:
    • Microsoft Intune
    • Azure AD
    • Active Directory (Windows only)
    • Jamf (macOS only)
    1. When you add or edit a device group, enable the device management attribute.
    2. Select the device management systems you want to allow in the device group.
    3. Click
      Set
      .

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.