Choosing Two Security Subscriptions With Five Identified Gaps
Northbridge Credit Union runs 40 branch PA-440s and one PA-1420 hub on PAN-OS 10.2 with Threat Prevention, URL Filtering and WildFire licensed, but no DNS Security and no data loss prevention. Over six weeks the SOC records four events. Three credential-phishing pages were hosted on compromised marketing domains that PAN-DB still rated business-and-economy at click time, and two of the three users entered passwords. Two endpoints beaconed to algorithmically generated domains through the corporate resolvers until they were reimaged. A malicious LNK delivered by email was executed two minutes after download, and WildFire returned a malicious verdict six minutes later. Separately, an employee uploaded a customer statement containing account numbers to a personal cloud-storage account, which policy allowed as a sanctioned SaaS category. Finance has approved exactly two additional subscriptions from Advanced DNS Security, Advanced WildFire, Advanced URL Filtering, Enterprise DLP and SaaS Security, and wants a written rationale.
1. Which two subscriptions would you buy, and how do you justify them against the four events rather than against a feature list?
Read the worked answer
Rank by business impact and by whether the existing stack already mitigates the gap.
Buy Advanced DNS Security and Enterprise DLP.
- DNS: the beaconing event had no network-layer detection because TCP and TLS never showed anything useful until after resolution. A DNS control blocks at the earliest observable point, uses predictive and tunneling detection for algorithmically generated names, and is cheap in dataplane terms on the PA-440 branches. This is the highest coverage per unit of added CPU.
- DLP: the exfiltration is the only event with direct regulatory consequence for a credit union, and it is the only one no current subscription touches. DLP inspects content on the allowed SaaS path and turns an allowable category into a content-aware decision.
Why not the others: Advanced URL Filtering would be the third pick because it directly targets phishing on compromised legitimate domains with real-time and evasive-site detection, but it upgrades a control that already partially works. Advanced WildFire improves verdict quality and evasion resistance, yet the failure here was latency, which a policy change can address more cheaply. SaaS Security overlaps with DLP and would be scoped later. Order of introduction matters: DNS first, DLP second, Advanced URL Filtering in the next budget cycle.
2. The board asks whether DNS Security alone would have stopped all four events. Answer precisely, including where DNS coverage fails.
Read the worked answer
No. DNS Security sees queries and responses, nothing else.
- The DGA beaconing would likely be blocked or sinkholed at resolution, which is exactly the visibility that was missing.
- The phishing event would probably not be blocked: the pages sat on compromised marketing domains that are legitimately resolved and legitimately hosted. The domain is not malicious at query time, so there is no verdict to apply. Only URL-level and page-level inspection catches that.
- The LNK file is invisible to DNS. The download resolves a legitimate domain and the payload is a file; prevention must come from file-blocking policy or WildFire verdicts.
- The data upload goes to a sanctioned SaaS domain, so DNS sees an approved query and allows it.
There is also an architectural caveat: if endpoints use DNS over HTTPS or external resolvers, the firewall never sees the query and the subscription provides no coverage. Enforce corporate resolvers and block outbound DNS to non-approved servers, otherwise the licence buys nothing. The honest answer to the board is that DNS closes the command-and-control gap and shortens dwell time, and that the other three events need URL, file and content controls respectively.
3. Does buying Advanced WildFire close the six-minute verdict gap that let the LNK run? Explain what actually changed in the timeline.
Read the worked answer
Partly, and not enough to rely on. Advanced WildFire improves analysis depth, evasion resistance and how quickly a verdict becomes available for a broad set of samples; it also feeds verdict caches so the second instance of a sample is blocked instantly. But the timeline in this incident was user click at two minutes and verdict at six. Any cloud-analysis verdict arrives after a user has already decided to open the file.
The control that actually changes the outcome is local: block or quarantine risky file types from untrusted zones (LNK, HTA, ISO, JS inside archives), restrict where those files can be opened from, and enable local and inline machine-learning verdicts so a first-seen file is judged on the endpoint or firewall without a round trip. The subscription then matters as defence in depth for samples that get past the type policy.
So the answer to the board is: Advanced WildFire raises detection quality and shortens average verdict time, but the fix for a two-minute click is a file-blocking and delivery policy that refuses to hand the user the file, plus verdict caching and inline ML. Buying the subscription without the policy change would leave the same window open.