3.3 Ensure 'Passive Link State' and 'Preemptive' are configured appropriately - Election Setings
3.3 Ensure 'Passive Link State' and 'Preemptive' are configured appropriately - Passive Link State
4.1 Ensure 'Antivirus Update Schedule' is set to download and install updates hourly
4.2 Ensure 'Applications and Threats Update Schedule' is set to download and install updates at daily or shorter intervals
5.1 Ensure that WildFire file size upload limits are maximized
5.2 Ensure forwarding is enabled for all applications and file types in WildFire file blocking profiles
5.3 Ensure a WildFire Analysis profile is enabled for all security policies
5.4 Ensure forwarding of decrypted content to WildFire is enabled
5.5 Ensure all WildFire session information settings are enabled
5.7 Ensure 'WildFire Update Schedule' is set to download and install updates every minute
6.1 Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'
6.10 Ensure that URL Filtering uses the action of 'block' or 'override' on the URL categories - override on the URL categories
6.11 Ensure that access to every URL is logged
6.12 Ensure all HTTP Header Logging options are enabled - Log Container Page
6.12 Ensure all HTTP Header Logging options are enabled - Referer
6.12 Ensure all HTTP Header Logging options are enabled - User-Agent
6.12 Ensure all HTTP Header Logging options are enabled - X-Forwarded-For
6.13 Ensure secure URL filtering is enabled for all security policies allowing traffic to the Internet
6.14 Ensure alerting after a threshold of credit card or Social Security numbers is detected is enabled - Data Filtering Profile
6.14 Ensure alerting after a threshold of credit card or Social Security numbers is detected is enabled - Data Object
6.15 Ensure a secure Data Filtering profile is applied to all security policies allowing traffic to or from the Internet
6.16 Ensure that a Zone Protection Profile with an enabled SYN Flood Action of SYN Cookies is attached to all untrusted zones
6.18 Ensure that all zones have Zone Protection Profiles with all Reconnaissance Protection settings enabled, tuned, and set to appropriate actions
6.19 Ensure all zones have Zone Protection Profiles that drop specially crafted packets
6.2 Ensure a secure antivirus profile is applied to all relevant security policies
6.20 Ensure that User Credential Submission uses the action of 'block' or 'continue' on the URL categories - continue on the URL categories
6.3 Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories, and threats
6.4 Ensure DNS sinkholing is configured on all anti-spyware profiles in use
6.5 Ensure passive DNS monitoring is set to enabled on all anti-spyware profiles in use
6.6 Ensure a secure anti-spyware profile is applied to all security policies permitting traffic to the Internet
6.7 Ensure a Vulnerability Protection Profile is set to block attacks against critical and high vulnerabilities, and set to default on medium, low, and informational vulnerabilities
6.8 Ensure a secure Vulnerability Protection Profile is applied to all security rules allowing traffic
7.1 Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone
7.2 Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist
7.3 Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources Exists
8.1 Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured - Invalid Categories
8.1 Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured - Policies
8.2 Ensure 'SSL Inbound Inspection' is required for all untrusted traffic destined for servers using SSL or TLS
8.3 Ensure that the Certificate used for Decryption is Trusted
