Palo Alto Networks PA-440

Palo Alto Networks PA-440
Security Grade A- Calculator v	Palo Alto Networks PA-440 Brand: Palo Alto Networks Category: Router • Model / Gen: PA-440 Release Date: 2021-05-19 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[[1] 🔗 Proof]	PA-400 hardware documentation includes PA-440 with TPM key storage and UEFI secure boot. Rare is a qualitative physical-resistance/risk judgment, not a measured tampering rate or a tamper-proof certification.
Known vulnerabilities	Rare	[[2] 🔗 Proof]	Historical CVE-2024-3400 affected specified older PAN-OS 10.2/11.0/11.1 builds with GlobalProtect enabled. Vendor lists fixed 11.1.2-h3 and later; this does not establish vulnerability in the assessed baseline.
Prior attacks	Rare	[[3] 🔗 Proof]	Unit 42 documents in-the-wild exploitation of CVE-2024-3400 in vulnerable GlobalProtect deployments. This is PAN-OS platform history, not a verified incident on an individual PA-440 or a model-specific rate.
Updatability	Very common	[[4] [5] 🔗 Proof]	Vendor documents PAN-OS software download/upload and installation, maintenance releases and PA-440 compatibility. Update entitlement/access may depend on support arrangements; Very common is qualitative, not a measured patch cadence.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[[6] 🔗 Proof]	PAN-OS supports local and external identity services including RADIUS, SAML and LDAP. Authentication is service-dependent; Partial does not assert universal mutual authentication across all connected systems.
Communications	Encrypted with up-to-date encryption	[[7] 🔗 Proof]	Assessed web-management profile uses HTTPS with TLS 1.2 and a trusted server certificate. This is management-plane protection, not a claim that all transit traffic is encrypted by the firewall.
Storage	Encrypted with up-to-date encryption	[[8] [9] 🔗 Proof]	Assessed profile uses a unique master key with AES-256-GCM level 2, supported from PAN-OS 11.1. The protected scope is sensitive passwords/private keys, not whole-disk encryption or every log.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	[[10] [11] 🔗 Proof]	PAN-OS provides administrator accounts, granular roles and creation/deletion workflows. Password-change and least-privilege capabilities are documented; Full is a qualitative account-management mapping.
Authentication	Secure	[[12] [13] 🔗 Proof]	Assessed administrator profile integrates an external MFA service through RADIUS. The MFA provider supplies the factors; no universal factory-default MFA or elimination of emergency local accounts is claimed.
Brute-force protection	Exist	[[14] [15] 🔗 Proof]	Assessed management profile sets five failed attempts and a 30-minute lockout. Both controls must be positive; normal-mode unlimited-attempt defaults are not represented as protected or tested.
Event logging	Access event logged	[[16] [17] 🔗 Proof]	Vendor documents monitoring administrator login attempts and activity, with successful-login timestamps and failed-attempt information. The assessed profile configures System logging and forwarding; unlimited retention is not claimed.
Passwords	Require change after setup with complexity requirements	[[18] [19] 🔗 Proof]	Since PAN-OS 9.0.4, initial default-admin login requires a new password with minimum length and character rules. The assessed profile retains enforced complexity and first-login change for applicable local accounts.
Category Score	Score: 1 / 3

Technical Specifications

Property	Details
Operating System & App	PAN-OS (assessment baseline: 11.1.11) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: 12 V DC via adapter (100–240 V AC, 50–60 Hz); vendor average 29 W, maximum 34 W • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: 8 × RJ-45 10/100/1000Mbps traffic ports; dedicated 1GbE management port; console/USB administration
Physical (Dimensions & Mass)	Dimensions: 44.5 × 203 × 223.5 mm (H × W × D) • Mass: 2.27 kg (firewall only)

Documentation-based assessment of PA-440 using a model-compatible PAN-OS 11.1.11 configured profile; no physical firewall, installed software or network was tested. This is not a latest-patch recommendation. The profile assumes HTTPS/TLS 1.2 for web management, external RADIUS MFA for applicable administrators, granular roles, positive lockout settings (five attempts/30 minutes), enforced local-password controls, System logging/forwarding, and a unique master key with AES-256-GCM. These are not universal factory-default claims; local emergency access remains a separate case. Stored-data encryption refers to sensitive passwords/private keys, not every log or the entire disk. Communication encryption concerns management sessions, not all forwarded traffic. Historical CVE-2024-3400 and Unit 42 attack evidence refer to vulnerable GlobalProtect deployments, not a proven compromise of an individual PA-440 or this baseline. None/Rare/Very common are qualitative mappings, not measured rates. The date 2021-05-19 is the manufacturer's PA-400-series public introduction; exact PA-440 first retail delivery is unverified, and June availability was stated without a day. Unknown optional hardware details and current sales status are left blank.