To: Board of Supervisors
From: David O. Livingston, Sheriff-Coroner
Report Title: Palo Alto Networks, Inc.
☒Recommendation of the County Administrator ☐ Recommendation of Board Committee
RECOMMENDATIONS:
APPROVE and AUTHORIZE the Purchasing Agent, or designee, to execute on behalf of the Sheriff-Coroner, a purchase order with AT&T, Inc., in an amount not to exceed $18,502, for the purchase of Palo Alto Networks Firewall software, for the period of January 1, 2025 through December 31, 2027.
FISCAL IMPACT:
Approval of this request will result in a one-time expenditure of $18,502 and will be funded 100% by the General Fund.
BACKGROUND:
Palo Alto Networks (PAN) is an industry leader in providing hardware and software firewall solutions. The Sheriff’s Office has PAN hardware and software installed at multiple locations within the department. This purchase will add a PAN virtual firewall, also known as a cloud firewall, or a virtualized next-generation firewall (NGFW). It is a software-based security system and barrier that operates in a virtual environment to protect cloud-based assets and data centers by filtering, inspecting, monitoring, and controlling network traffic between the Sheriff’s Office on-premise network servers and its tenant in the California State Sheriff’s Association (CSSA) Azure Cloud.
PAN virtual firewalls offer features that the Sheriff’s Office needs to secure its CSSA cloud environment. It includes full visibility and control, application security, exfiltration prevention, compliance and risk management, security automation, cloud management, and because the Sheriff’s Office already uses PAN firewalls for its on-premises network, consistent policy enforcement.
This purchase will be for a 36-month subscription for a PAN virtualized NGFW, along with accompanying subscription services and management software. Palo Alto Networks, Inc. does not sell directly to customers; therefore, it will be purchased through AT&T, a third-party reseller.
The End User License Agreement includes a limitation of liability provision.
CONSEQUENCE OF NEGATIVE ACTION:
If the Board does not approve, the firewall protection will remain as is, leaving the Sheriff’s Office CSSA cloud environment to the SO network open to potential hacks and intrusions.