The Purpose Of The Cloud-Native Application Protection Platform (CNAPP) Model
Gartner made CNAPP a popular security buzzword with the release of their Innovation Insight for Cloud-Native Application Protection Platforms report. However, CNAPP isn’t just a new security tool with some hype. CNAPP is a platform intended to replace multiple independent tools with a single holistic security solution for modern enterprises with cloud-native workloads.
Specifically, the Cloud-Native Application Protection Platform model exists because Gartner identified the need for enterprises to consolidate tooling and security platforms, and treat security and compliance as a continuum across operations and security teams. Viewed from that perspective, CNAPP is a logical evolution for DevSecOps and “shift left” security.
Why Is It Important To Have A CNAPP?
Multiple, disjointed solutions will inherently have gaps in visibility and integration complexities. This means more work for DevSecOps teams and lower observability across enterprise workloads. By using a CNAPP, enterprises can address these issues and improve their overall security posture.
Specifically, a CNAPP approach provides the following benefits:
- “Cloud-native” security: Traditional security solutions designed for “castle-and-moat” networks with well-defined parameters aren’t ideal for the modern enterprise with cloud-native workloads. By integrating with CI\CD pipelines and providing protection across public and private clouds and on-premises, CNAPP is built with modern “cloud-native” infrastructure — including containers and serverless security — in mind.
- Improved visibility: There are many security scanning, monitoring, and observability tools for cloud-native workloads. However, what sets CNAPP apart is the ability to contextualize information and have end-to-end visibility across an enterprise’s application infrastructure. For example, with end-to-end visibility and granular detail on configurations, technology stacks, and identities, a CNAPP solution can prioritize alerts that pose the most risk to an enterprise.
Tighter controls: Misconfigurations of secrets, cloud workloads, containers, or Kubernetes (K8s) clusters are some of the most common risks facing enterprise applications. CNAPP platforms enable enterprises to proactively scan, detect, and quickly remediate security and compliance risks due to misconfigurations.
The Key Components Of CNAPP
At a high level, there are 3 key components of CNAPP:
- Cloud Security Posture Management (CSPM)
- Cloud Service Network Security (CSNS)
- Cloud Workload Protection Platform (CWPP)
Let’s take a closer look at each and how CNAPP brings them together.
CSPM: Visualizations and security assessment
Cloud Security Posture Management (CSPM) enables enterprises to automate the detection and remediation of security risks using security assessments and automated compliance monitoring. CSPMs are also capable of detecting misconfigurations that can lead to data breaches. Further, CSPMs provide deep cloud visibility by helping enterprises classify and inventory assets across IaaS, SaaS, and PaaS platforms.
CSNS: Security for cloud-native networks
Cloud Service Network Security (CSNS) — while not always cited as part of CNAPP — is a vital aspect of overall cloud-native security and true CNAPP solutions. CSNS provides cloud network security functions designed for the dynamic network perimeters common with cloud-native workloads. CSNS provides granular segmentation and protects both North-South and East-West traffic. Common examples of CSNS functions include:
- Next-generation firewall (NGFW)
- Load balancers
- Denial of Service (DoS) protection
- Web Application and API protection (WAAP)
- SSL/TLS inspection
CWPP: Modern threat protection for workloads
Cloud Workload Protection Platform (CWPP) solutions deal with protecting the workloads deployed across public, private, and hybrid clouds. CWPP makes it possible for enterprises to shift security left and integrate security solutions early in — and continuously throughout — the application development lifecycle. Solutions in this category first discover workloads within an enterprise’s cloud and on-premises infrastructure. Then, they scan them to detect security issues and provide options to address the vulnerabilities. Additionally, CWPPs provide security functions such as runtime protection, network segmentation, and malware detection for workloads.
Integration Is What Sets CNAPP Apart
While many cloud-native security tools exist, what makes CNAPP unique is the fact it integrates end-to-end cloud-native security across all enterprise workloads. For example, here are just a few of the different security functions a CNAPP platform may provide from “code” to “deploy” across a CI\CD pipeline:
- Code and commit: Infrastructure as Code scanning (a CSPM function) and 3rd party library scans (a CWPP function)
- Build: Container image assurance (CWPP)
- Deployment and beyond: Kubernetes runtime assurance and virtual machine protection (CWPP), posture management and entity behavior analytics (CSPM), and API protection and automated micro-segmentation (CSNS)
Performing all these functions in a holistic platform removes friction from DevSecOps processes, enables insights with context, and improves overall enterprise security posture.
CNAPP With Check Point
Check Point’s CloudGuard is the most robust enterprise CNAPP available today, providing a wide range of cloud-native security functions to improve application security across an enterprise. The components of the CloudGuard Cloud-Native Application Protection Platform are:
- CloudGuard Posture Management: Provides cloud-native security posture management and account-level threat detection across multi-cloud environments. WIth CloudGuard’s Cloud Security Posture Management, enterprises can automate governance of enterprise assets across environments, automatically detect misconfiguration, enforce security policies and compliance frameworks, and visualize their overall security posture.
- CloudGuard Network Security: Delivers cloud-native network security. With CloudGuard Network Security, enterprises are able to macro- and micro-segment their assets across cloud providers and on-premises infrastructure with advanced features such as DoS protection, NGFW, API protection, and SSL\TLS inspection.
- CloudGuard Workload Protection: Enables true “shift-left” security by integrating with CI/CD pipelines, implementing source code and infrastructure as code (IaC) scanning, and protecting workloads running on virtual machines, containers, and serverless platforms. CloudGuard Workload Protection is purpose-built to enable security, compliance, and visibility for modern applications wherever they run.
- CloudGuard AppSec: Automates application and API security. CloudGaurd AppSec gets rid of the need for enterprises to manually modify security rules when an application is updated. Instead of the rule-based approach of legacy web application firewalls (WAFs), CloudGaurd AppSec uses intelligent contextualized A.I. analysis to deliver precise and up-to-date threat protection without the need for constant human intervention.
- CloudGuard Intelligence. Achieves a deeper layer of security and insight with intrusion detection, threat hunting, and remediation. CloudGuard Intelligence provides the necessary security context, correlating information from cloud inventory and configuration, account activity, network traffic logs and additional threat feeds, such as Check Point ThreatCloud AI, IP reputation and geo databases to portray one complete and accurate picture. Easily identify unwanted traffic and suspicious activity through automated alerts and anomaly detection.
Want To Learn More About CNAPP And Cloud-Native Security?
If you’d like to learn more about cloud-native security, check out the links below to access cloud security ebooks and other free resources.
Check out the links below to sign up to access free cloud security ebooks and resources:
- The Serverless Security Advantage. This ebook details the changes and challenges around serverless security, how you can prevent most attacks with the right security posture, and the DevSecOps shared responsibility model.
- Technical Guide to Unified Cloud Security. This guide explores the technical requirements you need to consider for cloud-native security including posture management, workload protection, and centralized visibility.
If you would like to see CloudGuard in action for yourself, you’re welcome to schedule an application security demo.
Feedback