By: Diana Polansky, Cloud Security Product Marketing Manager, and Sergio Silva, Product Incubation Manager
When we started to plan our goals for the new year, we took the time to think about your goals as well – and we don’t mean your personal New Year’s goals. We mean your application security goals.
You may know you need to choose a new AppSec vendor, and you may already be in the evaluation process. But there’s so many vendors to choose from, and many of them seem to offer the same set of “hot” features. But can they really help you? And do you really need their solution?
We decided to help you narrow that list down so you can get to the final bake-off as quickly as possible. In order to do this, we interviewed our customer-facing employees so we could learn about the needs of actual users and buyers of application security products. We then compiled this information into a list of the most commonly asked questions, which you’ll find below.
But we didn’t stop there. We also provided answers to those questions so you can informally evaluate us – and come to us when you’re ready. Please note: the answers provided primarily refer to CloudGuard AppSec, but most are relevant to our full CNAPP suite.
Enjoy and let us know how we can help!
1. Is your solution a WAF, WAAP, or RASP?
That’s a good question. We get that one a lot. The simple answer is: we are a WAAP – a web application and API protection solution. This is the next-generation of a web application firewall (WAF), but so much more.
CloudGuard AppSec goes beyond the traditional WAF to protect applications against common, external threats as well as automated bot attacks, API attacks, malicious file uploads, and even targeted attacks to your application layer.
While WAF and RASP (runtime application self-protection) solutions offer crossover capabilities, they typically need to be used together in order to protect web applications against both broad, well-known threats and highly specific, often unknown threats. With our cloud WAAP, you get both capabilities and more rolled into one solution.
2. Do you protect against zero-day exploits?
Absolutely. In fact, CloudGuard AppSec is the only solution on the market that was able to preemptively protect against recent zero-day attacks including Log4j, Spring4Shell, and Text4Shell – without the need to update signatures and firewall rules.
This was accomplished through a contextual machine learning engine that analyzes how users typically interact with your web applications and automatically blocks malicious requests such as those pesky Java vulnerabilities.
3. Do you protect beyond the OWASP Top 10?
Yes. As noted above, we protect against both known and unknown attacks. The OWASP Top 10 is just a starting point – and offers bare minimum guidelines for application security.
To truly protect your web applications, you need to protect against both common exploits AND more sophisticated attacks. With CloudGuard AppSec, you get automatic protection against a wide range of attacks without having to worry about accidentally blocking legitimate requests.
4. Can you protect our APIs?
Yes, and we understand your concern. Cyber attacks against APIs are surging, and we’re sure you’re worried about your API ecosystem. Don’t worry. We’ve got your back.
CloudGuard AppSec protects APIs from abuse and misuse by monitoring for unusual behavior and automatically blocking any request not found to be valid.
5. Can you protect our site from malicious bots?
Yes, in fact, we prevented a potentially catastrophic Russian bot attack on a customer site. And the company couldn’t stop singing our praises.
CloudGuard AppSec uses client-side behavioral analysis to distinguish between human and non-human interactions with your site – and will protect you from all kinds of bot attacks including credential stuffing, brute force attacks, and automated account creation.
6. Can you meet our compliance requirements?
Yes and no. Using a solution with WAF capabilities and third-party certifications will help you meet many of your compliance requirements, but not all.
For example, CloudGuard AppSec is SOC2 certified, which means you can trust how we use your customer data. But while we meet the PCI DSS requirements for a web application firewall, you’ll probably need to get quarterly vulnerability scans and satisfy other requirements for how you handle cardholder data.
We recommend you check these requirements as well as other regulatory compliance requirements such as GDPR, NIST, ISO, NERC CIP, and HIPAA.
7. Can you protect applications in multiple environments?
Yes. We designed our next-gen WAF to keep up with today’s technology and staffing needs. You can protect your applications across multi-cloud and on-premise environments – without complex processes that require skilled experts.
CloudGuard AppSec can be deployed in a variety of ways that are easy to implement – including support for AWS, Azure, GCP, Alibaba, VMWare, Nginx, and Kubernetes.
8. Does your solution use a unified management console?
Of course! We know it’s important for you to move quickly, and we know you can only do that if you’re able to manage your many environments from a single console. We take great pride in giving you this ability – as well as a pleasant, unified experience that allows you to intuitively find what you need.
Whether your applications are deployed across different cloud service providers, on-premises, or both, you’ll still be able to manage it all from one place. And if you choose to add on any other CloudGuard CNAPP offerings, you’ll be able to manage those from the same portal as well – so you can get visibility and control of all cloud security activities at once.
9. Can I integrate WAAP capabilities into our CI/CD pipeline?
Yes. CloudGuard AppSec supports REST API and Terraform so you can automate deployment without interfering with DevOps.
By integrating our WAAP solution into your CI/CD, you can rest assured that your applications will be secure from the start – and will remain secure with each and every update.
10. Are you dependent on signature updates?
No. We’re not dependent on signature updates – or any kind of manual intervention or excessive tuning that would raise your cost of ownership and force you to make a trade-off between usability and security.
While CloudGuard AppSec does use signature-based detection and does allow you to fine tune firewall rules, it leans more heavily into its machine learning engine that allows you to train the system so you can preemptively block any malicious traffic while minimizing false positives and operational effort at the same time.
11. How quickly can your solution be installed?
You can have our solution up and running in as little as 10 minutes. Agent deployment is so fast, it’s almost automatic. Deployments on other environments could take longer, but you won’t spend weeks or months getting the full solution deployed.
Deploying CloudGuard AppSec is quick and painless – starting with a simple installation process done through Check Point’s Infinity Portal. This is where you’ll start to configure and “magically” protect your various assets. Just make sure to choose “prevent” mode for that automatic, preemptive protection we discussed before.
Conclusion
Getting answers to these questions is only the start to refining your AppSec goals and choosing the right solution for your needs. But this list can help you take charge of the RFP process and focus on the essentials with confidence and clarity.
Are you most concerned with replacing your legacy WAF? Do you have to meet compliance requirements? Do you need to protect multi-cloud environments? Are there specific threats you want to prevent? Are you worried about resource-intensive deployments?
Only you know what you need, and you certainly don’t want to overwhelm yourself or your vendors with a laundry list of requirements that will be nearly impossible to use for a simple vendor comparison.
We recommend you start with our short list to help you narrow down your candidates. And we hope you’ll add CloudGuard AppSec to your list – so we can help you understand the benefits of choosing an automated, cloud-native WAAP solution in more detail – and get you on your way to stopping all kinds of attacks against your web applications and APIs.
And if you need complete, cloud-native application protection or want to hand-pick individual solutions covering the entire development lifecycle from pipeline security through build and runtime, then getting started is as easy as signing up for one of our free cloud security trials.
CloudGuard AppSec is currently available for a 30-day free trial and legacy WAF trade-in.
If you’d like to learn more, we recommend you check out the following whitepaper, documentation, and on-demand-demo. You can also read any of the “related articles” below.
And if you would like to contact us, or speak with your Check Point account manager or approved partner, please get in touch at: https://www.checkpoint.com/about-us/contact-us/.
Follow and join the conversations about Check Point and CloudGuard on Twitter, Facebook, LinkedIn, and Instagram.