By Jonathan Maresky, Cloud Product Marketing Manager, published October 14, 2021
Cloud security has become business-critical as organizations expand and deepen their cloud presence. According to the Check Point 2020 Cloud Security Report, 75% of surveyed organizations were either very or extremely concerned about cloud security. The figure below illustrates the kind of multilayered yet unified cloud security platform that organizations should put in place in order to protect their cloud deployments and ensure a robust cloud security posture. Similarly, a recent Forrester study stated that cloud security confidence is a leading driver for adopting more cloud services.
Figure 1: The Multiple Layers of a Unified Cloud Native Security Platform
It is always important to remember that cloud security takes place in the context of a shared responsibility model. At the infrastructure level (IaaS), cloud providers are responsible for securing their compute-network-storage infrastructure resources while users are responsible for protecting the data, apps, and other assets deployed on the infrastructure. The tools and services offered by cloud providers to help users uphold their end of the shared responsibility model are important elements of any cloud network security solution. However, cloud providers are not specialists in security; these cloud provider tools and services must be complemented by partner solutions in order to achieve enterprise-grade network security.
As shown in figure 1, a key foundational layer is cloud network security, where organizations should deploy virtual security gateways to provide advanced threat prevention, traffic inspection and micro-segmentation. Such security solutions use multiple layered security technologies including Firewall, IPS, Application Control, DLP and others.
This article describes the ten essential considerations a company should examine when choosing its cloud network security platform. It explains how you can ensure that vendor solutions have the capabilities that are important to your organization’s success and security.
Threat detection is not enough to effectively protect cloud assets in today’s complex cybersecurity landscape. You need multilayered, real-time threat prevention for both known and unknown (zero-day) vulnerabilities. The solution must deliver deep security through features such as granular and deep traffic inspection, enhanced threat intelligence, and sandboxing that isolates suspicious traffic until it is either validated or blocked. And these advanced capabilities must be deployed on both North-South (incoming/outgoing) and East-West (lateral) traffic.
2. Borderless
The solution must run transparently and consistently across even the most complex multi-cloud and hybrid (public/private/on-prem) environments. A unified management interface (sometimes called a “single pane-of-glass”) should provide a single source of cloud network security truth as well as a centralized command and control console.
3. Granular Traffic Inspection and Control
Look for next generation firewall (NGFW) capabilities, such as fine matching granularity that goes beyond basic whitelisting, deep inspection to ensure that traffic matches the purposes of the allowed ports, advanced filtering based on URL addresses, and controls at not just the port level but the application level as well.
4. Automation
In order to match the speed and scalability of DevOps, the solution must support high levels of automation, including programmatic command and control of security gateways, seamless integration with CI/CD processes, automated threat response and remediation workflows, and dynamic policy updates that don’t require human intervention.
5. Integration and Ease of Use
The solution must work well with your company’s configuration management stack, including support for Infrastructure as Code deployments. In addition, the solution has to be deeply integrated with the cloud providers’ offerings. In general, your goal should be to streamline operations and promote ease of use by minimizing the number of point security solutions that have to be deployed and managed separately.
6. Visibility
The solution’s dashboards, logs, and reports should provide end-to-end and actionable visibility into events as they are happening. For example, logs and reports should use easy-to-parse cloud object names rather than obscure IP addresses. This visibility is also important for enhanced forensic analytics should a breach take place.
7. Scalable, Secure Remote Access
The solution must secure remote access to the company’s cloud environment with features such as multi-factor authentication, endpoint compliance scanning, and encryption of data-in-transit. Remote access must also be able to scale quickly so that, during times of disruption such as the COVID-19 pandemic, any number of remote employees can work productively yet securely.
8. Context-aware Security Management
The cloud network security solution must be able to aggregate and correlate information across the entire environment—public and private clouds as well as on-prem networks—so that security policies can be both context-aware and consistent. Changes to network, asset, or security group configurations should be automatically reflected in their relevant security policies.
9. Vendor Support and Industry Recognition
In addition to the features and capabilities of the solution itself, it is also important to take a close look at the vendor. Is it highly rated by independent industry analysts and third party security testing companies? Can it meet your SLAs? Does it have a proven track record? Can it provide added value, such as network security advisory services? Can it support your global operations? Is it committed to innovation so that its solution will be future-proof? Is its software mature, with few vulnerabilities, and does it deliver timely fixes?
10. Total Cost of Ownership
The total cost of ownership is determined by a number of factors, all of which should be considered as part of the buying process: the flexibility of the licensing model, the extent to which the cloud security platform seamlessly integrates with and leverages existing IT systems, the level and scope of personnel required to administer the system, the vendor’s MTTR and availability SLAs, and more. You want your cloud security platform to streamline operations, optimize workflows, and reduce costs while enhancing your security posture. The last thing you want is to be surprised by hidden infrastructure, personnel and other costs that emerge only after the system is up and running.
Conclusion
Organizations are increasingly moving to the cloud to meet business demands. These organizations want the ability to control their own data and keep it private, protect themselves from cyber threats and securely connect their cloud with their traditional on-premises network, all while maintaining compliance with regulatory mandates. Adopting a cloud network security solution that meets these requirements will help organizations remain protected in an increasingly complex threat environment.
What’s next?
The top ten considerations above are taken from a recent Check Point white paper, the Buyer’s Guide to Cloud Network Security.
If you are migrating to the cloud and evaluating cloud network security solutions, download the guide to understand:
- The top 10 considerations when evaluating and choosing a cloud network security solution in more detail
- An overview of Check Point CloudGuard and how it answers these top 10 considerations
- The relative benefits of the solutions provided by leading cloud providers and third-party security vendors
Another fascinating document is the Forrester Total Economic Impact of CloudGuard Network Security:
Forrester Research interviewed a $10B+ US-based healthcare company who uses CloudGuard to secure their hybrid-cloud deployment and generated a 169% ROI. To read this document, click here.
If you’d like to learn more about CloudGuard Network Security, please speak with your Check Point channel partner, your account Security Engineer or contact us.
If you are in the process of planning your migration to the cloud, please fill in the form to schedule a demo, and a cloud security expert will help to understand your needs.
Do you want to read more about cloud security?
Download the Check Point cloud security blueprint documents:
- Introduction to Cloud Security Blueprint introduces the cloud security blueprint and describes key architectural principles and cloud security concepts.
- Cloud Security Blueprint: Architecture and Solutions explains the blueprint architecture, describes how Check Point’s cloud security solutions enable you implement the blueprint, and how these address the cloud security challenges and architectural principles that were outlined in the first document.
- This document provides reference architectures for implementing the cloud security blueprint.
If you are ready to trial CloudGuard Network Security in your public or private cloud, contact us to ask if there is a 3 hour deep-dive technical workshop in your region/country and even in local languages. If you have any other questions, please contact your local Check Point account representative or partner using the same contact us link.
Follow and join the conversations about Check Point and CloudGuard on Twitter, Facebook, LinkedIn and Instagram.