Application security has become a complex, distributed problem. During the days of waterfall development and monolithic applications, application security was pretty straight forward – statically scan your source code, dynamically test your business logic, and deploy a web application firewall to protect layer 7 traffic. But with agile development, DevOps processes, and containerized applications, application security has evolved into a more robust market with lots of new solutions. Add the cloud and it gets even more complex. How does an organization effectively correlate, prioritize, and remediate vulnerabilities and misconfigurations across a complex cloud or hybrid architecture?
Although the industry analysts like to create new security markets, the goal should be to consolidate findings across the various components of the application and cloud infrastructure into a single, DevOps friendly tool to prioritize and remediate vulnerabilities quickly. We see these tool starting to emerge in two areas: Application Security and Cloud Security. For applications, we see a consolidation of the following components:
- Custom Code (i.e., static and dynamic analysis)
- Open Source/Third Party Code (i.e., software composition analysis)
- Orchestration/Containers (i.e., endpoint security, Kubernetes security, and container security)
In the cloud, we see a consolidation of the following components:
- Cloud Infrastructure (i.e., infrastructure as code, cloud workload protection, and cloud security posture management).
- Orchestration/Containers (i.e., container security and serverless)
- Application Programming Interfaces (i.e., web application firewalls and API security)
We also need to address user, service, and machine accounts (i.e., access and entitlements) across this distributed architecture. As you can see, delivering on the promise of application security in a cloud deployment is easier said than done. So where do you start?
We recently interviewed Ankur Shah, Vice President of Products, Public Cloud Security at Palo Alto Networks, on Application Security Weekly to discuss how Prisma Cloud is addressing these challenges. Palo Alto has been acquiring many companies and integrating them into Prisma Cloud to solve the complexities of cloud, including:
- Visibility, Compliance, and Governance
- Threat Detection
- Data Security
- Host Security
- Container Security
- Serverless Security
- Web Application and API
- Identity-Based Microsegmentation
- Identity and Access Management Security
To see how Prisma Cloud can help protect your applications in the cloud, watch the interview on Application Security Weekly here or visit securityweekly.com/prismacloud for more information.
