Cloud Native Tools

Table of Contents

The CNAPP is advantageous in a number of ways, with the key benefit of increasing Security Visibility to the cloud.

CNAPP
#

A Cloud-Native Application Protection Platform (CNAPP) provides a holistic view of cloud security risks in one platform.

As noted, a CNAPP integrates multiple cloud security capabilities, including CWPP, CSPM and CIEM, even with Kubernetes Security Posture Management (KSPM), with compliance and cybersecurity risk management.

Besides, CNAPP could incorporate shift-left capabilities to identify risks in development lifecycle.

With an agentless CNAPP deployed, the platform can address the cloud security gaps that traditional agent-based tools cannot.

Benefits of CNAPP include centralized management, enhanced visibility, improved security posture, and deeper insights into cloud environments.

Let’s explore the 3-key common components of cloud native tools under CNAPP platform.

Key Components
#

Cloud Workload Protection Platform - CWPP: Protects workloads by detecting threats, managing vulnerabilities, and addressing security risks.
Cloud Security Posture Management - CSPM: Monitors cloud environments, manages configurations, and proactively applies controls for security and compliance.
Cloud Identity Entitlement Management - CIEM: Manages identities, access rights, and permissions to mitigate excessive privileges and data breaches.
Kubernetes Security Posture Management - KSPM: Manages continuous monitoring (misconfiguration), assessing (image/host vulnerability, access control and identity management), and ensuring the security and compliance of Kubernetes environments.

CSPM & CWPP
#

Here’s the summary of CSPM and CWPP.

	CSPM	CWPP
Focus	Security posture & compliance of cloud infra	Protection of cloud workloads & applications
Scope	Monitor configuration, identity & access, storage.	Protect VM, container, serverless workloads, code
Approach	Preventive & proactive	Reactive & protective

Capability	CSPM	CWPP
Monitor for misconfiguration & vulnerabilities	Yes	No
Identifies compliance gaps	Yes	No
Provide risk assessment & visualization	Yes	No
Integration into cloud provider API for visibility	Yes	No
Measureing the cloud infra and platform services	Yes	No
Protect against malware & intrusions	No	Yes
Enable workload behavior analysis & anomaly detection	No	Yes
Runtime app security protection	No	Yes
Workload hardening and configuration	No	Yes
Vulnerability Management	No	Yes
Utilize agents for intra-workload	No	Yes

Limitations
#

Disadvantages of CSPM & CWPP:

CSPM can only identify simple control plane misconfiguration.
Some CSPM could have limited insights to workload posture.

Others
#

Cloud Access Security Brokers - CASB: Brokers each session between users and cloud service to enforce policy for enterprise, such as authentication, SSO, authorization, credential mapping, device profiling, encryption, logging, alerting, malware detection/prevention.

Security Visibility
#

When come to the cloud, the key is Security Visibility.

Here’s the evolution of security visibility: starting from agents, then scanners, and CSPM.

	Agents	Scanners	CSPM
Scope	Host	Network	Cloud
Focus	Full visibility to OS, Apps & Data	Scan apps & network	Examine cloud metadata
Looking for	Rogue activity	Improper response	Deviations and misconfiguration