Over the past five years, public cloud adoption has shifted from mostly lift-and-shift of traditional VM workloads to a single cloud provider to today’s reality of rapid adoption of cloud native services. Today, multi-cloud is the norm rather than the exception, and there’s been an ongoing shift to dynamic, ephemeral, and immutable workloads. As these changes have taken root, it stands to reason that security approaches developed for the public cloud several years ago need to evolve as well. Enter the cloud native application protection platform, or CNAPP.
CNAPP converges CSPM, CIEM, and CWPP
CNAPP is a new category of security products that incorporates cloud security posture management (CSPM), cloud infrastructure entitlement management (CIEM), and the cloud workload protection platform (CWPP). If you feel like you’re drowning in the acronym soup of the prior sentence, here it is in plain English: a CNAPP ensures that your cloud workloads are secure, combining security for cloud infrastructure and services with security for workloads/applications. And despite what “cloud native” in the name might imply, these platforms should be just as applicable to workloads leveraging cloud native services as they are to traditional application workloads that are lifted-and-shifted to the cloud.
Top CNAPP capabilities
Rather than provide an entirely new set of security capabilities, a CNAPP converges multiple existing capabilities to holistically address cloud application risk, including:
- Identifying and remediating security and compliance violations caused by misconfigurations of services across your multi-cloud footprint. These are functions typically associated with CSPM functionality. It’s important to note that, increasingly, coverage is not only of the cloud services, but Kubernetes environments as well.
- Identifying excessive permissions granted to cloud users and cloud services/workloads, allowing you to set and enforce a strategy of least privilege. These are functions typically associated with CIEM functionality.
- Performing hardening and vulnerability management and identity-based segmentation of cloud workloads and network-based behavioral monitoring, the foundational technologies associated with CWPP functionality.
What about runtime protection?
With the rise of CNAPP, there is significantly less need for runtime protection capabilities. Starting with pre-deploy, CNAPP provides continuous validation of workload posture. In an environment with immutable infrastructure and short-lived workloads that make it impossible for attackers to achieve persistence, CNAPP delivers on runtime protection needs from outside of the workload, via identity-based segmentation and monitoring/control of workload behavior on the network. The use of identity for segmentation enables organizations to extend zero trust security to cloud workloads.
The Zscaler CNAPP solution
Zscaler Cloud Protection (ZCP) is a powerful answer to the growing need for CNAPP. ZCP delivers a new approach that takes the operational complexity and headaches out of cloud workload security. Our innovative zero trust architecture reduces business risk by automatically remediating security gaps, minimizing the attack surface, and eliminating lateral threat movement.
If you’ve been challenged with a public cloud security stack that is fragmented across many different tools from third-party vendors as well as cloud service providers, I would urge you to take a look at how ZCP can simplify your cloud security infrastructure while improving security with a zero trust approach.
Read more:
Blog: Simplifying and Automating Cloud Workload Protection
