Now Available: Compliance Centric SaaS Security Posture Management Solution

[pneelakrishn]

Enterprises around the world are challenged with managing the configurations of several enterprise SaaS applications and making sure they remain compliant. In fact SaaS is currently responsible for ~70% of company software use and is forecasted to rise by 85% in 2025 as cited here. That’s why we are excited to announce the latest innovation in SaaS Security Posture Management- An actionable compliance-centric view for managing all their enterprise applications configurations in one place. Rolled out on May 13, 2024, this feature marks a significant leap forward in empowering customers with advanced visibility and control over the configurations of their enterprise cloud applications.

Our latest enhancement, a compliance-centric SaaS security posture management solution, is designed to empower cybersecurity administrators with both a panoramic and granular view of their cloud application configurations from a compliance perspective. Customers gain the ability to navigate audits with ease, fixing non-compliant settings swiftly and even enabling drift prevention to maintain compliance in perpetuity. Our solution prioritizes compliance, meeting customers' first requirements effectively. Moreover, it goes beyond compliance, ensuring robust security measures to safeguard data and systems.

Key Benefits

1. High-Level Visibility: Gain Compliance 360 for all standards supported across all SaaS applications and instances.
2. Granular Visibility: Dive deep into specific compliance standards, identifying non-compliant settings and receiving suggestions for remediation.
3. Remediation Options: Enjoy the flexibility of auto-remediation with drift prevention or manual remediation, with clear step-by-step guidance.

How it Works

Navigate to the Compliance dashboard to view a summary of your compliance posture across all the SaaS applications that SSPM is monitoring. The dashboard shows your overall compliance posture across the following common compliance standards and frameworks:

• NIST Cybersecurity Framework: The U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) provides guidance to organizations on how to manage and reduce cybersecurity risks. Its recommendations are designed to help organizations of all sizes implement best practices.
• Critical Security Controls (v8): The Center for Internet Security (CIS) Critical Security Controls (CSC) Version 8 are a prioritized set of recommended actions and safeguards to help organizations protect their data from known cyberattack vectors.
• System and Organization Controls 2: The System and Organization Controls Type 2 (SOC 2) is an auditing framework, developed by the American Institute of Certified Public Accountants (AICPA), for assessing how well service organizations store, process, and transmit sensitive data on behalf of their clients or user entities.
• Payment Card Industry Data Security Standard: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements for storing, processing, and transmitting credit card data. Its primary purpose is to protect cardholder information and prevent credit card fraud.
• NIST 800-53: The U.S. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 is a standard for Federal Information Security Modernization Act (FISMA) compliance. It governs the security and privacy of federal information systems.
• ISO 27001: The International Organization for Standardization (ISO) 27001 standard describes controls and processes for the establishment, maintenance, and improvement of an Information Security Management System (ISMS).

For each of these standards and frameworks, the Compliance dashboard summarizes the status of policies that map to the standard or framework. The failed policies represent settings that are not compliant. From the dashboard, you can navigate to compliance reports for each of the compliance standards and frameworks. The compliance reports show the misconfigured settings by SaaS application. From there, you can drill down further to view the settings that passed and failed, and remediate settings as needed.

Step 1: To navigate to the Compliance dashboard, select Posture Security Compliance.

The Compliance dashboard displays the overall compliance of SaaS applications that SSPM is monitoring, and the number of policies for each compliance standard that passed and failed. The dashboard table includes more details, such as the number of application instances with settings related to the compliance standard.

 Step 2: To view more details about your organization's compliance to a particular standard, click its name in the Standard column of the table.

The details page shows the distribution of compliant and non-compliant policies and settings related to the standard. This distribution is across all SaaS applications monitored by SSPM. The compliance report breaks the distribution down by each SaaS application.

Step 3: To view the settings of a SaaS application that are not compliant with the standard, click the number in the Non-Compliant column of the table. The Security Settings page displays the misconfigured settings related to the compliance standard.

You can use the Compliance filter this on this page to show settings for other compliance standards.

On the Security Settings page, review the current settings that are not compliant with the standard. Review each setting's current value and recommended value and take action as needed.

If automated remediation is available, you can Remediate the non-compliance with a single click. Otherwise, you can follow the steps for Manual Remediation.

Conclusion

In summary, Palo Alto Networks Compliance-Centric SaaS Security Posture Management Solution revolutionizes enterprise SaaS security. With advanced visibility and remediation options, it ensures compliance across diverse standards. Its intuitive interface streamlines audits and empowers users to maintain robust security effortlessly. Join us in enhancing your compliance journey.

Explore more by reading the SaaS Security Administrator's Guide.

Stay Compliant, Stay Secure!

Best Regards,

Priyanka Neelakrishnan  |  Product Line Manager, Cloud Security