About RPrasadi

By Carlos Martins Jr., Customer Success Engineer   With the introduction of CBDR (Code, Build, Deploy, Run) Implementation Plans on LiveCommunity, Palo Alto Networks is enhancing how we look at Prisma Cloud in our customers' environments. Prisma Cloud touches every part of your app and infrastructure lifecycle, so knowing what the product does and when is essential. For example, shift-left security helps detect issues and misconfigurations earlier in the app dev lifecycle. In addition, visibility enables you to avoid technical debt and other problems in the product lifecycle.      As a part of this shift in perspective with CBDR, we are soon introducing new customer success sessions to help our premium customers find as much value as possible with Prisma Cloud. One of the premium sessions, “Visibility in the Code & Build Lifecycle,” discusses Prisma Cloud's features to assist you in your product lifecycle's code and build phases. Let’s look at some topics covered in this session.   VCS/CI/IDE/CLI Scans with Code Security   Prisma Cloud offers the new Code Security framework, which scans your IaC files, container images, and more. There are several ways to use the Code Security scanning features, such as scanning your VCS directly, using CI integration for scans and IDE or CLI-based scans for developers.    These three integration methods will cover the most critical areas of concern in a software development lifecycle:   IDE and CLI integrations are ideal for a shift-left approach to security, bringing the knowledge of security professionals directly to the development process and significantly reducing avoidable mistakes.    CI integration will ensure that any code passing through a CI/CD pipeline undergoes another round of scans. The scan ensures nothing is missing or changed when the developer makes their first pass with the IDE or CLI tool. The CLI tool can also be leveraged in the CI process if necessary.    You can scan the code at rest in a repository. In addition, code security scans regularly check the code base to ensure you can address any emerging threats or configuration mistakes after developers are reassigned to other projects or tasks.    Code Security Projects   The Projects section of Code Security will be the landing page for anyone using the platform to remediate issues in IaC.   Here are the scan results for the integrated repositories, CLI, and CI scans. This page serves as the main source of results, drift detection, and contextual information relating to resources covered by the scan. The results also include tags, configuration details, and a history of issues found with the resource.    Projects also provide the ability to suppress and automatically fix select issues with the press of a button. This action sends all necessary information about the proposed changes directly to the integrated VCS, where the code base resides.    Code Security IaC Tag and Trace + Drift Detection   Code Security offers the ability to automatically add tags to cloud infrastructure via your integrated code repositories and use drift detection to track and remediate any changes made to your cloud infrastructure. Using tags and drift detection can improve traceability and compliance in your cloud environments. Additionally, you can fix the drift via another IaC deployment to overwrite the drift or by merging the change into your VCS via the pull request feature in the UI.    Tagging also offers the ability to create custom tags that can be applied to specific repositories and tracing tags that enable drift detection. They will display as merge requests in your VCS after a scan. This can save you a lot of time tagging and ensuring that every tag is in its proper place.    Code Security Supply Chain   The Code Security Supply Chain offers a different perspective by giving customers a visual representation of the code base that can help facilitate discussions between teams about the attack surfaces and the overall impact of the scan results. This is shown in the form of the “Supply Chain Graph.”      This graph is handy for visualizing the package dependencies in your code base to give you an idea of how vulnerable your packages and libraries might be. It can help a developer to identify possible supply chain attacks due to risks associated with the dependent packages, such as attack vectors, open source licenses and vulnerabilities.    In addition, it allows you to drill down into each package for more information about the vulnerability and the possible fixes available. This page also allows you to generate an SBOM (Software Bill Of Materials) for sharing results with stakeholders in CSV or CycloneDX format.   Development Pipelines   Code Security Development Pipelines help with visibility into pull requests and code reviews that provide issue and vulnerability concentration in repositories over time. The data this feature displays can be helpful for a manager or security analyst who needs a high-level view of the IaC's overall health. This feature gives you a global view of all the scan results performed on the repository with insights based on pull requests (PR) and merge requests (MR).     In addition, Prisma Cloud analyzes the number of Git users and weekly commit status to give you a “trend line” of the repository, which helps identify critical issues in an active repository. You can also see insights for scans performed on all branches integrated on CI/CD, pull requests (PR) and merge requests (MR) in a VCS. These insights are structured to give you access to the latest information first.   Image Analysis Sandbox in CWP   Using the Image Analysis Sandbox feature in Prisma Cloud Compute, you can test container images to ensure they are safe and free from malicious images and suspicious findings. In addition, you can leverage the Image Analysis Sandbox to analyze your container images on demand or as part of your CI/CD process.      Every report will provide information about the container image. This can include the SHA-256 hash representing the image ID in Prisma Cloud, the OS the container runs on and any other scan results for this image.    Conclusion   Because Prisma Cloud is designed with the software lifecycle in mind, your organization can benefit from combining all of these features with one solution. The ability to scan code packages and containers for license issues and vulnerabilities, IaC misconfigurations, exposed passwords and much more, keeps your data safe with the ease of a centralized command center.  About the Author     ... View more

  In February 2023, we released the latest capabilities for Prisma Cloud CIEM including integration with AWS IAM Identity Center, support for AWS tags, and permission level in Azure. Please join us as we showcase and demo these new functionalities. ... View more

By Julian Neytchev, Sr. Cloud Security Engineer   Introduction   Infrastructure as Code (IaC) makes creating, managing and collaborating around cloud infrastructure easier.  DevSecOps provides automated tools and shifts left the security to the developer.  This shift left allows security and compliance to be part of the development process, and not an afterthought in production. Security becomes part of the whole DevOps lifecycle, leading to a more secure product in production.    To facilitate the shift left, tools that scan IaC for compliance and vulnerabilities need to be available to the software development team.  These tools are used to check code prior to check-in for your source code repository and after check-in to your source code repository for your code review.     It is important to understand how Prisma Cloud Code Security can integrate into your development lifecycle through the coding and building phases to ensure repeatable code in your runtime environment infrastructure.    Figure 1: Development Lifecycle_palo-alto-networks    GitOps Definition   Git Operations or GitOps is a method for managing infrastructure and application deployments as code, using Git as a single source of truth.  In cloud computing, GitOps can be used to maintain the desired state of an infrastructure in a Git repository, and continuously synchronize it with the actual state of the infrastructure.    In typical GitOps setups, all infrastructure state is maintained via a continuous deployment pipeline. The deployment pipeline is triggered by changes pushed to the source code repository, automatically applying the desired state to the infrastructure, ensuring that it remains in a consistent and predictable state. This makes it easier to manage and maintain infrastructure, as all changes are version controlled, auditable, and reversible. Figure 2: General GitOps workflow _palo-alto-networks     Git Workflow   A typical Git operation for submitting a pull request (PR) against an infrastructure as code repository follows the following steps:   Check out the repository Create a new branch Make changes to IaC code Commit changes to your branch Push changes to a remote branch Submit a pull request Code review. Your colleagues, manager and DevOps engineer will review and discuss the desired changes. Merge or reject Deploy to your environment upon approval    In a GitOps workflow, all changes to the infrastructure are version-controlled and auditable, making it easier to track changes, collaborate, and ensure the infrastructure is always in a desired state. When there are issues, the infrastructure can be rolled-back to a known good state.    Improving GitOps security   Adding a static scanning tool into your GitOps workflow can improve the quality of code produced by detecting issues early in the development process and automatically enforcing best practices and coding standards. Some benefits of using a static scanning tool include:   Automated code analysis A static scanning tool can automatically analyze IaC code for security vulnerabilities, syntax errors, and other issues, reducing the risk of human error and speeding up the development process. Best practices enforcement The tool can enforce best practices and coding standards, ensuring that all code is written in a consistent and high-quality manner. Early issue detection Issues can be detected early in the development process, reducing the risk of problems later in the pipeline and speeding up the resolution of problems. Improved collaboration By automatically enforcing best practices and coding standards, the tool can improve collaboration between team members and increase the quality of code produced. Increased security By detecting security vulnerabilities early in the development process, the tool can reduce the risk of security breaches and ensure the IaC is secure.   Prisma Cloud Code Security (CCS) can detect and prevent cybersecurity risks in infrastructure code before it is deployed. By adding the command line tool checkov to their workflow, developers can inspect their infrastructure code even before it is submitted as a pull request. Furthermore, checkov can be integrated with the CI/CD pipeline and perform analysis on infrastructure code  and terminate the pipeline if critical errors are detected before the code is handed to the orchestrator of choice.   Figure 3: GitOps workflow protected with CCS _palo-alto-networks There are 3 ways to incorporate infrastructure code scanning in your workflow as a developer: VCS only Utilize your version control system integration with CCS. You will get periodic repo scans, PR comments and fixes (where available) and drift detection. Integrating your VCS with CCS.   VCS plus local Use your VCS integration and checkov to scan your code before you push your changes. You can elect to manually scan your code, or you can integrate checkov with your integrated development environment (IDE). You will get the same benefits as just the VCS integration, plus earlier scan results, reducing remediation time and empowering your developers.    VCS, local scanning, CI/CD pipeline All of the above benefits are included, plus additional scanning flexibility and the ability to block your pipeline if critical errors are detected. Here is how you can integrate Jenkins with CCS . You can also see other integrations supported by  Prisma Coud CCS.    Let’s review the setting up the developer’s environment, as this is usually the first step new users take to get themselves familiarized with CCS. Make sure you have your infrastructure code repository enrolled in CCS. Make sure you have created your Access Key ID and know your secret key and API URL (it will be in the form of https://apiX.prismacloud.io where X is the number of your tenant, see here for a list.) Please follow security best practices and set an expiration date for the Access Key and rotate following your organization’s best practices.   Select one of the following options: Manual scans You can manually scan you infrastructure code repository from the command line: Add the following to your ${HOME}/.bash_profile (linux) or ${HOME}/.zshrc (mac) export PRISMA_ACCESS_KEY_ID=<your-value-here> export PRISMA_SECRET_KEY=<your-value-here> export PRISMA_API_URL=https://api<your-value-here>.prismacloud.io export BC_API_KEY=${PRISMA_ACCESS_KEY_ID}::${PRISMA_SECRET_KEY} Now you are ready to install checkov. pip3 install -U –user checkov   As long as you have sourced you bash or zsh profile file, you can change into the directory with your infrastructure code and run your first manual scan:   cd <your-value-here> checkov -d . Prisma Cloud documentation documenting this process.   IDE integration Connect you IDE with Prisma Cloud Code Security . You can perform a scan from within the IDE, plus you will be notified of potential errors as you write your infrastructure code in real time.   Once you have checkov integrated with your workflow and have performed some scans, you should be able to see results in the CCS console:   Figure 4: Scan results in CCS console _palo-alto-networks     Your VCS will have PR comments plus the ability to automatically submit code fix PRs for some of the violations:     Figure 5: PR comments and fixes in your VCS _palo-alto-networks   Conclusion   Along with the benefits of code scanning / compliance, CCS also offers: Automatic remediation Ability to automatically fix common errors. Drift detection Continuously verifying that your infrastructure is in a state described in your code. Any manual changes to running assets will be flagged and alerted on. Software composition analysis Ability to inspect all underlying packages of your application and find vulnerable versions and incompatible licenses. Secrets scanning Ability to identify potential leak of credentials if they are contained within the code that is about to be pushed to a VCS instance.   Prisma Cloud Code Security offers various comprehensive benefits to support the development lifecycle of your organization’s infrastructure as outlined above.   About the Author:   Julian Neytchev is a Sr Cloud Security Engineer on the Prisma Cloud SWAT team, specializing in Cloud Application Security. Julian uses collaborative approaches to break down complex problems into solutions for global enterprise customers and leverage his vast industry knowledge to inspire success.  ... View more

By RD Singh,  Sr Customer Success Engineer       Prisma Cloud Compute protects your containerized environment according to the policies you set in Prisma Cloud Console. Watch this demo with RD Singh, Sr. Customer Success Engineer, to learn how to Protect AWS ECS EC2 nodes and Fargate task with Prisma Cloud Compute Defender.   ... View more

By RD Singh, Senior Customer Success Engineer   Incident response is a daily problem to solve in cybersecurity. Bad actors are constantly looking for new ways to hack into an enterprise. Due to the consequences of ill-intentioned hacking causing potential distress at a global scale, we all have a responsibility to be as prepared as possible to better protect our environments by the proactive action of incident response. Through the Cloud Workload Protection Platform (CWPP) of Prisma Cloud, there are ways to be proactive in achieving goals in incident response while creating protocols to coherently scope your applications and accounts in these environments. In this article, you will learn about the primary scoping utility that is available to you in the console through collections and approaches to optimally create scope.   When utilizing the Prisma Cloud Compute Console, a tool that can help you have the most efficient environmental setup within each cloud environment is collections . Collections allow you to be able to have the scoping that is necessary to be able to triage your incident response as well as proactively give you the capabilities that you will need to be able to report on any incident. Collections will also allow you to have an organized view into your cloud resources to be able to better help with your use cases. If your cloud environment is disorganized at the cloud service provider level, it will be a good practice to begin to organize these environments. One option is to look within the console to be able to work backwards in creating this coherency in every environment over time. Let’s begin to take a look at how collections can help you to have a better experience in utilizing cloud security technologies.    To locate collections in your Prisma Cloud Compute console, navigate to the “ Manage > Collections and Tags.” This will present you with the current set of collections available to you in your Prisma Cloud environment.    Figure 1: System defined collections_palo-alto-networks   To add a new collection, you will need a resource onboarded for the collection to be relevant. Click on the “ Add Collection ” button and you will be able to see the different options available to you in scoping resources within your new collection.   Collections are created with pattern matching expressions that are evaluated against attributes such as image name, container name, hostname, labels, function name, namespace, and more.     Figure 2: Create New Collection_palo-alto-networks   There are several options to create nested scoping within your collection.    The easiest way to achieve primary scoping is through a color code that can be associated with a type of environment, team, business unit, or stage in your software development lifecycle that a resource may reside in. There is none to minimal limitation to how you can define your scoping.   There are 20 unique color codes available to you within this primary scoping. To best utilize these available encoded value potentials, you can select a piece of your scoping that is relatively static and less than 20 in the objective count. This could be a business unit and, as an example, if you are a pharmaceutical company that has business units in research, accounting, human resources, technical support, management, cloud technology, and growth, you could assign a color code to represent each respective business unit to be able to standardize the scoping of your cloud resources.    Figure 3: Color Code scoping_palo-alto-networks  The last scoping tool that will be discussed in this article is tagging (Manage > Collections and Tags > Tags) . Though it does not correlate directly to what can be utilized within a collection, tagging can help with incident response through allowing you to associate a tag to either an individual CVE or a package within an individual CVE that is available within the threat intelligence feed. This tag can then be applied to a vulnerability rule and an alert profile so that if you had a security incident with a CVE, such as CVE-2021-44228, you could then have that rule send a notification to an alert profile whenever that tagged CVE is detected.    Figure 4: Define Tags_palo-alto-networks    To further study this topic, check out this previous article: Understanding the Security Posture of your Organization - log4j . Conclusion   You now have the tools to effectively scope the cloud resources that you onboard into the console.  References : Prisma Cloud Administrator’s Guide (CWP): Collections About the Author RD Singh is a senior customer success engineer specializing in Prisma Cloud, Next-Generation Firewall, AWS, Azure, GCP, containers and Kubernetes. RD uses collaborative approaches to break down complex problems into solutions for global enterprise customers and leverage their multi industry knowledge to inspire success.  ... View more

By Shashank Chandramohan,  Sr Customer Success Engineer   In the Code Build Deploy & Run (CBDR) framework, securing the Deploy Lifecycle can help you prevent privileged containers, poisoned pipelines, compliance violations, and exposed branches before deploying your workloads.    This blog discusses how you can utilize Prisma Cloud’s Compute Workload Protection functionality to secure resources within your Deploy Lifecycle after the initial setup. You can leverage knowledge in the next steps after installing Defenders, creating policies and rules .   Defenders First, we will explore the radar section and discuss the environment before moving on to the best practices and recommendations for Defenders.   Navigate to Radars > Cloud .    This gives you a holistic view of where and what type of cloud accounts you have ( Cloud Discovery must be enabled at the time of onboarding ). This is a general overview of the number of resources you have in the cloud platform and how many resources have defense coverage along with the number of resources and the types of resources that are not defended.   The sidebar also contains the vulnerabilities for impacted resources and compliance information. Now you have a complete picture of your environment and its state.   Once you have installed Defenders and have a fair idea about your environment with the help of Radar view you can start managing Defenders under Manage > Defenders . Here you can gain visibility on all the Defenders installed and their statuses. Make sure the Defender status is “connected” . Insights are also provided into how long defenders have been connected or disconnected.   You can filter down specific Defenders using the filter feature . Some common use cases are to see which Defenders use old certificates or to list out all Defenders that need to be upgraded. This would help you filter the defenders that only need upgrades.   The best practice is to upgrade the Defenders to the latest version as Prisma cloud supports up to n-2 versions where “n” is the latest version and “-2” is the previous two versions.   Registry Scanning Prisma Cloud can scan container images in public and private repositories on public and private registries. When configuring Prisma Cloud to scan a registry, you can select the scope of Defenders used for performing the scan job.   Registry Scan Behavior Prisma Console controls the registry scan with assigned Defenders. The Console scans one registry at a time. If multiple registries are configured to scan, the Prisma Cloud console will scan one registry until complete before moving on to the following registry. This registry scanning behavior is not configurable.     Compute Vulnerability Policy    Having clear visibility into which vulnerabilities to focus on is crucial to identify four items:   1) The criticality of the alarm 2) The owners of an image resource 3) The actual image resource that is triggering the vulnerability alarm and  4) If there is a fix for the vulnerability.   Without measurability, vulnerability is impossible to manage correctly.  In addition, scanning images in the CI/CD pipeline is crucial in preventing further vulnerabilities from polluting the environment. It is a good practice to solve vulnerabilities based on the severity level. First solving the most critical vulnerabilities followed by high, medium and low. The results can also show if the same package is triggering alarms across multiple images.  Therefore updating one package across multiple images could reduce the vulnerabilities significantly.   Owners It is vital to know who the owners are for cloud resources.  Many customers have no visibility into these resources because they do not have an enforcement of tags in their environment.  If ownership is not clear, it will become challenging to efficiently manage the environment.  Also, tags can be utilized to define scopes in Prisma Cloud in order to block vulnerabilities from polluting the environment.   Alerting-to-blocking strategy It is also crucial to have an alerting-to-blocking strategy– review which images and packages are triggering alarms. If the alarms are not being addressed, those issues can be determined if the blocking for that image is a go or no-go for specific business issues.   Scope When defining scopes, having one for alerting only and one for blocking only is important. When converting images to blocking mode causes an outage, you can easily move the image back to the scope of alerting and triage the situation later.  Once the image has been moved to blocking mode, the CI pipeline scanning is critical in keeping the environment unpolluted.   Compute Compliance The Center for Internet Security (CIS) publishes recommendations for best practices that should be adhered to when setting up machine images, servers, and containers. For convenience, you can access this information within the compliance tab.   Compliance Tab:   Compliance Explorer: shows all non-compliance critical and high alerts Clicking on compliance check will show resources that are not compliant Container level view shows each container in the environment -- name, image, host, cluster, compliance heat map Open up to see the best practices within compliance -- make sure to check the version number for compliance Check compliance standard vendor with description in Prisma Compliance Container View  Compliance vendors will show audits, remediation, etc.   Trusted Images The Trusted Images feature controls developer access to a specific registry, images or layers. Trusted Images ensure that developers are using verified or approved sources for their images and provide a straightforward way to implement the best practices for container security.   It is recommended to specify the images it trusts. Declare trust using objects called Trust Groups. Trust Groups collect related registries, repositories, and images in a single entity. For writing policy rules, it’s recommended to use registries or repositories for the trusted groups, if they are an organization’s golden standard images.   As a best practice, the default rule, Default - alert all should be maintained, and it should be the last rule in your policy as a “catchall” rule. The default rule matches all clusters and hosts (*). It will alert the images that aren’t captured by any other rule in your policy.   Assuming the default rule is in place, the policy is evaluated as follows:   A rule is matched: The rule is evaluated. A rule is matched, but no trust group is matched: The image is considered untrusted. Prisma Cloud takes the same action as if it were explicitly denied. No rule match is found: The default rule is evaluated, and an alert is raised for the image that was started. The default rule is always matched because the cluster and hostname are set to a wildcard   Access Control Admission Control - Prisma Cloud provides a dynamic admission controller for Kubernetes and OpenShift that is built on the Open Policy Agent (OPA) . In Console, you can manage and compose rules in Rego, which is OPA’s native query language. Rules can allow or deny (alert or block) pods. Console pushes your policies to Defender, which enforces them. Decisions made by the system are logged. Once the admission webhook configuration YAML is applied and rules are created, an audit will be created if there are any violations based on your rules. You can monitor this under monitor>events>admission audits. Click on an audit to get more details and it will also hold the cluster information You can also integrate this audit into our alerts integration tool. As soon as the alert is created, you will be notified via the alert provider you select. Kubernetes auditing - The Kubernetes auditing system records the activities of users, administrators, and other components that have affected the cluster. Prisma Cloud can ingest, analyze, and alert on security-relevant events. Write custom rules or leverage Prisma Cloud Labs' prewritten rules to assess the incoming audit stream and surface suspicious activity. Once you have created the rules you can monitor the audits under Monitor > Events > Select Kube Audits . You can filter based on alert techniques and export it as a CSV. Click on an audit to get more details about the cluster, IP, time stamp etc.   By deploying Prisma Cloud’s defenders you gain continuous scanning with a single pane of glass. An overview of the runtime environments, resources, and firewalling make it simple to create reports and integrate new technologies into your stack with a peace of mind. Once the Defenders setup is completed, one can protect their environment by creating vulnerability, Compliance policies and creating alerts for the same. Furthermore, using trusted images gives a simple approach to put the best practices for container security into reality while ensuring that developers are utilizing approved sources for their images. Lastly, establish and monitor access control measures for cloud workloads and cloud native applications.     ... View more

  In December 2022 we released latest capabilities for Prisma Cloud Compute including API Risk Profiling, Enhanced Vulnerability Explorer, App Control for Hosts and Container support for Agentless Workload Scanning. We would like to showcase and demo new functionalities. For more information, please refer to this: API Security and Threat Intelligence Reduce Attack Surface in Prisma Cloud Workload Protection Release  ... View more

Prisma Cloud Compute Admission Control With Open Policy Agent By RDSingh       Prisma Cloud Compute provides a dynamic admission controller for Kubernetes and OpenShift that is built on the Open Policy Agent (OPA). Watch this demo with RD Singh, Sr. Customer Success Engineer, to learn how to enable dynamic admission controller to intercept admission requests to API Server, and then accept or reject those requests as per admission policy configured in the Prisma Cloud Compute. Note: Prisma Cloud currently does not support Admission Controller for Windows. To read the step-by-step instructions outlined in this video, visit our TechDocs:  Access Control: Open Policy Agent ... View more

API Security and Threat Intelligence Reduce Attack Surface in Prisma Cloud Workload Protection Release by Ivan Melia    Three trends with cloud native applications present significant security concerns that can cost your organization through breach or valuable time lost in remediation.    The first area of risk enters with development. Modern cloud-native apps are constructed in CI/CD pipelines consisting of many components and dependencies, any number of which can unknowingly introduce vulnerabilities. The holy grail of vulnerability management is prioritizing vulnerabilities that matter while balancing risk and vulnerability impact on production environments.   Second, most of today’s traffic is web, and most web traffic is via API calls. API is a software intermediary that allows two applications to extract and share data. Cloud-native applications rely on APIs for communication, as APIs are the entry point to our apps and data. The explosive growth of insecure cloud-native deployments has made APIs a primary attack vector.   Third, all systems are vulnerable. It’s only a matter of time before a vulnerability is exploited. Unaddressed vulnerabilities amplify security alerts at runtime, and attackers have bountiful targets when vulnerabilities are discovered because 100% patch rates are rare.   Risk Prioritization Through Prisma Cloud Workload Protection For DevOps and security teams that focus on runtime application security, Prisma Cloud is making it easier to adopt agentless and agent-based architectures that help with prioritizing threats and defending your workloads.    We’re pleased to announce the following key capabilities that reinforce security in your code to cloud journey: API Risk Profiling: We’ve added API risks profiling to our API discovery capability. You can now better understand and prioritize risk based on 200+ risk factors for all APIs in your environment.   Vulnerability Explorer Enhancements: A primary approach to application security involves accurate risk prioritization to enable your team to focus on what’s most concerning. The first step in this process is to have a complete view of your vulnerabilities from filtering threats by risk factors. This is where Vulnerability Explorer comes in.  In our commitment to ongoing development, we’ve added new features that will make it easier for you to identify and prioritize security issues with our Vulnerability Explorer. You’ll find new ways to better track, analyze, and prioritize vulnerabilities across all your workloads.   Application Control for Hosts: With applications and versions evolving, it’s becoming difficult to track what runs on your hosts. We’ve added new capabilities to control applications and their versions that can run on your host machines.   With this protection policy, we provide compliance controls that give users the ability to select which applications can run on their host machines and specify the allowed versions. Now you can reduce the attack surface and ensure continuous compliance controls on all your hosts.   Agentless Workload Scanning for Containers: Now Prisma Cloud can scan container workloads for software vulnerabilities without the need of an agent. Identified vulnerabilities are prioritized with a risk score and a description of risk factors. The risk factor description guides the security team to the best course of action by reporting details — vulnerable packages, attack complexity and attack vector.  With the addition of container agentless scanning, customers can centralize visibility across hosts, VMs, serverless, and containers.   API Risk Profiling Due to the massive growth in APIs, less than 50% of enterprise APIs will be managed by 2025 , according to a recent study by Gartner. The speed of application development makes it incredibly challenging without automation to keep track of all API-associated risks. API Security needs to start with full insight into the risk APIs pose across your cloud environments.    Prisma Cloud has enhanced its API security capabilities with API risk profiling to help teams understand and prioritize risk based on 200+ factors for all APIs in your environment. Understanding the risk factors associated with APIs based on misconfigurations, best practices, exposure to sensitive data and access control is a key step before application security teams can take preventative measures to reduce the API attack surface.    In a single view, Prisma Cloud provides the API endpoint’s path, the method used to call, the number of times it’s been called, what protections are enabled, its risk factors and the vulnerabilities in the underlying workload. Prisma Cloud makes it easy to prioritize risk based on these filters and then users can enable runtime protection to enforce security across the OWASP API Top 10 security risks.     Figure 1: API Risk Profiling and Observations   Vulnerability Explorer Enhancements We improved our risk mechanism for CVEs across a number of areas. First, you can now filter the CVE viewer in the Vulnerability Explorer by risk factors of your choice (see Figure 2). You can include factors, such as whether the container is privileged or if the container is exposed to the Internet. This will help you find affected assets fast.   Second, we added a new risk factor category — ‘Exploit in the wild’ (see figure 3) — with CISA Known Exploited Vulnerabilities Catalog as the main data source. Now you can know which CVEs have a proven risk of exploitation. Based on this, you can create alerts and block policies for ‘exploits in the wild’ vulnerabilities.     Figure 2: Additional search parameters in Prisma Cloud Vulnerability Explorer to help security teams focus on things that matter     Figure 3: Expanded Risk and Environmental factors overview for a more granularity and insights   Application Control for Hosts To minimize the attack surface and prevent vulnerable applications from running on host machines, we’ve added a new capability to detect legacy applications and control the application inventory on your host machines with compliance checks.   Now you can identify legacy applications or the versions of the applications that can run on hosts (see Figure 4). Without this control, vulnerable applications and versions with vulnerabilities can run freely on host machines. But with compliance controls, you have the ability to select which applications can run on host machines and specify the allowed versions. Our compliance controls can alert on a range of versions or raise an alert on specific applications detected on host machines.     Figure 4: Added process for new application control rule in Prisma Cloud   Agentless Workload Scanning Securing cloud environments in an agentless deployment model begins with quick visibility to inventory and threat prioritization but with little to no overhead processes. We are continuing the investment in agentless capabilities to help you map the environment and calculate and prioritize risk as a first step in implementing application security at runtime.    We know that distributed environments, mixed workload types and app stacks require frictionless security. Our latest release of agentless security brings support for containers across the major cloud providers. In addition to container scanning, we’ve introduced host scanning for Oracle Cloud and compliance assessment for Kubernetes clusters across the public cloud, including support for OpenShift clusters.   Learn More To learn more about the latest product updates and discover how Prisma Cloud provides everything you need for cloud-native security, we invite you to take a test drive with a hands-on demo . Prisma Cloud protects application lifecycles from code to cloud for 2000+ customers, securing more than 1.5 billion assets and protecting over 2.5 million workloads by processing roughly 2 billion events each day. Continually recognized by the industry — most recently by Frost and Sullivan — Prisma Cloud was named the Global Cloud Workload Protection Company of the Year and earned Frost & Sullivan’s 2022 award across 10 categories . For its outstanding growth and innovation, Prisma Cloud was also named a Leader in the inaugural Frost Radar: Cloud-Native Application Protection Platforms (CNAPP) study. ... View more

By Priyank Patel,  Customer Success Engineer   APIs are a massive concern for our customers and organizations worldwide and I’m sure you know we have had some API security capabilities within WAAS. However, in our latest 22.12 release , we’ve added more innovations to this feature. What we’re adding is the visualization of all risks associated with the API to prevent attacks that can occur through risky and vulnerable endpoints. So at first, you were able to discover all APIs in your environment, and now we’ve added an additional layer to help prioritize risks by adding in more risk factors. For example, adding capabilities to notify you if APIs containing sensitive information are exposed to the internet. From there we’ve added more insight into vulnerabilities within these workloads, all on the same screen. This helps you prioritize the APIs that contain the highest risk and then add protection for these APIs.    Our goal with WAAS is to address the underlying security. Addressing just the tip of the iceberg isn’t enough. What I mean by that is it is one thing to identify risky endpoints, but what about the rest of the application? How can you secure the entire application? With our latest innovations and continuous efforts, we are the only security company actually addressing the rest of the iceberg.          To showcase the importance of addressing the security of your entire application, going beyond just API security, let's take a look at a real-world example.    In this diagram, a security provider experienced a ransomware attack that originated from an endpoint that was open to the public. Anyone could have sent a call to that REST API endpoint requesting contact details for a customer with contactID. That contactID was directly referenced. One of the best practices here is to randomize contactID and then map that into a real contact. Then finally what happened is the attacker was able to enumerate and exfiltrate millions of customers' data and personal information from their database.    Now, how did this ransomware attack occur and how could it have been prevented? There wasn’t any validation regarding who is authorized to access this API. There was no request tracking or any sort of rate limiting. With our core WAAS capabilities, we are able to provide that type of protection and more than just detecting vulnerable APIs, we’re able to prevent and alert you on these types of attacks.    With our latest release, we have made tremendous strides in protecting your personal and sensitive data using WAAS and API Discovery. Bad actors are getting better and better at stealing sensitive data and we’re here to put an end to it. One of the key features we are going to discuss in this blog is utilizing a well-known feature, API Discovery , in order to protect your apps. This includes a new feature called path risk profiling , which helps identify vulnerable API endpoints when it comes to sensitive and personal information. Another great feature we will discuss is utilizing API Discovery to create sensitive data rules .       API Discovery A powerful feature within WAAS is the API Discovery feature, which automatically learns API endpoints in your app, shows a report of endpoint usage, and also allows you to export all discovered endpoints as an OpenAPI spec file. When API discovery is enabled, Defender inspects API traffic routed to the protected app. Defenders learn the endpoints in your API by analyzing incoming requests and generating a tree of API paths. Every 30 minutes, Defender sends Console a diff of what it has learned since its last update. Console merges the update with what it already knows about the API. Although API Discovery is enabled by default, take the following steps to ensure it is still enabled on your protected app:  Log in to the Console, and go to Defend > WAAS > {Container (Inline/Out-Of-Band) | Host (Inline/Out-Of-Band) | Agentless} . Click Add rule . Enter the required details. Enable API endpoint discovery . Save the rule. Once API Discovery is enabled, we can begin inspecting those discovered endpoints. To find these reports, head over to Monitor > WAAS > API discovery .    We have completely revamped this page to show more information that can help protect your applications, not just for API security but showing how many vulnerabilities are also present in your workloads. Here we see very important information such as the actual path, what HTTP method was used, the number of hits, API Protection status, path risk factors, as well as the workload, along with other information. To view more stats on an endpoint, simply select the path. This view will give you more information pertaining to that particular path.          Path Risk Profiling A new feature we have introduced in 22.12 is path risk profiling. This feature displays visualizations of all risks associated with APIs on one screen. This new feature allows us to identify three critical risks when it comes to API Endpoints, as well as identify vulnerabilities within those workloads.    1) Endpoints that are accessible from the internet. 2) Endpoints that do not require authentication in order to access.  3) Endpoints that have sensitive data such as credit card information, PII, emails, session cookies, etc.    This feature is a great way to identify risk endpoints as well as filter risk by workload vulnerabilities. For example, in the below screenshot, in the “ Path Risk Factors ” column, you will notice three icons for the path, “ /login ” which is detecting vulnerable API endpoints that are exposed to the internet, APIs with sensitive data, and APIs that allow unauthenticated access to them.        Now that we have identified vulnerable endpoints, now what? The next step would be to actually protect these endpoints with path risks. Under the Actions column, click “ protect ” and here you will be able to set effects for all API endpoints discovered in that particular app.           Sensitive Data Rules Now let's go beyond the tip of the iceberg and actually address those risky API endpoints. A great way to flag your apps that may include sensitive and personal information is by creating sensitive data rules . The reason why this is a big feature and can play an important role in protecting your web apps is that there may be sensitive data captured when WAAS events take place, such as access tokens, session cookies, PII or other information considered to be personal by various laws and regulations.    By utilizing sensitive data rules, you have the ability to mark sensitive data and enable log scrubbing based on regex patterns or its location in the HTTP request. Keep in mind, when we flag sensitive data in API Discovery, we won’t automatically scrub that information in the logs. To accomplish this, we have the log scrubbing feature that will scrub the data and replace it with placeholders. This way the actual information isn’t being passed through the logs, where bad actors can intercept this data.    By default, we give you some common out-of-the-box rules to get you started. However, you still have the ability to create a custom sensitive data rule.   Let's walk through how to create a custom rule:  In your console head to Defend > WAAS > Sensitive Data Click Add Rule Enter a rule name, and rule type (pattern-based or location-based) For pattern-based rules: Provide a match pattern in the form of a regular expression,   e.g. ^sessionID$ , key-[a-zA-Z]{8,16} . Provide a placeholder string, e.g. [scrubbed cookie] For location-based rules: Select the location of the data to be scrubbed. Provide location details:  For query / cookie / header / form/multipart - provide match pattern in the form of a regular expression ( re2 ), e.g. ^SCookie.*$ , item-[a-zA-Z]{8,16} . For XML (body) / JSON (body) - provide the path using Prisma Cloud’s custom format e.g. /root/nested/id . Provide a placeholder string, e.g. [scrubbed cookie] Select options for Sensitive Data and Log Scrubbing Sensitive Data works by searching for the key value in the location, for example, query, cookie, header, form/multipart, XML, and JSON body. Log Scrubbing replaces the value with the placeholder that you enter. Data will now be scrubbed from any WAAS event before it is written (either to the Defender log or Syslog) and sent to the console Click Save   Example of what log scrubbing looks like:         Sensitive Data Protection Recap API Discovery Allow the WAAS module to observe and update new API endpoints from your environment. This is a great way to ensure maximum protection against your web apps so that way you’re not having to look for new endpoints yourself. Not only does this feature discover new endpoints but will create usage reports as well.  Path Risk Profiling A new feature in our 22.12 release is the addition of path risk profiling. This feature allows us to quickly identify endpoints that may result in sensitive data being leaked.  Sensitive Data Rules Protecting your sensitive data is very important to us, so on top of just implementing log scrubbing, you have the ability to create sensitive data rules as well. By utilizing these rules you have the ability to mark sensitive data and enable log scrubbing to replace the data with placeholders in the logs before the events are recorded.      ... View more

By Brandon Goldstein, Senior Customer Success Engineer   Overview This guide describes how to configure agentless vulnerability and compliance scanning for virtual machines in Microsoft Azure subscriptions.   This article will use a credential dedicated to the agentless scanning process.  In Prisma Cloud Enterprise Edition  / SaaS, you have the additional option of using a Prisma Cloud onboarded account credential which will be covered in a future article. The creation and use of an Azure service principal credential are also supported in SaaS.   Before You Begin To follow along, you will need: A Prisma Cloud Compute console running v22.06 or later (SaaS or self-hosted). Permission in your Compute console to create Cloud Account credentials, view console logs, the vulnerability monitor and the compliance monitor. Sufficient permissions in your Azure subscription to create service principals, custom roles and role assignments The Azure CLI installed and authenticated with the subscription you want to scan A helpful list of reference material can be found at the end of this document.   Configuration Procedure 1:  Create a New Azure Service Principal Create a Service Principal dedicated to the agentless scanning procedure. Step 1:   Using the Azure CLI, execute the command below. Replace the name and  subscription ID with your own custom values: az ad sp create-for-rbac --name your-service-principal-name name --scopes /subscriptions/ your-subscription-id-here --role reader --sdk-auth   You should receive a result as this:   $ az ad sp create-for-rbac --name sp-new-azure-agentless-scanner --scopes /subscriptions/your-subscription-ID --role reader --sdk-auth   Creating 'reader' role assignment under scope '/subscriptions/your-subscription-ID' The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli   {   "clientId": "service-principal-client-ID",   "clientSecret": "service-principal-client-secret",   "subscriptionId": "subscription-ID",   "tenantId": "tenant-ID",   "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",   "resourceManagerEndpointUrl": "https://management.azure.com/",   "activeDirectoryGraphResourceId": "https://graph.windows.net/",   "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",   "galleryEndpointUrl": "https://gallery.azure.com/",   "managementEndpointUrl": "https://management.core.windows.net/" }   Procedure 2:  Configure the Compute Cloud Credentials We need to configure the cloud credentials in order to get the permissions template assigned to the service principal.   Step 1:  Login to the Compute console and navigate to Manage > Cloud Accounts   Step 2:  Click Add Account .   Step 3:  Select Azure from the “Select Cloud Provider” dropdown menu, enter a name, a description (optional), and then select the “Service Key” radio button.   Step 4:  Copy and paste the entire JSON output from Step 1 into the  “Service Key” field. Then click “Next”   Step 5:  Enter your Console URL and port , then click “Download” to get a file archive with the permission templates. Note: you will receive an archive similar to this .tar.gz It will have the following .json files in it: Role_assignment.json Role_definition.json   Step 6:  All of the Advanced Settings are optional.   Step 7:  Click “Next” to proceed to the next section.   Step 8:  You can leave Cloud Discovery disabled because this credential will not have sufficient permissions to perform Cloud Discovery.   Step 9:  Then click “Add Account” to complete the credential setup within Compute. You will find that the new credential has a green checkmark under “Agentless scan”; however, we still aren’t ready for a successful scan.   Procedure 3:  Create the Custom Role for Azure Agentless Scanning Step 1:  Use the role_definition.json file to create a new custom role. az role definition create --role-definition "role_definition.json" You should receive a result like this: $ az role definition create --role-definition "role_definition.json" The underlying Active Directory Graph API will be replaced by Microsoft Graph API in Azure CLI 2.37.0. Please carefully review all breaking changes introduced during this migration: https://docs.microsoft.com/cli/azure/microsoft-graph-migration   {   "assignableScopes": [     "/subscriptions/your-subscription-ID"   ],   "description": "Can create and manage VMs, snapshots, disks, network interfaces and security groups",   "id": "/subscriptions/your-subscription-ID/providers/Microsoft.Authorization/roleDefinitions/05504b7f-8d89-49ae-9a9e-e8e075185423",   "name": "05504b7f-8d89-49ae-9a9e-e8e075185423",   "permissions": [     {       "actions": [         "Microsoft.Resources/subscriptions/resourceGroups/read",         "Microsoft.Resources/subscriptions/resourceGroups/write",         "Microsoft.Network/networkInterfaces/read",          …         "Microsoft.Compute/virtualMachines/write",         "Microsoft.Compute/virtualMachines/delete",         "Microsoft.Compute/virtualMachines/instanceView/read"       ],       "dataActions": [],       "notActions": [],       "notDataActions": []     }   ],   "roleName": "Prisma Cloud Compute Agentless Scanner",   "roleType": "CustomRole",   "type": "Microsoft.Authorization/roleDefinitions" }   Step 2:  Assign the new role to the new service principal. az role assignment create --assignee " new-service-principal-id " --role "Prisma Cloud Compute Agentless Scanner" --scope "/subscriptions/ your-subscription-id " You should receive a result like this: $ az role assignment create --assignee "new-service-principal-ID" --role "Prisma Cloud Compute Agentless Scanner" --scope "/subscriptions/new-service-principal-ID"   The underlying Active Directory Graph API will be replaced by Microsoft Graph API in Azure CLI 2.37.0. Please carefully review all breaking changes introduced during this migration:   https://docs.microsoft.com/cli/azure/microsoft-graph-migration   {   "canDelegate": null,   "condition": null,   "conditionVersion": null,   "description": null,   "id": "/subscriptions/new-service-principal-ID/providers/Microsoft.Authorization/roleAssignments/9d3943e7-fe1f-4230-82cf-2cfc6719196a",   "name": "9d3943e7-fe1f-4230-82cf-2cfc6719196a",   "principalId": "e4856716-f8e1-4c8c-9867-0d333a1dccf0",   "principalType": "ServicePrincipal",   "roleDefinitionId": "/subscriptions/new-service-principal-ID/providers/Microsoft.Authorization/roleDefinitions/05504b7f-8d89-49ae-9a9e-e8e075185423",   "scope": "/subscriptions/new-service-principal-ID",   "type": "Microsoft.Authorization/roleAssignments" }   Procedure 4:  Trigger the first agentless scan Step 1:  Return to the Compute console and the Cloud Accounts page.   Step 2:  Click the icon for “Trigger Discovery or Scan Agentless” to open a dropdown menu and then click “Start Agentless scan”.     Step 3:  You should find the activity and progress for Azure agentless scanning in the top right corner of the console window.   Step 4:  You can also search for the keyword “scan” in the Virtual Machine list within the Azure console to confirm that the temporary scanners have been created.   Step 5:  Eventually you will see more progress in the Compute console status.   Step 6:  View the console logs at Manage > Logs > Console and search for “agentless” to see the related API activity.   Procedure 5:  Confirm Success! Step 1:  In the Compute console, navigate to Monitor > Vulnerabilities > Hosts then select the Hosts subsection . Set the filter to “ Scanned by: Agentless” and add a VM name or keyword to the search for virtual machines which are to be scanned.   Step 2:  Click on one of the entries to see the scan details. Check the scan time to see that it was recent. You will also be able to confirm that it was discovered in Azure.   Step 3:  Check the Compliance Monitor under Monitor > Compliance > Hosts and the Hosts subsection to ensure you are getting valuable results there as well!   Procedure 6:  You’re Done! You have successfully configured and completed agentless virtual machine scanning of your Azure subscription!   Related Information Compute v22.06 - Agentless Scanning Compute v22.06 - Configure Agentless Scanning Compute v22.06 - Permissions By Feature In the “Azure” table first find “Agentless Scanning” The next section “Scanning within the same Account (Individual Account Permissions)” has the relevant permissions Compute v22.06 - Credentials Store See “Creating an Azure Service Principal” How to install the Azure CLI Create an Azure service principal with the Azure CLI Create or update Azure custom roles using Azure CLI Assign Azure roles using Azure CLI About the Author Brandon Goldstein is the senior customer success engineer specializing in Prisma Cloud, Next-Generation Firewall, AWS, Azure, GCP, containers and Kubernetes. They use collaborative approaches to break down complex problems into solutions for global enterprise customers and leverage their multi-industry knowledge to inspire success.   ... View more

By Shashank Chandramohan   In the past couple of years, organizations have increased their utilization of cloud environments. Many teams are now finding it difficult to handle the technical complexity of cloud migration, including the ability to safeguard their applications throughout the course of the application development lifecycle. In today's environment, cloud native applications consist of an increasing number of microservices, containers, hosts and a range of computing options and technology stacks. These intricate architectures will continue to become more complex as cloud native technology continues to grow.    Security experts have always found it difficult to secure the web apps and APIs that support these intricate architectures. Since APIs and applications are constantly evolving, current web security solutions do not provide the necessary coverage. Prisma Cloud has a WAAS (Web Application and API Security) module as a solution to protect your web applications and APIs.   WAAS: The most popular method for sharing and altering data is through web applications and APIs. As web programs and APIs increase, the attack surface increases which leaves your data and resources vulnerable.    Image: An example of how traffic is handled by WAAS   To reduce risk, a complete solution is needed by application security, development, and cloud architects to safeguard their Web applications and APIs on any infrastructure. Here is where the Prisma Cloud Compute (CWPP) module WAAS comes into play: It protects both containerized and non-containerized web applications and API security against OWASP top 10 risks, API vulnerabilities, file uploads, geo-location based controls and more. Organizations can choose how to safeguard their cloud applications using Prisma Cloud's deep web and API security, which is available both inline and Out of Band.   Image: Types of WAAS Difference between inline and Out of Band WAAS: Inline WAAS sits between the incoming traffic and the Web Application. It authenticates and allows/blocks the traffic and alerts the customer in real-time if it violates the rule created by the customer. On the other hand, Out of Band WAAS utilizes VPC to mirror the traffic - analyze it in real-time - and only alerts the customer based on the traffic and rules created. This gives the customer a flexible security option that meets their evolving application demands and ensures there is no trade-off between application performance and security.   Inline WAAS: Notice the different modes - Disable, Alert, Prevent and Ban.   Out of Band WAAS: Notice there is no Ban/Prevent mode.     When do you choose Out of Band? It has been difficult for businesses to safeguard their mission-critical applications without compromising performance as they create and deploy more of their applications on the cloud. Developer and security teams can safeguard their applications with the same degree of security as conventional in-line WAFs and API security without suffering performance penalties by adding the option of Out-of-Band WAAS.   Another use case where you use Out of Band WAAS is when you don’t want to risk a failure of inline WAAS, meaning no traffic reaches your application. How does Out of Band WAAS work? Out of Band WAAS protects your workloads by inspecting the mirrored traffic. Client-server connections and application performance are unaffected. There are two ways to deploy WAAS Out of Band:   WAAS Out-of-band with Defender is used when you have an environment where you can deploy a defender in your workload environment. When installing Defender on each microservice is not feasible, WAAS Out-of-band with VPC traffic mirroring is used.   Did you know? You can monitor both protected and unprotected workloads with Prisma Cloud Out of Band WAAS.   In order to remotely monitor the unprotected apps on your source instance utilizing the built-in traffic mirroring offered by CSP, this configuration needs you to deploy a Defender on the target instance outside of your workload environment.   For instance, the AWS VPC traffic mirroring capability copies traffic from the source EC2 instance (which does not have Defender installed) to the target EC2 instance, which is located in the same VPC but has Defender installed on the host.   There is no latency cost with WAAS Out-of-band configuration. However, WAAS can only alert the Prisma Console because it cannot direct the flow of traffic. All the traffic mirroring on AWS will be taken care of by our cloud formation script.   How to create a WAAS Out of Band rule on Prisma Console:   Step 1 : Open Prisma UI >Navigate to Compute>defend>WAAS> Out of Band     Step 2 : Create a rule by clicking on “Add Rule”     Step 3 : Enter the rule name. Use the Notes for describing the rule (Optional)   Step 4 : Scope down the resources (observers) by specifying a collection. (Collections can be created on the fly or under Manage>Collection and Tags) Observers - agents deployed for Out-of-band traffic mirror are termed Observers   Step 5 : API Endpoint discovery - when toggled to enable, the mirrored traffic to and from the remote applications is examined by the Observer. The Observer reports a list of the endpoints and their resource paths in Compute > Monitor > WAAS > API observations > Out-of-band observations.   The below image shows that you are able to discover API endpoints and the risks that they present for the applications.   You can also see any unprotected web apps as shown in the below image.     Step 6 : When employing VPC traffic mirroring, ports cannot be automatically identified since no agent is directly installed on the source workload and the traffic is redirected through the CSP's traffic mirroring service to the Prisma Cloud Observer.   Step 7 : Toggle on VPC traffic monitoring to enable the flow of mirrored traffic from the source instance to the destination instance's Prisma Cloud Observer.   Step 8 : Click Save. Once the rule is created click on “Add App” to configure the firewall settings, Bot protection, Denial of Service, etc.     For in-depth information about VPC mirroring, you can look at the documentation here: Deploy WAAS Out-of-band with VPC Traffic Mirroring   Note : VPC Traffic Mirroring OOB is available only for AWS environments, but Defender based OOB is available anywhere a Defender can be deployed.   Example: How to create traffic mirroring in AWS manually Architecture:   Step 1 : Deploy host defender on an EC2 instance. This will be our WAAS Observer.  Step 2 : Configure Traffic Mirr o ring . Here, set up the Source, Target, Filter and Session. Step 3 : Create Out of Band WAAS rule on Prisma UI. Step 4 : Perform Sanity checks. Step 5 :  Check Monitor > Events > WAAS Out of Band. This will provide you with insights into the events that occurred.     Click on any of the attack types to gather more information.     Modern problems require modern solutions. Modern online applications that are API-centric and cloud native, as well as the microservices they use, are sophisticated, which creates a host of new security challenges. To supplement traditional security measures, this new environment needs new security solutions and methods and with Prisma Cloud WAAS module offering OWASP Top-10 Coverage, API Protection, Access Control, File Upload Control, Detection of Unprotected Web Applications, Penalty Box for Attackers, Bot Protection, DoS Protection let us secure our web applications. About the Author:     ... View more

By RD Singh, Senior Customer Success Engineer   Introduction   Prisma Cloud Compute Agentless scanning enables you to quickly gain comprehensive visibility into vulnerability and compliance risks without having to install an agent on each host.   Cloud environments are dynamic in nature. Prisma Cloud gives you the flexibility to choose between agentless and agent-based security. At this time, Prisma Cloud supports agentless scanning of VMs on AWS, GCP and Azure.   This article outlines the process of setting Prisma Cloud Compute Agentless to scan Google Cloud Platform (GCP) Compute Engine to discover vulnerabilities and compliances.     The steps to enable Agentless Scanning on GCP are: enabling GCP API using a predefined role  configuring agentless on Prisma Cloud   Option 1 - GCP Project: Enable following APIs Cloud Resource Manager API Compute Engine API Identity and Access Management API Deployment Manager API (to execute gcloud deployment-manager commands to apply templates) Temporarily add  Roles > Role Administrator   IAM > Security Admin   Roles to the Google APIs Service Agent ( aka <project_number>@cloudservices.gserviceaccount.com ) Create an IAM Service Account and download a Service Account Key   Option 2 - GCP CloudShell: Execute following gcloud commands: $ gcloud config set project example-project-name $ gcloud services enable cloudresourcemanager.googleapis.com $ gcloud services enable compute.googleapis.com $ gcloud services enable iam.googleapis.com $ gcloud services enable deploymentmanager.googleapis.com $ gcloud projects add-iam-policy-binding \    example-project-name \    --member=serviceAccount:example-project-number@cloudservices.gserviceaccount.com \    --role=roles/iam.roleAdmin $ gcloud projects add-iam-policy-binding \    example-project-name \    --member=serviceAccount:example-project-number@cloudservices.gserviceaccount.com \    --role=roles/iam.securityAdmin $ gcloud iam service-accounts create \    example-project-name \    --display-name="Prisma Cloud Service Account for Agentless Scanning" $ gcloud iam service-accounts keys create \    example-project-name_service_account_key.json \          --iam-account=prisma-cloud-agentless@example-project-name.iam.gserviceaccount.com   Download the Service Account Key: example-project-name_service_account_key.json Note: If the APIs are not enabled and the Roles are not added to the Google APIs Service Agent , the subsequent gcloud deployment-manager deployments create command will fail. If the gcloud deployment-manager deployments create command fails, enable the APIs and add the Roles and retry the command. Replace the create with update if you receive a "deployment already exists" error.   Prisma Cloud Compute onboard the GCP account: Login to the Compute console and navigate to Manage / Cloud Accounts Click Add Account In the Service Account field, paste the Service Account Key ( example-project-name_service_account_key.json ) and leave the API Key field blank Download the permission templates Advanced Settings are all optional   GCP, apply the permission templates: Upload all of the downloaded (and expanded) permission templates. In CloudShell: gcloud deployment-manager deployments create \ pc-agentless-hub-user-local \ --project example-project-name \ --template permission-template-file   Prisma Cloud Compute test Agentless Scanning: Return to the Compute console and the Cloud Accounts page Click Start Agentless Scan Monitor the scan, looking for errors in Scanning Job Progress, or summarized in the list of Cloud Accounts View the Agentless scan results in Compute > Monitor > Vulnerabilities > Hosts   GCP, in your Project, remove temporary Roles: In IAM, remove  Roles > Role Administrator   IAM > Security Admin   Roles from the Google APIs Service Agent (aka <project_number>@cloudservices.gserviceaccount.com ) .   CloudShell: gcloud projects remove-iam-policy-binding \    example-project-name \    --member=serviceAccount:example-project-number@cloudservices.gserviceaccount.com \    --role=roles/iam.roleAdmin      gcloud projects remove-iam-policy-binding \    example-project-name \    --member=serviceAccount:example-project-number@cloudservices.gserviceaccount.com \    --role=roles/iam.securityAdmin   Those roles were only needed to execute gcloud deployment-manager commands to apply the permission templates.   Closing Thoughts:   To speed up testing, create VMs in just one Region, and configure Prisma Cloud to scan that Region via Custom Regions .   Prisma Cloud Compute Edition Administrator's Guide - Permissions   Prisma Cloud Compute Edition Administrator's Guide - Agentless Scanning   We recommend to leverage this reference article in order to gain visibility into vulnerability and compliance risks across your cloud accounts without having to install an agent on each host.   About the Author RD Singh is a senior customer success engineer specializing in Prisma Cloud, Next-Generation Firewall, AWS, Azure, GCP, containers and Kubernetes. RD uses collaborative approaches to break down complex problems into solutions for global enterprise customers and leverage his multi industry knowledge to inspire success.   ... View more

  By Ben Nicholson   Prisma Cloud Ensures Your Cloud Applications are Secure from Code to Cloud   To stay relevant, organizations need to be nimble. They need to offer new services, new capabilities and transform their customers' experiences while managing the volatile world of cyber attackers. Moving to the cloud is now the way of achieving the first part of your goals.   But, what about securing the data, applications and tools to ensure you can go from building secure codes to delivering secure cloud applications? When you’re responsible for the secure operation of your cloud services, how do you ensure the transformation of your journey to the cloud?   You’ve probably heard that shifting left increases your applications’ security, helping to ensure they’re deployed to the cloud without vulnerabilities. How this is done, though, can be a mystery — one that I hope to shed light on with this post.   Shift Left — Code, Build, Deploy and Run   Step 1:   Build Security Into Your Code and Build Cycles   Continuous integration (CI) is the development lifecycle practice that provides your organization with the ability to rapidly and continuously develop, update and maintain your cloud-based applications. Ensuring that your code is free from vulnerabilities, before going to the build stage, can be simplified with the right tools.   Using Palo Alto Networks Prisma Cloud   scanning capabilities provides visibility and control within your code. And, it builds processes to identify vulnerabilities and compliance violations before progressing to the “deploy phase” of the application's lifecycle.   Step 2: Confidently Deploy Secure Applications   With modern automation, cloud applications are in a continuous cycle of development, testing and release, which introduces the fundamental challenge of continuous change. But, identifying vulnerabilities and compliance issues within applications that are staged for deployment helps prevent your applications from becoming targets of bad actors. Prisma Cloud helps   enforce your policies   to ensure only trusted applications are deployed in the cloud runtime environment.   Step 3: Monitor and Track Applications Running Across the Cloud Workload Continuum   Regardless of where it’s deployed (IaaS, PaaS, SaaS, etc.), an application’s runtime actions should be monitored for abnormal behaviors. Prisma Cloud quickly   identifies   expected behaviors and   prevents   anomalous behavior.   It secures runtime environments using predictive and threat-based protections.   Shifting left can be as simple as selecting a product designed to secure cloud applications in every step of your cloud applications’ code, build, deploy and run processes.   With built-in scanning capabilities, policy enforcement, predictive and threat-based protection, Prisma Cloud helps shift your security left, delivering the assurance that your cloud applications are highly secured.   To help configure, provision, deploy and gain the maximum benefit from Prisma Cloud, we recommend  Prisma Cloud CBDR Adoption Guide,  Prisma Cloud CBDR Adoption Workshop   or   QuickStart Service for Prisma Cloud Code Security, and shift left for optimum cloud application security.   Prisma Cloud  ... View more

DNS log Ingestion and DNS Threat Detection     Being one of the core foundations of the internet, DNS is equally important in the Public Cloud environment. But, DNS is a blind spot to many organizations' security strategies. Network applications rely on DNS to translate domain names to IP addresses- this is fundamental to detect any communication between an infected host and a C&C server.   Prisma Cloud helps detect these hidden threats in DNS traffic in the AWS environment. Activities like Domain Generation Algorithm (DGA) and cryptomining domain request activity can be detected in AWS environments with Prisma Cloud DNS Threat Detection.  Join Vinayak Shastri for a session to uncover more about the DNS based threat detection capabilities with a demo and overview of DNS Threat Detection service. ... View more