How Western Asset Management Is Mitigating Cloud Threats

Banking, investment management and FinTech have constantly committed to technology upgrades, data analytics and differentiated product choices within an more and more competitive and evolving investment landscape. A current Accenture survey found 90% of banking respondents proclaiming that cloud enables and accelerates innovative adoption. Of individuals surveyed, 60% say cloud-based entrants will challenge traditional companies shackled through the limitations of the on-premises agility, storage, and computing abilities.

Western Asset Management (WAM) is presently exceeding expectations regarding innovation inside a highly competitive market. The “active” investment management industry that WAM services involves constantly managed funds and portfolios, time-sensitive transactions and decision-making based on fast-altering market conditions. With a number of options available, clients expect compressed charges with regards to managing their cash.

By embracing an agile development process and moving DevOps towards the cloud, WAM’s application delivery continues to be transformed for application deployment and product. Several years ago, when the risk management team desired to develop and test new risk models or algorithms, groups of hardware, networking also it sources will have to be scheduled. Now, within the cloud, instances could be spun up in the push of the mouse, and sandbox environments for testing purposes could be produced and destroyed instantly before pushing to production.

Managing security, risk and regulatory compliance can be tough within an agile, dynamic cloud atmosphere. Western Asset Management’s DevOps and security teams accepted the competitive challenges, understanding the requirement for a properly-architected, cloud-native security solution.

We lately sitting lower with David Pace, who accounts for Global Information Security at Western Asset Management (WAM), a set-earnings investment firm as well as an independent affiliate of Legg Mason, managing funds exceeding $420 billion across nine offices worldwide. The difficulties they faced being an organization moving towards the cloud were eliminating risks, discovering when users misconfigured cloud sources, and alerting for threats on the network-level within their public cloud atmosphere.

The first deployment of Prisma Public Cloud (formerly RedLock) gave WAM immediate understanding of their environments, for example identifying administrator accounts without multi-factor authentication (MFA) enabled. They could better approach cloud peace of mind in a competent, scalable manner. Rather of counting on outdated manual ways of getting log data into systems to evaluate, they are able to now depend on Prisma Public Cloud to recognize, prioritize and pinpoint where risks exist and mitigate them as quickly as possible.

Pace and the team discovered three major benefits throughout their look at Prisma Public Cloud:

• Effective security governance abilities
• Out-of-the-box compliance and auditing features
• Unparalleled network visibility

His team presently has visibility to their entire cloud infrastructure, letting them see and recognize threats which are targeting their cloud atmosphere in the outdoors, in addition to threats that could be via inside their cloud atmosphere heading out. Pace presently has a 360° look at his atmosphere in a single centralized interface where he and the team can run reports in addition to issue and process alerts in tangible-time for you to remediate any problems that may arise.

“Our senior IT management has the arrogance now within our cloud team having the ability to leverage Prisma Public Cloud for that compliance, security governance, auditing and network visibility that people get. The Return on investment just been immense - allowing our business to operate faster, and much more efficiently by leveraging new cloud services - that previously we might not have had the ability to secure correctly.” - David Pace, Global Information Security at WAM

WAM’s future plans with Prisma Public Cloud are mainly centered on expanding the combination across multiple cloud platforms. Initially deployed on AWS, WAM’s DevOps teams intend to expand to Microsoft Azure and Google Cloud Platform. Getting the opportunity to leverage Prisma Public Cloud across their multi-cloud atmosphere can give Pace and the team one holistic view regarding what’s happening and assist them to precisely assess risk.

For organizations moving towards the cloud or searching to consider cloud-computing technologies, Pace recommends leveraging an item for example Prisma Public Cloud that gives visibility to their cloud atmosphere for comprehensive user auditing, compliance reporting, and identification of dangerous behaviors or misconfigurations. Considering that, organizations can be assured their public cloud environments feel at ease. With Prisma Public Cloud, users will gain actionable insights, combined with the confidence that any threats that could promote themselves could be pinpointed and remediated rapidly.

Applying Zero Trust to Google Cloud Environments

At Palo Alto Networks, we’ve been helping our customers make a dramatic, transformative shift on how they approach security. This journey is not just about the implementation of technologies, but rather a change in the very philosophy on what security is and how it should be designed across the enterprise.

In the past, the traditional perimeter model for security was based on fortifying the demarcation between trusted and untrusted areas of your network. The convention presumed that your users and applications were in the trusted parts, and the internet and threats were in the untrusted parts. This model is fundamentally broken today. Mobile workforces and cloud applications are not inside the trusted part of the network. The model is also broken because it cannot stop a threat actor that is operating within the trusted network. Furthermore, even with the separation between network boundaries in place, conventional port and protocol security lacks the granularity to enable applications and stop attacks from passing back and forth anyway.

The right philosophy should challenge the notion of trust in the first place, and implement the necessary controls to enforce least-privileged access – in other words, Zero Trust. For example, never presume something to be trustworthy. Build enabling policies based on the context of the user and application, rather than trying to block everything you don’t want. Don’t presume a file is safe just because it’s not known to be bad. With Zero Trust, we drive policy to enable what is allowed, rather than try to identify every possible permutation of what isn’t.

Toward this end, we have developed a tremendous number of important technologies to establish complete visibility, reduce the attack surface, prevent known attacks, and detect and prevent unknown attacks. Four real-time capabilities at the core of the Palo Alto Networks Security Operating Platform are App-ID, which classifies and identifies applications and functions; User-ID, which automatically assigns identity to otherwise anonymous network flows; Host Protection, which provides device posture and exploit and malware prevention; and Content-ID, which performs inspection of content, in order to detect and prevent malicious actions. All of this rich context is made available to be leveraged in our customers’ security policy and decision-making process.

As part of our customers’ journey to the cloud, we believe that the same Zero Trust philosophy toward security is mandatory, whether that means building their own applications in the cloud with IaaS and PaaS services or consuming pre-built cloud applications through SaaS. Google shares many of the same beliefs, as implemented in BeyondCorp, a framework for securing apps and infrastructure based on the principles of Zero Trust.

We are announcing our commitment to work together with Google to develop integration that makes the implementation of secure cloud applications easier. With respect to BeyondCorp, we believe that our mutual customers will benefit from the integration to address implementation challenges with identifying users, maintaining consistent policy, protecting data and enforcing threat prevention across a diverse landscape of users, workloads and devices.

How does this help secure Google Cloud APIs?

The various DevOps teams within your organization are building Google Cloud applications and interacting with a number of Google Cloud APIs. You want to have the granularity to make sure that every team member has access to the APIs that they need, without having to provide unnecessary levels of access to the most sensitive APIs if it isn’t necessary. Contextual information helps drive policy because the level of access that a person needs may be driven by their individual responsibilities, their role in the organization, or even the device that they use. This is the classic least-privilege problem because you can reduce the attack surface area by limiting access based on context, as long as that context information is available.

The intersection of identity (based on user/device characteristics) and the enforcement of access control policy has traditionally been done at the time of authentication. We believe that working together, we can do better than that. If we can limit access so that unauthorized users never get the chance to make an unauthorized API request in the first place, we can cut the attack surface area, mitigate the risk of credential abuse, and reduce the security alerts for failed authentication. This is possible by working together to integrate our identity/device technologies, and we believe it will significantly improve the overall security of the operating environment.

How does this help secure G Suite?

At Palo Alto Networks, we have been relentlessly focused on building protections for applications and data in the cloud. We have taken innovative approaches toward SaaS applications, in particular, being at the forefront of integrating CASB API protections for data security with our platform for inline security. Our customers are using our platform to identify risks, mitigate threats and protect data across the broad landscape of SaaS applications in use in the enterprise today.

Productivity applications such as G Suite are used by nearly everyone within the organization, and as such, they are accessed by an extremely diverse spectrum of employees and contractors, using a mix of devices that may or may not be owned by the organization. By integrating Palo Alto Networks protections for SaaS applications with G Suite, we can build out the user/device context that drives BeyondCorp policy decisions for access. Employees with managed devices get immediate, full access to their applications, while contractors on non-compliant devices receive different levels of access. Again, by working together so that we can exchange context, while also incorporating our threat and data protection, we can help our customers deploy G Suite securely to all employees.

How does this help secure apps on GCP?

The principles of using contextual access and threat prevention together should be consistently applied from the data center to the cloud, without skipping a beat. We know that different app developers and organizations have different ideas about how they approach security, and that consistent, contextual protection is often hard to achieve. By working together with Google, we want to make sure that, as organizations move their applications from the data center to the cloud, the user experience remains the same and consistently safe, regardless of where the user is located. For users on managed devices, only the authorized user with a compliant device can access the application (whether in the data center, cloud or SaaS). For users on unmanaged devices, we enable access to the application without bringing the device on network, thus maintaining a least-privileged architecture without disrupting business.

Palo Alto Networks Completes Acquisition of RedLock

Palo Alto Networks (NYSE: PANW), the global cybersecurity leader, announced today that it has completed its acquisition of RedLock Inc., a cloud threat defense company. For Palo Alto Networks, the transaction will extend its cloud security leadership.  

"With the combination of RedLock and our existing cloud security offerings, we are well-positioned to solve our customers' most difficult challenges of securing a mobile workforce, protecting the public cloud and stopping advanced threats," said Nikesh Arora, CEO of Palo Alto Networks. "Since announcing the transaction, our integration planning teams have been working to combine the strengths of both companies in an effort to bring an integrated offering to market quickly."

Palo Alto Networks already provides a broad security offering for multi-cloud environments with inline, host-based and API-based security, bolstered by the acquisition of Evident.io in March 2018. The company currently serves more than 6,000 cloud customers globally with its cloud security portfolio that includes VM-Series next-generation firewall, Aperture, Evident, and GlobalProtect cloud service.

Palo Alto Networks will combine the Evident and RedLock technologies to provide customers with cloud security analytics, advanced threat detection, continuous security, and compliance monitoring in a single offering anticipated early next year. The company expects that the new offering will allow security teams to respond faster to the most critical threats by replacing manual investigations with automated, real-time remediation and reports that highlight an organization's cloud risks.

Palo Alto Networks paid approximately $173 million in cash, excluding purchase price adjustments, to acquire RedLock.

About Palo Alto Networks

We are the global cybersecurity leader, known for always challenging the security status quo. Our mission is to protect our way of life in the digital age by preventing successful cyberattacks. This has given us the privilege of safely enabling tens of thousands of organizations and their customers. Our pioneering Security Operating Platform emboldens their digital transformation with continuous innovation that seizes the latest breakthroughs in security, automation, and analytics. By delivering a true platform and empowering a growing ecosystem of change-makers like us, we provide highly effective and innovative cybersecurity across clouds, networks, and mobile devices.

Palo Alto Networks and the Palo Alto Networks logo are trademarks of Palo Alto Networks, Inc. in the United States and in jurisdictions throughout the world. All other trademarks, trade names or service marks used or mentioned herein belong to their respective owners.