you can get burned when

1©2018 Check Point Software Technologies Ltd. 1©2018 Check Point Software Technologies Ltd.

Christof Jacques | Security Engineer Check Point Belgium & Luxembourg

YOU CAN GET BURNED WHEN IT’S CLOUDY

2©2018 Check Point Software Technologies Ltd.

“I think that you will all agree that we are

living in most interesting times. I never

remember myself a time in which our

history was so full, in which day by day

brought us new objects of interest, and,

let me say also, new objects for

anxiety.”

Joseph Chamberlain, Bristol, England, 1898


NEW OBJECTS OF INTEREST

0

20

40

60

80

100

120

2016 2017 2018 2019 2020

Rev

en

ue

(U

S$ B

illio

n)

Worldwide Cloud Services Revenue Forecast

Platform-as-a-Service

SaaS

Public Cloud

Source: Gartner


Networks are more Inter-Connected

Threats are more Sophisticated and Automated

NEW OBJECTS OF ANXIETY

&


CURRENT STATE OF CLOUD SECURITYNOT EVERY CLOUD HAS A SILVER LINING


56 million users’ data got stolen... In 2016


HOW EXPOSED ARE WE

REALLY IN THE

CLOUD?


OUR CLOUD ENVIRONMENT

Internet


WITHIN THE FIRST 15 MINUTESHouston we have a problem . . .


Customer responsible for security in the cloud

Cloud Provider responsible for security of the cloud

CLOUD = SHARED RESPONSIBILITY


Customer responsible for

security in the cloud

Cloud Provider responsible for

security of the cloud


Provider Global Infrastructure

Regions

Availability ZonesEdge Locations

Compute Storage Database Networking

Customer Data

Platform, Applications, IAM

Operating System, Network and FW Configurations

Client-side Data Encryption & Data Integrity /

Authentication

Server-side Encryption (File System / Data)

Network Traffic Protection (Encryption, Integrity,

Identity)


CLOUD NETWORKS ARE VULNERABLE

• Shared responsibility is unclear

• Increasingly sophisticated and automated attacks

• Lateral spread of threats

• Account hijacking

• Inconsistent tools for visibility, management and reporting


IT’S TIME

FOR SOME

SUN BLOCK


CLOUD SECURITY RECOMMENDATIONS

4. CENTRALIZED MANAGEMENTSingle pane-of-glass experience across all clouds

2. EASE OF OPERATIONSOne-click deployment, auto-provisioning templates

3. CONSUME & CONTRIBUTE CONTEXTAdjust to dynamic nature of cloud

1. COMPREHENSIVE PROTECTIONSPrevent attacks against cloud applications, data and workloads


INTRODUCING CHECK POINT CLOUDGUARD

PROTECTING ANY CLOUD, ANY SERVICE, ANYWHERE


COMPREHENSIVE SECURITY ARCHITECTURE

Headquarters

Remote Employees Branch

Private Cloud & SDN SAASPublic IAAS

©2018 Check Point Software Technologies Ltd.

BUILDING BLOCKSA bit more detail



Customer

responsible for

security in the

cloud

Customer Data

Platform, Applications, IAM

Operating System, Network and FW Configs

Client-side Data

Encryption & Data

Integrity Authentication

Server-side Encryption

(File System / Data)

Network Traffic

Protection (Encryption,

Integrity, Identity)

Cloud vendor

responsible for

security of the

cloud

Cloud Global

Infrastructure

Regions

Availability Zones

Edge Locations

Compute Storage Database Networking


NO Unified management for all Clouds & Traditional Data Center

NO Threat Prevention in real time (L4-L7 protections)

NO Identity based authentication access to applications

NO URL Filtering

NO Threat Extraction and Zero-day Sandboxing

WHERE CLOUD NATIVE SECURITY FALLS SHORT


Lateral threat movements

Data breach due to misconfiguration

Abuse of cloud services

API hacking

Malicious insiders

THIS MIGHT EXPOSE YOU TO…


ACI

SD

N

Public

Cloud

Private

Cloud

Hybrid Cloud

CloudGuard Family


CLOUDGUARD SAAS

SAAS SECURITY IS ONE CLICK AWAY

Identity

Protection

Protect

Sensitive Data

Zero-day threats

Protection

End-to-End

SaaS Security


Security Gateway

SAAS PROVIDERS

SECURITY STACK

Prevent

Account

Takeovers

Data Leak

PreventionReveal

Shadow IT

HOW IT WORKS

API & AD

…

CloudGuard SaaS

Documents

encryption

Zero-day

Threats

Protection


CLOUDGUARD IAAS BUILDING BLOCKS

Centralized Management

Advanced Threat Prevention

Cloud Diversity

DevOps Ready

Adaptive and Automatic


CloudGuard IaaS

• All the Advanced Threat Preventionfeatures of Check Point Security Gateways and R80 Management plus:

• For all these clouds

ACI

Automation and

Orchestration

Cross Environment

Dynamic Policies

Adaptive Security


CloudGuard for VMware NSX

Hardware

Hypervisor

vm vm

ESXi ESXi

Security Management

Server

Hardware

vSphere API NSX vSphere API

NetX API

vCente

r

Hypervisor

vm vm

Clo

ud

Guard

Clo

ud

Guard


CloudGuard for Cisco ACI


CloudGuard IaaS Advanced Protection

Basic Firewall / Access Rule

Firewall IPS App Control

DLP

Zero-Day

Anti-bot

Forensics

FilteringAntivirus

Threat Emulation Threat Extraction

Multi-cloudVPNIdentity

Awareness

Anti-Spam


CloudGuard Deployment

Single Gateway

Cluster/HA

Auto-scale

Automation

Hybrid Cloud


APPLICATION-AWARE POLICY TIED TO CLOUD MANAGEMENT AND SDN


CLOUDGUARD ADAPTIVE SECURITY

Check Point Access Policy

Rule From To Application Action

3

Web_SecurityGroup

Object

DB_VM

Object

MSSQL Allow

4

CRM_SecurityGroup

Object

SAP_SecurityGroup

Object

CRM Allow

5

AWS_VPC

Object

Azure_VNET

Object

ADFS Allow

Drag & Drop dynamic policy with cloud objects


ADAPTIVE SECURITY THAT ENABLES INNOVATION

Easy to secure and connect

Multi-cloud applicationDevOps and IT Security

speak the same language

Policy is updated when

application is deleted


SECURITY THAT ENABLES INNOVATION

Easy to secure and connect

Multi-clouds application

Applications are protected

with the best security

DevOps and IT Security

speaks the same language

Policy is updated when

application is deleted Application owner

never waits

Reduce security tickets

by 60%


CloudGuard Ecosystem

NETWORK

Shared Threat Intelligence

Consolidated Security

Management

Multi & Hybrid Cloud

Headquarters Branch

Access Control

Multi Layered Security


Data Protection

Access Control

Multi Layered Security


Wi-Fi, DSL, PPoE Ready

MOBILE

Network Protection

Device Protection

App Protection

Capsule

WorkSpace/Docs

Remote Access

Secure Business Data

Protect Docs Everywhere

ENDPOINT

Anti-Ransomware

Forensics

Threat Prevention

Access/Data Security

Access Control

Secure Media

Secure Documents

CLOUD


Adaptive Security

Automation and Orchestration

Cross Environment

Dynamic Policies

Infrastructure

Identity Protection

Sensitive Data Protection

Zero-Day Threat Protection

End-to-end SaaS Security

Applications