FFF000 2F2 C5D 017D4E 312984 7FF73C DDA

A New Paradigm In Cloud Security

CNAPP : Cloud-Native Application Protection Prevention

800M ProtectedAssets 3.7K Hybrid Cloud Customers 1.3K PostureRules 2.8K CodeDetectors

With an attack surface unmatched by any topology, the cloud poses equally unmatched risks. Now, CloudGuard provides an unmatched solution: A prevention-first cloud security platform adding advanced Prevention capabilities to the traditional CNAPP.

Powered by 52 CNAPP engines, an award-winning signature-free Web Application Firewall (WAF), and Check Point’s acclaimed hybrid/multi-cloud Network Security solution, CloudGuard unifies agentless and agent-based findings with context-based risk management and near-real-time threat detection and response, coupled with code and CI/CD scanning, single-click and auto-remediations options, enforcing compliance systemwide and providing protection against zero-day exploits at the network, app, and API levels.

+ Gain real-time forensic threat detection & response, correlating CNAPP findings with account and network logs, MITRE ATT&CK, and Check Point ThreatCloud - the largest Indicators of Compromise database in the world.

+ Effective risk management, filtering tens of thousands of issues down to a handful of risks that require immediate attention, coupled with single click and automatic remediation options.

+ Click-and-Enforce hundreds of compliance frameworks and best practices across cloud providers, + Get comprehensive security coverage for all types of cloud assets and risks – pre-deployment and at runtime. + Exposed secret and library vulnerabilities scanner, integrated directly into your CI/CD pipelines. + Interacts with developers and SOC teams via Teams, Slack, Jira, Service Now, Splunk, and more.

CLOUD SECURITY POSTURE DATA SECURITY POSTURE CLOUD WORKLOAD PROTECTION

CLOUD IDENTITY ENTITLEMENT CLOUD DETECTION AND RESPONSE CODE AND CI/CD SECURITY

CloudGuard CNAPP

+ Leverage a hub-and-spoke architecture for vNets’ and VPCs’ interconnectivity.

+ Automatic deployment, scaling, and micro- segmentation of cloud environments.

+ Seamless policies across on-prem and cloud environments.

+ Deep packet inspection, malware detection, and extensive logging.

Cloud WAN, NGFW, IPS, DLP, and Segmentation.

CloudGuard Network Security

+ Preemptively blocks zero-day exploits, malicious behavior, and suspicious activities.

+ Advanced UEBA-based detection without relying on signature-based methods.

+ Integrates across hyper-scalers and on-prem data centers as a service or as a plug-in.

+ Features API schema discovery for defining security policies.

Web App & API Firewall as a Service/Plug-In

CloudGuard WAF

FFF000 2F2 C5D 017D4E 312984 7FF73C DDA

Check Point’s Cloud Security Blueprint

1) NGFW, IPS, and DLP: Protects and secures your N/S traffic with deep packet inspection across protocols, boasting a malware catch rate of 99.8%, advanced analytics, and customized reports.N

E T

W O

R K

S E

C . 6) Cloud Infra. Entitlement Management:

Enforces the Principle of Least Privilege system-side, identifies anomalous access, and flags overprivileged entities and inactive roles, and provides alerts of privilege escalation.

C N

A P

P

2) WAF & API Security: Detects subtle deviations from normal API and web-apps’ behavior for Zero-Day attacks prevention (the only WAF in the world that stopped Log4Shell). Available as a SaaS or as a plug-in.

W A

F

7) Cloud/Data Security Posture Management: Agentless and agent-based scanning, asset inventorying, and compliance enforcement across entities and environments, with the largest posture rulesets list in the industry.

C N

A P

P

3) Cloud Threat Detection & Response: Threat detection with automatic response options and multi-channel alerts, synthesizing network/account logs with IOCs from Check Point’s ThreatCloud and MITRE ATT&CK.

C N

A P

P

8) Cloud WAN with NGFW: Integrates natively with native cloud WAN services, securing ingress and egress traffic, site-to-site VPN, remote access, and comprehensive east-west and north-south inspection.N

E T

W O

R K

S E

C .

4) Hub & Spoke Segmentation: Prevents lateral movement with E/W segmentation, granular access policies, and traffic inspection across cloud accounts with advanced network peering features.N

E T

W O

R K

S E

C . 9) Hybrid Cloud VPN: Manages and secures

hybrid cloud connectivity with client-to-site SSL VPN and site-to-site IPsec VPN, integrated with Check Point Quantum, leveraging identical policies across clouds.N

E T

W O

R K

S E

C .

5) Cloud Workload Protection: Agentless and agent-based scanning across workload types, with anomaly, drift, and malware detection, including malicious workload deactivation and single-click remediation across hyperscalers.

C N

A P

P

10) Code Security: IDE and CI/CD-integrated secrets detector and bills of material CVE scanner, featuring language-agnostic pre/post-commit scanning + monitoring messaging apps for keys/password sharing.

C N

A P

P

W W

W

D at

ac en

te r

/ H

yb ri

d C

lo ud

/ B

ra n

ch

CI/CD & Code Security

SERVICE DOOR HUB: LANDING ZONE

FRONT DOOR HUB: LANDING ZONE

Virtual WAN

Packet Intercept

Account activity and network logs.

Ingress/Egress FTP, SMTP, DNS

1

Web Apps & API

.…

2

Spoke: VPC

Spoke: Cloud Accounts 4

3

10

Workloads: VMs, Containers, Serverless5

Entitlement: Permissions (IAM)6

Cloud Services: PaaS / Storage7

8

IDE VCS/Repo CI/CD

9

Images5

Cloud WAN

Slide 1 Slide 2