SecureChangeTM+

Change Design Automation
and Rule Lifecycle Management
Overview
SecureChange+ delivers the compliance monitoring, policy management andrisk mitigation that comes with SecureTrack+, as well as full-spectrum change
design automation, rule lifecycle management and complete topology visibility.
Many businesses today struggle to manage thousands of network devices andcloud resources from multiple vendors, with manual and error-prone changes
that take weeks to implement and require significant resources. These manual
processes are risky and often noncompliant with corporate policy or industry
regulations. Frequently, the security policies themselves lack documentation
and are not reviewed nor justified.

Key Features• Customizable automatedworkflows• Integrates fully into ITSM
processes• Automated change design andvalidation• Topology mapping• Visual path analysis• Fast, accurate troubleshooting• Efficient target selection

SecureChange+ is an end-to-end, automated policy change design solution,
enabling you to automatically build least-privilege access rules across all major
firewall, SDN and cloud platforms. Automated risk identification and impact
simulation is built into the network change process, with real-time visibility into
every network or cloud change and its impact on security posture.
Automation is a must in order to achieve agility, while consistently
enforcing security policy across your hybrid environment.

„ We also integrate Tufin SecureChange with our ITSM

• Checks changes against
vulnerability data
• Automated rule recertification
process

Outcomes• Save thousands of work hours
per year typically spent onrule cleanup, change design,
recertification and audit prep.
• Achieve continuous compliance,
virtually eliminating the risk ofconfig errors.

ticketing system, ServiceNow, where a ticket triggers aworkflow… facilitating easy and centralized tracking.

• Minimize risk and vulnerability
exposure.

Tufin Designer can run across multi-vendor firewalls and• Reduce downtime with fasttroubleshooting.

highlight rules and interfaces.”“• Every change is documented
providing more granular
auditability.

— Security Engineer, Fortune 500 Travel Company
01 |www.tufin.com© Copyright 2024 Tufin. All rights reservedCustomizable Workflows
SecureChange+ workflows are fully customizable to address multiple use cases and constant organizational changes.
Each workflow is a multi-step, graphical process – from request submission to the fully automated stages of target
firewall selection, risk assessment, design, and verification. This process removes the bottlenecks in everyday manual
operations and eliminates the risk of configuration errors. All workflows are audit-ready, tracking and documenting thefull change history.

Fully Automated with SecureChange+
SubmitRequestBusiness
Approval

TargetSelection

Automated
Risk Analysis

Security
Review

Audit &Report

Designiiiiii

Use SecureChangeor integrate withyour ITSM to submit
the requests via theITSM

Automaticallyidentifies firewall
targets and security
groups based onreal-time, full pathanalysis of yournetwork

Automatically performs
risk assessment against
the security policy,
vulnerability data andother third-party
security intelligence toavert policy change
violations and prevent
access to risky assets

SecureChange+
automaticallysuggests the mostefficient set ofchanges necessary
across network
devices and security
groups to process arequest ticket

The Verifier
automatically tests
to confirm that yourchange was
implementedAll changes madeare documented
and reportable

Access Request Workflow - a unified change process enables collaboration and visibility across teams.

For every change request, Tufin conducts risk analysis against the selected Unified Security Policy, as well as data
retrieved from either Tufin’s Vulnerability-based Change Automation module or a third-party tool, such as a SIEM,
SOAR or endpoint security solution. These potential risks and violations will be instantaneously flagged.
Tufin integrates with leading ITSM providers and other solutions that use REST API (ServiceNow, Remedy and others), todeliver seamless change workflows, whereby opening a ticket in your ITSM solution triggers a change design workflow
within Tufin.

Several readily available workflows can be customized to fit your organization’s
business processes, such as:
Access Request / Access Decommissioning
Automatically identifies all devices on the network
path between the source and destination, checks forsecurity risks and network impacts, then updates therule base to enable access or removal of access.
Group Modification
Creates and modifies network groups across different
firewall vendors.

02 |www.tufin.com

Rule Modification
Designs changes to existing rules.
Rule Recertification
Identifies expiring or expired rules, maps them totheir business owners, and triggers an automatedrecertification or decertification process.

© Copyright 2024 Tufin. All rights reserved

The Industry’s Most Advanced Topology Mapping Delivers Real-Time,
Holistic Visibility
SecureChange+ is powered in part by the industry’s most advanced topology model. SecureChange+ connects tonetwork devices, such as multi-vendor firewalls, routers, NGFWs, SDNs, and cloud services, retrieving all routing
tables, as well as accounting for common network technologies, such as NAT, MPLS, IPSEC VPN, to create yourtopology view. This vendor-agnostic network topology map, delivers centralized visibility and control on-premises andin the cloud.
Tufin’s topology intelligence lets you use the routing information from your devices to make informed decisions about
your network’s security.
Within SecureChange+ workflows, topology
intelligence is used to:• Suggest target firewall devices for access requests• Calculate and show the necessary changes needed forthe access request• Verify the access request was successfully added
Rapid Troubleshooting• Users can run topology analysis queries, showing thecurrent path from source to destination and the relevant
security policies on each network device along the way tounderstand if the path in question is allowed or blocked.

Tufin’s Topology Map

Unmatched Scalability
The topology map is expandable, allowing customers to add generic network devices and nonstandard configurations.
Tufin supports thousands of devices and 100M+ routes, providing real-time, accurate network topology analysis.

Vulnerability-based Change Automation (VCA)
Tufin’s Vulnerability-based Change Automation module enables you to expand your risk-based access request
workflows to reflect the results of vulnerability scan results. You can automatically check source and destination assets for
known vulnerabilities prior to granting access or connectivity.

Tufin’s Topology Map

03 |www.tufin.com© Copyright 2024 Tufin. All rights reservedRule Lifecycle Management (RLM)
Rule Lifecycle Management enables orchestration of rule recertification. It integrates with configuration management
databases to map network owners, identify inactive owners for rule reassignment, and orchestrate certification acrossthe right set of rule owners. You can automatically identify expiring or expired rules and map them to their owner(s),enabling simple recertification or decertification of the rule. This allows you to operationalize more frequent rule reviews.

RLM Dashboard

A multinational bank eliminated a 12-month recertification backlog.

Customer
Success

The team automated rule review and recertification workflows withvariable rule expiration timeframes.
Now they review rules daily.

Copyright © All rights reserved. Tufin, Unified Security Policy, Tufin Orchestration Suite and Tufin logo are trademarks of Tufin. All other product names mentioned herein are trademarks or registeredtrademarks of their respective owners. You may not copy, reproduce, photograph, translate, transmit, make available to the public, make derivative works, perform in public, rent, broadcast or makeany commercial use of the publication in full and / or in part without prior written approval.

04 |www.tufin.com© Copyright 2024 Tufin. All rights reserved