Technology Partner Solution Brief

How To Extend
Network Security
Into The Cloud
Overview
Enterprise networks have changed significantly in recent years. The cloudhas introduced new flexibility — and complexity — that make network
security look much different than it did a decade ago. As a result, NetSec
teams now have to view their jobs in a fundamentally different way.
The cloud has caused an explosion in network tool and solution adoption,
unprecedented speed and fluidity (that can lead to misconfigurations), a
pressing need for NetSec to align with applications teams, and a new world ofcompliance that makes audit readiness more difficult.
This evolution equates to a new threat landscape, along with a host of new
responsibilities that are a significant ask for security teams. That’s why it isvital that NetSec pros are equipped with the right knowledge and tools tosecure the hybrid network. Adequate preparation will allow them to fulfill
their core objectives:• Empower the business.
• Enable users to do their work.
• Protect sensitive and critical data.
• Monitor threats as they evolve.
• Ensure compliance and audit readiness.

More than a third(36%) of enterprisetechnology
professionals don’t
feel fully equipped
to manage hybrid
network complexity,
and only 8% feelextremely confident.
[Source]01 |How to extend network security into the cloudHow to extend network
security into the cloudEnterprises must accept that change is needed to help network security enable rapid progress across thebusiness while increasing security and agility. Fortunately, this transformation will result in less stress andgreater bandwidth for team members to focus on strategic, high-value work. Here are four ways NetSec
can work smarter, not harder, to improve enterprise security and compliance.

Achieve consolidated, end-to-end visibility
The foundation for effective hybrid security lies invisibility. Without complete network visibility, thegaps between disparate technologies will inevitably
create blind spots. This creates unmeasured risk andmisconfigurations that can go undetected for long
periods of time.
According to research from Enterprise Management
Associates (EMA), only 34% of organizations believe
they are successful in their approach to visibility,with architectural complexity, skill gaps, and limited
visibility into the cloud named as top challenges. Manyof these issues stem from the fragmented nature oflarge, multi-vendor hybrid cloud environments. Siloedtools — and teams — are not communicating as muchas they should be.
To overcome these challenges, enterprises must
think about visibility more holistically. End-to-end
visibility encompasses more than just network
enforcement information — you need to leverageand integrate all of the tools in your security
stack. For example, when managing access requests
and policy changes, being able to bring in datafrom your vulnerability management solution,
your governance, risk, and compliance tools, etc.
is critical to making the most informed decisions
on how to keep the hybrid network secure while
promoting business agility.
Tufin offers an all-in-one solution that unlocks endto-end network visibility across the hybrid cloud, nomatter the product or provider. Without a consolidated
network visibility platform like Tufin, NetSec has tocheck a variety of tools and consoles just to gain avague picture of whether or not security mechanisms
are configured properly to effectively protect theorganization — a major waste of time and resources.
Tufin allows NetSec teams to extend the same levelof awareness and control they are used to havingin traditional networks into the cloud. The platform
provides the broadest possible coverage of yourenvironment at scale, eliminating blind spots andenabling strong security governance. Its industryleading topology map, for instance, offers dynamic
visualizations of all network devices and zones forreal-time analysis and troubleshooting.

“Before, we were always focused on getting the proper rules in place and not being able to do
anything else. We would have to look into every environment and which firewall goes where, which
was difficult due to the complexity of our environment.”– Technical lead forsecurity, financial services company*[Source: TEl of Tufin Report]

Increase speed while
reducing risk of breachFor hybrid network security to operate at the speed of the cloud, the enterprise has topractice proactive network change management — real-time risk identification for every
proposed network or cloud change and its impact on security posture.

Step 1:

Step 2:

The first step toward proactive change
management is to review your access policychange processes to ensure that requested changes
are being properly approved, implemented, anddocumented. For all requests, you should be able toanswer essential questions such as:

Next, take inventory of all firewall and security
group rules that are currently in place. Ideally
you will use a global security policy, a single place
to design and manage requirements for governing
segments and traffic across your hybrid network. Askquestions such as:• Is the requester documented, and are they authorized to makethis change?

• How many rules does the rulebase currently have compared
to last year?

• Is the business reason for the change documented, including
any impact on network devices and topologies?

• Are there any redundant rules that should be removed?

• Were the approvals recorded before the change wasimplemented?

• Are there any policy rules that are no longer used, including
VPN or network environments?

• Are the changes well documented in the change ticket,including any required remediation or cleanup?

• Are there any overly permissive rules (e.g., rules withmore than 1,000 IP addresses allowed in the source ordestination)?

• Is there documentation of risk analysis for each change,including prioritizing and aggregating risks?

• Are there any rules that violate our corporate compliancerequirements (e.g., HIPAA, PCI DSS, SOC, etc.)?

Having completed these steps, you will be able to get started with policy-driven
automation that allows changes to be implemented in minutes rather than days
while removing the chance of human error resulting in misconfigurations — the#1 cause of security breaches in the cloud.
Tufin has everything you need to adopt an automated, policy-based approachto meet business demands and eliminate tradeoffs between agility and security.
For example, the platform’s Unified Security Policy (USP) Builder lists all security
zones in your environment and identifies traffic that must be blocked or allowed
between security zones.
Tufin also offers customizable templates and workflows that can be used toautomatically evaluate proposed changes (access requests, rule modifications,etc.) and associated risk. These repeatable, auditable, and policy-driven
processes reduce risk for your organization while making it easier to maintaincontinuous compliance.
03 |How to extend network security into the cloud

The composite Tufin
customer sees a75% reduction
in manual effort
related to application
connectivitymanagement.
*[Source: TEl of Tufin Report]

Maintain continuous complianceand audit readiness
The pinnacle of hybrid network security is to attain continuous compliance and audit readiness. Thismeans the business is always ready to undergo and pass a third-party audit to verify that your network
infrastructure, security controls, and practices comply with relevant security policies, industry standards, andregulatory requirements.
The truth is that effective, 24/7 compliance for the hybrid network is impossible to achieve without
automation. Any manual, “snapshot in time” inventory of controls almost immediately becomes obsolete.
This is a major reason why Flexera’s 2022 State of the Cloud report found that compliance is a top cloudchallenge for 76% of organizations.
Tufin offers the most efficient path toward continuous complianceand audit readiness. The platform facilitates and automates essential
activities, giving NetSec the ability to:

The composite Tufin
customer sees a
95% efficiency
gain for audit
preparation
and reporting
activities.
*[Source: TEl of Tufin Report]

04 |• Always see and understand the current state of hybrid
network infrastructure and identify areas that don’t complywith policies.
• Set up and issue real-time alerts for automated monitoring
to ensure continuous compliance.
• Define a Unified Security Policy that works across eventhe most complex infrastructures (multi-vendor, multiplatform, multi-cloud, etc.) to simplify policy review andmanagement.
• Identify compliance violations before they occur as part ofan automated change process.
• Access and automate an audit trail of all changes andapprovals which can be used to generate a variety ofcustomizable reports for standards such as PCI DSS, NIST,SOX, NERC CIP, and more.

How to extend network security into the cloudThe fastest path tointegrated hybrid
network security
NetSec must adopt a new toolkit tosuccessfully adapt to the new enterprisenetwork. Tufin is the best way for security
teams to achieve the desired results whileworking smarter and avoiding burnout.
Our platform offers unified, end-to-end
network visibility and unparalleled security
automation across network and cloudenvironments. With the power of Tufin, yourteams will be able to deploy apps faster,
remediate issues more quickly, maximize
efficiency, and stay audit-ready year round.

W H E R E N E T W O R K S E C U R I T Y M E E T S T H E C LO U D

6Ways the Cloud
Changes Everything
About Enterprise
Network Security.

To learn more about how cloud computing hasaltered the way enterprises approach security,
download 6 Ways the Cloud Changes Everything
About Enterprise Network Security.

About Tufin
Tufin provides a single platform for network and cloud security teams to simplify the management of security policies across today’scomplex, multi-vendor hybrid networks. The platform gives some of the largest companies in the world the end-to-end visibility andautomation tools necessary to swiftly provide new access, enable fast and secure application deployment, and ensure continuous
compliance and audit readiness. Tufin’s proven solutions help more than 2,000 customers across industries including healthcare,financial services, utilities, telecommunications and retail to quickly identify and mitigate network risks. For more information, please
visit www.tufin.com.