Cadence Uses CloudGuard Posture Management for Robust Security Across Its Multi-cloud Environment

Visibility in a Multi-Cloud Environment Visibility into the cloud is vital in order to control security and minimize the infrastructure attack surface. With the highly dynamic nature of the public cloud and unlimited amount of resources it would afford its customers for scalability, the need arose to tightly monitor and track the various network configurations. According to Kancharla, “With several administrators adding to the cloud configuration, the occasional misconfiguration is inevitable. With thousands of constantly shifting rules across hundreds of security groups and VPCs, Cadence’s cloud presence is far too big and complex to be managed by humans. It’s impossible for an individual to manage it. We needed an automated tool that actually tracks all the changes.”

When a change occurred, Kancharla’s team needed to be able to peer into the system to see exactly what took place so that it could be corrected quickly. Cadence needed to automate repetitive tasks such as security group auditing, fix any misconfigurations with in-place remediation, and have built-in active protection to enforce established policies with the ability to track and revert unwanted changes consistently.

CloudGuard Posture Management Clarity for Granular Network Visualization

Cadence found their solution in CloudGuard Posture Management Clarity. As part of the CloudGuard Posture Management service, Clarity is a powerful visualization capability that provides a granular view of network topology and workflow traffic so Kancharla’s team can easily map all subnets and drill down to view reports of all AWS EC2 instances on a single, easy-to-use dashboard. In addition, Cadence uses CloudGuard Posture Management Clarity to check their AWS VPCs state and overall network exposure. This includes using CloudGuard Posture Management IP Lists for grouping and configuring permissions to specific public IPs. Using CloudGuard Posture Management Clarity, Cadence has centralized management of its network security posture and can efficiently whitelist those IPs that can be viewed coming to and leaving from their security groups, in order to define the internal and external network links.

One of Cadence’s most common uses for Clarity, is to find potential vulnerabilities that would create a security alert. Clarity gives Kuramatsu a quick view of a specific subnet or route going from A to B so he can quickly identify any unauthorized changes to the network. In addition, the CloudGuard Posture Management VPC Flow Logs allow the team to quickly respond to events without the efforts of cumbersome investigation of the data logs.

Maintain Access Control While Providing User Flexibility

Enforcement of access and authorization to ports and services are vital in a complex cloud network. One of the main concerns Cadence faced was protecting their customers’ data while providing multiple users access. Cadence needed a tool that could not only monitor, but protect the movement of resources both between the segregated subnets as well as on and off the public cloud networks. This tool would ensure that only authorized individuals could access specific data, make changes, and enforce only authorized changes.

At the same time as securing access, Kancharla had the added challenge of retaining flexibility. Cadence provides training sessions for their customers which requires the off-site trainer to enter the Cadence system remotely from the customer’s site. However, permitting such adhoc temporary entry naturally puts the network at risk and makes it vulnerable to outside threats. Kancharla’s team sought a solution which would bring the capability to add access without compromising strong security controls.

Active Protection for Security Enforcement with CloudGuard Posture Management

Kancharla recognized that the cloud security solution he implemented needed to offer full security orchestration, going beyond monitoring and reporting to include enforcement. Automated control over the implemented and established baseline security posture was essential. Within the CloudGuard Posture Management service, Kancharla found the control he was looking for with the always on security enforcement of Active Protection with CloudGuard Posture Management . With active protection, Cadence acquired the following three-pronged approach to the challenge of granting user access and providing flexibility and agility to its customers, while securing their multi-cloud environment with confidence.

CloudGuard Posture Management Dynamic Access Leases: “We use Dynamic Access Leases heavily,” says Kuramatsu. He and others on his team use CloudGuard Posture Management’s Dynamic Access Leases to solve the challenge of individuals who need temporary remote access to the network. With Dynamic Access Leases, the person can get specific temporary access to only those parts of the networks that he needs for a limited time frame. The CloudGuard Posture Management tool opens up the ports automatically and closes access again at the end of the defined time frame, thus reverting to the original, defined network state, ensuring consistent protection across their clouds.

CloudGuard Posture Management Tamper Protection: Attempts to modify a security group from the multi-cloud environment will result in Tamper Protection detection and a message. Cadence’s predefined policy in CloudGuard Posture Management is always enforced, and any modification attempt will be overridden, forcing the policy to revert to its original definition. Kancharla’s team leverages this capability to make sure there are no port changes that result in configuration conflicts, especially in the case of network configuration updates.

CloudGuard Posture Management Region Lock: Since Cadence operates across three AWS regions, Kancharla and Kuramatsu rely heavily on Region Lock to enforce regulations which prohibit moving data between regions. Cadence uses Region Lock to ensure that information cannot be moved outside of the USA or Europe. Furthermore, with Region Lock, Cadence can make sure that user access is granted accordingly and employees cannot view data that they should not be seeing. With Region Lock, Cadence can make sure that user access is granted accordingly and employees can not view data that they should not be seeing.

Compliance Reporting for Customers

Cadence is a large public enterprise that serves leading industry vendors. As such, customer trust is key. With the migration to the cloud, Cadence had to be able to continue to demonstrate consistency with industry standards such as ISO 27001 and other cyber security frameworks’ best practices in order to reassure their customers that their applications and data are safe.

Compliance Automation and Reporting with CloudGuard Posture Management

The Compliance Engine from CloudGuard Posture Management , a part of the CloudGuard Posture Management service, delivers continuous end-to-end compliance testing and reporting against industry standards using automated data aggregation and an intelligent insights generation system. Cadence turned to the Compliance Engine from CloudGuard Posture Management to generate compliance reports for AWS and Azure.

Kuramatsu notes that CloudGuard Posture Management best practices reports are, “One of the best parts of the Compliance Engine from CloudGuard Posture Management and we use them quite often.” They also use CloudGuard Posture Management to validate their cloud security against CIS AWS Foundations Benchmark framework, which is a set of security configuration best practices to protect one’s footprint on AWS. Kuramatsu can prove how robust Cadence compliance truly is by producing compliance reports and quickly respond to Cadence management requests, with well structured and trusted information.