We recently published a list of 10 AI News Stories You Can’t Miss. In this article, we are going to take a look at where Palo Alto Networks, Inc.

Palo Alto Networks (PANW) Boosts AI-Driven Cybersecurity: Key Analyst Insights - Insider Monkey

Prevent disruptions from certificate revocations with fast, automated solutions for continuity. Register Make Cybersecurity Memorable!

Warning: Over 2,000 Palo Alto Networks Devices Hacked in Ongoing Attack Campaign

One of the highlights at Palo Alto Networks Inc.’s the most recent version of its Ignite on Tour event series, this one at its Santa Clara headquarters, was founder and Chief Technology Officer Nir Zuk’s presentation of the cybersecurity company’s 2025 predictions for the security industry.

Palo Alto Networks' Nir Zuk on what's coming in cybersecurity in 2025 - SiliconANGLE

Cybersecurity firm Palo Alto Networks (PANW) has reported mixed financial results for this year’s third quarter. The Santa Clara, California-based company announced earnings per share (EPS) of $1.56 U.S., which beat the consensus forecast of $1.48 ...

Baystreet.ca - Palo Alto Networks Reports Mixed Financial Results

Palo Alto Networks beat Wall Street expectations for first-quarter revenue and profit on Wednesday, owing to healthy spending for its cybersecurity services amid a rise in digital threats.

Palo Alto tops revenue and profit estimates on steady cybersecurity demand | Reuters

The cybersecurity giant published an advisory on November 8, urging customers to ensure that access to the PAN-OS management interface is secured, in light of claims about a remote code execution vulnerability.

Palo Alto Networks Confirms New Firewall Zero-Day Exploitation - SecurityWeek

The US Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities Catalogue with two newly identified vulnerabilities in Palo Alto Networks’ Expedition migration tool. These vulnerabilities, tracked as CVE-2024-9463 and CVE-2024-9465, are reportedly ...

CISA adds two more vulnerabilities in Palo Alto Networks tools to exploited catalogue

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday warned that two more flaws impacting the Palo Alto Networks Expedition software have come under active exploitation in the wild.

CISA Flags Two Actively Exploited Palo Alto Flaws; New RCE Attack Confirmed

Palo Alto Networks

paloaltonetworks

Cryptographic Ransomware Encryption Detection: Survey: Author's Declaration

Organizations now recognize the significant role of integrating security in the software development lifecycle. DevSecOps is a powerful approach that has emerged to achieve this goal. By incorporating security practices at the earliest stages of development, DevSecOps helps organizations identify and reduce vulnerabilities more effectively, minimize the risk of security breaches, and build more secure applications. This article will discuss the fundamental principles of DevSecOps and provide key steps for securing your organization’s CI/CD Pipeline. DevSecOps Principles : Organizational principles It is important to involve Security teams right from the beginning of a project to make sure that security requirements are given serious thought and attention early on. This step can prevent the discovery of security problems later in the development phase, which could be more expensive and time-consuming to fix. Involve Security Teams Early: In DevSecOps, it is important for Development, Security, and Operations teams to work together. By promoting a culture of shared responsibility for security, organizations can ensure that all team members play a part in creating secure applications and in identifying and solving security issues faster. Collaboration and Transparency: DevSecOps incorporates security practices early in the development process, also known as "shifting left." It helps organizations to detect vulnerabilities in the codebase before they escalate into expensive and time-consuming issues. Shift-Left: DevSecOps advocates for the inclusion of security procedures throughout the entire software development process, ensuring continuous security. This involves implementing automated security testing, constant monitoring, and regular security evaluations. Continuous Security: The concept of security chaos engineering involves deliberately introducing security-related problems and disruptions into a system to verify its ability to withstand them and reveal weaknesses. Security Chaos Engineering: By replicating actual security incidents, organizations can obtain significant insights into their system's performance during challenging conditions. This enables them to take proactive measures to address vulnerabilities and enhance their overall security position. Security Awareness/Training principles: To make security a top priority of your organization, provide your team members with security training and resources, encourage collaboration, and recognize that everyone is responsible for security. By doing this, you can cultivate a culture that prioritizes and integrates security throughout your organization. Foster a Security Culture: Developers should be encouraged to adopt secure coding practices like input validation, output encoding, and proper error handling. These practices will help mitigate security vulnerabilities in the code and reduce the risk of potential attacks. Adopt Secure Coding Practices: Gamification techniques can be adopted by organizations to encourage a security-focused culture and educate team members on security best practices. Gamification of Security Training: By transforming security training into an enjoyable and competitive experience, engagement and knowledge retention can be enhanced, ultimately promoting better security practices throughout the organization. Technical principles: Automating security processes can bring various benefits to organizations. These include increased efficiency, reduced human error, and the consistent application of security best practices. Automation: To maintain security during the development process, it is important to regularly run security checks and tests within the continuous integration and continuous deployment pipeline. This will ensure that security concerns are constantly evaluated and addressed. Integrate Security into the CI/CD Pipeline: Use tools like static application security testing (SAST) and dynamic application security testing (DAST) to check for weaknesses and potential security threats in your codebase. These automated security testing tools should be added to your organization's CI/CD pipeline to provide real-time security feedback. Implement Automated Security Testing: Securing the CI/CD Pipeline: Key Steps and Solutions To secure your CI/CD pipeline, protecting the Build environment is the first essential step. Only authorized personnel should access Build servers and infrastructure. To prevent unauthorized access, implement robust authentication methods, such as multi-factor authentication (MFA) with hardware keys. Additionally, keep the Build environment up to date with the latest security patches, and configure it according to the best industry practices. Secure the Build Environment: To safeguard your code repository, implement robust access controls that permit only the necessary access to authorized personnel, and monitor it frequently to identify any suspicious activities. Also, keep reviewing and updating user permissions and use encryption to protect sensitive data stored in the repository. Secure Code Repository: Hardcoded credentials, such as passwords or secret keys within the code, is a serious security risk as they can provide unauthorized access if the code is exposed. Hardcoded Credentials Scanner Solutions: Open-source solutions: TruffleHog - https://github.com/trufflesecurity/trufflehog - GitLeaks https://github.com/gitleaks/gitleaks - GitSecrets https://github.com/awslabs/git-secrets Enterprise solutions: GitGuardian - https://www.gitguardian.com/ SpectralOps - https://spectralops.io/ Bridgecrew - https://bridgecrew.io/secrets-scanning/ To automatically detect any potential security weaknesses in your code during the build process, integrate SAST tools into the CI pipeline. These tools can help you find problems such as insecure coding practices, input validation errors, and potential code injection vulnerabilities. Static Application Security Testing (SAST): Open-source solutions: SonarQube - https://www.sonarsource.com/products/sonarqube/ Semgrep CLI - https://github.com/returntocorp/semgrep Enterprise solutions: Veracode - https://www.veracode.com/products/binary-static-analysis-sast Checkmarx - https://checkmarx.com/cxsast-source-code-scanning/ - Coverity https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html To ensure the security of your application, you can use SCA tools to track third-party libraries and open-source components that you use. SCA tools can check for potential security risks such as outdated components, known vulnerabilities, and licensing issues. Software Composition Analysis (SCA): Open-source solutions: OWASP Dependency-Check - https://owasp.org/www-project-dependency-check/ - Nancy (GoLang) https://gonancy.dev/ - RetireJS (JavaScript) https://retirejs.github.io/retire.js/ - Safety (Python) https://github.com/pyupio/safety Enterprise solutions: - Black Duck Hub https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html Mend - https://www.mend.io/sca/ Snyk - https://snyk.io/ In case your software uses containers, make sure to follow container security best practices, which include implementing minimal base images, scanning for vulnerabilities, and enforcing strict access controls. Additionally, it would be best if you used specialized container security tools, like container vulnerability scanners and runtime security monitoring solutions. Container Security: Open-source solutions: Trivy - https://github.com/aquasecurity/trivy - Grype https://github.com/anchore/grype - Clair https://github.com/quay/clair Enterprise solutions: Aqua Security - https://www.aquasec.com/products/software-supply-chain-security/ Sysdig Secure - https://sysdig.com/products/secure/ Snyk - https://snyk.io/product/container-vulnerability-management/ Incorporate security checks into your use of IAC tools like Terraform, CloudFormation, or Ansible. This is to ensure that the configuration of your infrastructure is indeed secure and free from potential security misconfiguration. Infrastructure as Code (IaC) Security: Open-source solutions: Checkov - https://github.com/bridgecrewio/checkov Tfsec - https://github.com/aquasecurity/tfsec KICS - https://kics.io/ Enterprise solutions: Bridgecrew - https://bridgecrew.io/infrastructure-as-code-security/ Prisma Cloud - https://www.paloaltonetworks.com/prisma/cloud/infrastructure-as-code-security - Snyk https://snyk.io/product/infrastructure-as-code-security/ To test your application in a real-time environment, add DAST tools to your CI/CD pipeline. These tools can uncover vulnerabilities that may only become visible when the application is executing, such as configuration issues, authentication problems, and access control concerns. Automated DAST tools should be used for thorough security testing. Dynamic Application Security Testing (DAST): Open-source solutions: OWASP Zed Attack Proxy (ZAP) - https://www.zaproxy.org/ - Nikto https://github.com/sullo/nikto - GoLismero https://github.com/golismero/golismero Enterprise solutions: Fortify WebInspect - https://www.microfocus.com/en-us/cyberres/application-security/webinspect Rapid7 InsightAppSec - https://www.rapid7.com/products/insightappsec/ - Checkmarx https://checkmarx.com/checkmarx-dast/ To enhance the security of your application and infrastructure, it is essential to continuously track and analyze their behavior. This can be achieved by implementing solutions for constant monitoring and logging. By doing so, you can quickly identify and respond to any potential security incidents that might occur. Continuous Monitoring and Logging: To facilitate this process, tools like SIEM (Security Information and Event Management) systems, intrusion detection systems, and log analyzers can be used to detect and alert you on security events. Open-source solution: ELK Stack (Elasticsearch, Logstash, and Kibana) - https://www.elastic.co/ Enterprise solutions: Splunk - https://www.splunk.com/en_us/products/enterprise-security.html Datadog - https://www.datadoghq.com/ To maintain the security and adherence of your CI/CD pipeline to industry standards and regulations, it is essential to conduct regular security audits and assessments. This includes examining the code, testing for potential vulnerabilities, and assessing the infrastructure. By implementing these measures, you can ensure that your pipeline is secure and compliant. Regular Security Audits and Assessments: Open-source solutions: OpenVAS - https://github.com/greenbone/ - BurpSuite Community https://portswigger.net/burp/communitydownload Enterprise solutions: Tenable Nessus - https://www.tenable.com/products/nessus QualysGuard - https://www.qualys.com/cloud-platform/ - BurpSuite Professional https://portswigger.net/burp/pro To be well-prepared for any security breach or incident, it is essential to create a clear incident response plan that lists the necessary steps to take. To ensure the safety of your application, your CI/CD pipeline must have the ability to roll back any deployments, patch any vulnerabilities, and immediately redeploy secure versions of your application. Incident Response Planning: Open-source solution: TheHive Project - https://thehive-project.org/ Enterprise solutions: IBM Resilient - https://www.ibm.com/products/qradar-soar Cortex XSOAR - https://www.paloaltonetworks.com/cortex/cortex-xsoar - D3Security SOAR https://d3security.com/enterprise-soar/ is a beneficial tool for DevSecOps teams. It's an open-source vulnerability management tool created by the OWASP community. Vulnerability Management and Reporting: DefectDojo This tool helps manage security vulnerabilities in the development process. One central space for all the information regarding defects is provided by DefectDojo. It makes it easier for teams to generate detailed reports and keep track of their progress over time. DefectDojo promotes clear communication about vulnerabilities, which ensures that security issues are resolved efficiently and promptly. As you can see, it is crucial to secure the CI/CD pipeline to implement a successful DevSecOps process. To achieve this, organizations need to incorporate security checks and tools throughout the pipeline. By doing so, they can identify vulnerabilities in advance and address them before they can cause security breaches. This helps to ensure that their applications are secure and comply with regulations. With the steps and practices outlined in this article, you can establish a robust and secure CI/CD pipeline for delivering software quickly and safely.

DevSecOps Principles and Key Steps for Securing the CI/CD Pipeline

Despite the increasing need for a cybersecurity workforce globally, we see a massive gap in demand and supply of skilled professinals. Reason? - we do not have enough workforce with required skillset. It’s time now to see this gap as an opportunity to up-skill in cybersecurity. Check out the HackerNoon Learn tab in the green top-nav accross the website today to get access to top-of-the-line cybesecurity course bundles curated by EC-Council. As the digital landscape continues to evolve, cybersecurity has become a top priority for businesses and individuals to safeguard personal and corporate data. This is why we see increasing demand for trained and certified cybersecurity talent to counter and prevent the number of cyber threats from increasing daily. You can stay ahead of the curve by upskilling with EC-Council's CodeRed course bundles. The Need to Upskill in Cybersecurity The average cost of a data breach is expected to surpass 5 million USD for each incident in 2023 ( ). TechCircle, 2022 This staggering figure highlights the need for businesses to prioritize cybersecurity and invest in employee training. Moreover, with the rise of remote work and the growing reliance on technology, cyber threats have become more sophisticated and harder to detect. Upskilling in cybersecurity can accelerate an individual's career. EC-Council-certified professionals report increased job opportunities, higher salaries, and improved job security. For example, individuals with the Certified Ethical Hacker (C|EH) certification earn an average salary of $98,000 annually ( ). PayScale, 2023 According to the C|EH Hall of Fame report, were able to get promotions after completing the certification. 50% of the surveyed C|EHs Rising Demand for Trained and Certified Cybersecurity Talent The demand for trained and certified cybersecurity talent is not limited to a specific region or industry. It is a global trend affecting businesses across all sectors. For example, the healthcare industry has seen a significant increase in cyber attacks in recent years. In 2022, healthcare organizations in the United States experienced an average of 1,410 cyber attacks per week, an 86% increase over the previous year ( ). SecurityMagazine, 2023 The financial services industry has become another prime target for cybercriminals. A report by the International Monetary Fund stated that “most financial supervisors haven’t introduced cybersecurity regulations or built resources to enforce them” ( ). IMF, 2023 The demand for trained and certified cybersecurity talent in these industries and others will continue to rise in 2023 and beyond. Advantages of Upskilling in Cybersecurity Recent examples of the high demand for cybersecurity professionals can be seen in the job market. The demand for U.S. cybersecurity workers grew 2.4 times faster than the overall rate, and in 2022, the industry witnessed nine of its top ten months for cybersecurity job postings ( ). CyberSeek, 2022 Moreover, employment opportunities for information security analysts are projected to surge by 35% between 2021 and 2031, surpassing the average growth rate for all professions ( ). U.S. Bureau of Labor Statistics, 2022 Here are five advantages of upskilling in cybersecurity: Cybersecurity is a rapidly growing field, and those with the right skills and qualifications can expect job security and lucrative salaries with greater growth opportunities as they move ahead in their roles. Job Security: Upskilling in cybersecurity can open new opportunities, including promotions, management positions, and specialized roles. Career Growth: Cybersecurity professionals are critical in protecting individuals, organizations, and even nations from cyber threats. By upskilling in this field, you can make a real difference in the world. Impact: Cybersecurity is an ever-evolving field, which means there is always something new to learn. Upskilling can help you stay up to date with the latest trends, tools, and techniques. Continuous Learning: Cybersecurity skills are highly transferable, which means you can work in various industries and sectors. This flexibility can help you find the right job that fits your skills and interests. Flexibility: The Most Sought-After Cybersecurity Skills to Build in 2023 In today's digital age, cybersecurity is crucial to ensuring the safety of data and systems. To combat this growing threat, upskilling in cybersecurity has become increasingly important. The most in-demand cybersecurity skills for professionals in 2023 include pentesting, digital forensics, cloud security, and mastering network security. These skills are essential for analyzing and solving security problems, examining computer systems, assessing threats, responding to incidents, and conducting audits to mitigate the risks posed by cyber threats. Ethical hacking or penetration testing are advanced forms of security that aim at discovering and mitigating vulnerabilities before hackers can exploit them. With over 25,000 vulnerabilities and attack types discovered in 2022—including Stealer, Botent, DDOS, and Zero-Day among others—businesses need to improve their security postures and become more proactive than reactive ( ). Pentesting: State of Cyber Threat Intelligence Report, 2023 The IT industry is undergoing a significant environmental shift in its digital infrastructure, which has led to vulnerabilities because of misconfigurations in applications and infrastructure. This new branch of cybersecurity requires professionals to understand security elements in the cloud thoroughly. Cloud Security: Studies and surveys have indicated that more than 99% of organizations plan to adopt a zero-trust framework following the rapid changes in the mode of access to business data by internal and external users ( ). Thus, this new concept of identity security requires security professionals with skills in automation, policy management, behavior analytics, etc., to maintain and further solidify the security state. Network Security: What's Next in Cyber Report, 2022 The forensics of security breaches and attacks are crucial assets for businesses. This information not only allows organizations to pursue legal action against hackers but also to learn more about undetected vulnerabilities as well as new technologies the attacker may have used. Digital forensics is estimated to reach 30.78 billion USD by 2030, indicating the increased need for skilled computer forensic experts ( ). Digital Forensics: VertifiedMarketResearch.com, 2023 EC-Council's CodeRed Course Bundles Career-Defining Opportunities To upskill in cybersecurity and stay ahead of the game, it is essential to choose the proper training and certification programs. EC-Council's CodeRed course bundles offer a comprehensive and career-defining opportunity for anyone looking to improve their skills. These bundles cover a range of in-demand, practical cybersecurity skills, and knowledge, with each bundle including various courses and materials designed to help you master these skills and earn valuable industry-recognized certifications. Here are the links to the five CodeRed course bundles: The is designed for individuals new to penetration testing. It covers topics such as network mapping, vulnerability scanning, and web application testing. Pentesting Agent Beginner bundle The is designed for individuals who have some experience in penetration testing but want to take their skills to the next level. It covers more advanced topics such as privilege escalation, password cracking, and post-exploitation techniques. Pentesting Agent Intermediate bundle is a comprehensive learning path designed for individuals who are interested in pursuing a career in cybersecurity but are not yet sure where to start. It covers all aspects of cybersecurity, from the basics to advanced concepts in areas such as cyber law, digital forensics, and incident response. Becoming a Cyber Professional bundle The is designed for individuals who want to specialize in digital forensics. It covers topics such as evidence acquisition, analysis, and reporting, enabling them to investigate and prevent cybercrime effectively. Mastering Digital Forensics bundle The is designed for individuals who want to specialize in network security. It covers topics such as firewall configuration, intrusion detection and prevention, and virtual private networks (VPNs). Mastering Network Security bundle Make the most of this excellent opportunity to invest in your career and upskill in a field that offers tremendous opportunities for growth and success today. Conclusion With cyber threats growing in complexity and frequency, upskilling in cybersecurity has become an essential need for professionals across every industry. With recent high-profile cybersecurity incidents, such as the widely publicized T-Mobile data breach of last year, which cost the company $350 million in customer payouts ( ), upskilling in cybersecurity is not only a way to stay ahead of the game but also a way to protect organizations from cyber threats. Tech.co, 2023 EC-Council's CodeRed course bundles offer a comprehensive and career-defining opportunity to upskill in cybersecurity. Remember, upskilling in cybersecurity is not just about obtaining certifications or completing courses. It's also about staying up to date with the latest threats and vulnerabilities and continually learning and improving. You can access these courses via HackerNoon learn tab today! References Adrian T. (2023, March 2). Mounting Cyber Threats Mean Financial Firms Urgently Need Better Safeguards. IMF. https://www.imf.org/en/Blogs/Articles/2023/03/02/mounting-cyber-threats-mean-financial-firms-urgently-need-better-safeguards Anderson J.L. ( 2023, January 20). Security Magazine. Global cyberattacks increased 38% in 2022. https://www.securitymagazine.com/articles/98810-global-cyberattacks-increased-38-in-2022 Bagchi S. ( 2022, February 19). . Average cost of data breaches to surpass $5 mn per incident in 2023: Report. Tech Circle https://www.techcircle.in/2022/12/19/average-cost-of-data-breaches-to-surpass-5-mn-per-incident-in-2023-report Drapkin A. (2023, February 11). Tech.Co. Data Breaches That Have Happened in 2022 and 2023 So Far. https://tech.co/news/data-breaches-updated-list Flashpoint. (2023). . State of Cyber Threat Intelligence: 2023 https://flashpoint.io/wp-content/uploads/State-of-Cyber-Threat-Intelligence-Report-2023.pdf Palo Alto Networks (2022*). What's Next in Cyber A Global Executive Pulse Check*. https://start.paloaltonetworks.com/whats-next-in-cyber-report PayScale (2023, April 12). . Salary for Certification: Certified Ethical Hacker (CEH) https://www.payscale.com/research/US/Certification=Certified_Ethical_Hacker_(CEH)/Salary Verified Market Research. Digital Forensics Market Size and Forecast. https://www.verifiedmarketresearch.com/product/digital-forensics-market/

Netizens, 2023 is the Year to Up-skill in Cybersecurity

নেটিজেনস, 2023 হল সাইবার নিরাপত্তায় দক্ষতা বৃদ্ধির বছর

Netizens, 2023 ist das Jahr der Verbesserung der Cybersicherheit

Internautas, 2023 es el año para mejorar las habilidades en ciberseguridad

Netizens, 2023 est l'année de la montée en compétence en cybersécurité

नेटिज़ेंस, 2023 साइबर सुरक्षा में अप-कौशल का वर्ष है

ネチズンの皆さん、2023 年はサイバーセキュリティのスキルアップの年です

네티즌, 2023년은 사이버보안 기술 강화의 해

Internautas, 2023 é o ano para aprimorar as habilidades em segurança cibernética

Netizenler, 2023 Siber Güvenlikte Beceri Geliştirme Yılı

Cư dân mạng, 2023 là năm để nâng cao kỹ năng về an ninh mạng

网民，2023年是网络安全提升年

As mobile users begin to connect uncontrolled devices and business applications to the Internet, there is a growing need for trust-free security. Security models designed to protect the perimeter leave network-penetrating threats uncontrolled, invisible, and can change and move at will, extracting valuable and sensitive business data. Zero-Trust (ZT) is a term for an evolving set of cybersecurity paradigms that move defense away from static network-based environments and focus instead on users, assets, and resources. Zero Trust believes that assets and user accounts receive implicit trust due to their physical network location (e.g. Local networks, Internet-based assets) and ownership (corporate assets). The original Department of Defense (DoD) Zero Trust reference architecture was designed to reduce the DoD's attack area and ensure that devices, networks, and users can be compromised, but the damage can be limited. It describes seven pillars of Zero Trust (user devices, network environment, application use, data visibility, analytics, automation, and orchestration) and outlines how Zero Trust capabilities are aligned. On 20 February 2015, the Swiss Federal Institute of Intellectual Property published a new architecture based on networks of trust and trust. In 2019 the National Technical Authority and the National Cyber Security Centre of the UK recommended that network architects consider a zero-trust approach to new IT deployments with significant cloud services and plans. Zero Trust, Zero Trust Network, or Zero Trust Architecture refers to a security concept in which the threat model no longer assumes that actors, systems, or services operate within a security area that can be trusted to ensure that anyone who tries to connect to their systems has access to it. On the contrary, your starting point is to consider all potential threats to be subject to verification. Zero trust is a security framework that requires all users on an enterprise network to authenticate, authorize, and validate security configurations and attitudes before granting or retaining access to applications and data. In this philosophy, any device, user, or application that tries to interact with your architecture is considered not safe. Only untrusted devices and users can gain privileged access. Zero Trust requires a traditional network, an edge network, a local cloud, or a combination of hybrid resources and work sites. The zero-trust architecture focuses on the business needs and functions of an organization and implements a network-centric data security strategy that provides specific access to those who need it. A network without trust uses a positive model of security enforcement with specific rules for access to resources. Zero Trust prevents attacks on access with the least privileges, which means that the organization gives users and devices the least access possible. In old networks, organizations have little visibility and control over the use of network data, but in a zero-trust architecture, all network traffic is seen via segmentation gateways that contain granular policies on data, applications, and asset access that are strictly enforced. In the event of an infringement, these subsidies help to limit lateral movement in the network and minimize the target area. Protection is environment agnostic, so applications and services can be backed up while communicating with the network environment without requiring architectural changes or political updates. The zero-trust model uses micro-segmentation, a security technology that involves dividing the perimeter into smaller zones and maintaining separate access to parts of the network to contain attacks. This can be achieved through next-generation firewalls with decryption features. Zero Trust is a strategic initiative to prevent successful data breaches by removing the concept of trust in an organization's network architecture. It is based on the "never trust, always check" principle to protect the modern digital environment by leveraging network segmentation to prevent lateral movement, prevent Level 7 threats and simplify granular user access control. A broken trust model assumes that the identity of a user cannot be compromised unless he or she acts in a manner of trust. The value of using zero trust in the cloud is not only to enhance an organization's cloud security but also to enable them to use enterprise applications without compromising performance or user experience. Gartner estimates that by 2022, 75% of global organizations will be operating container applications that benefit from faster release cycles and increased scalability, reliability, and resilience. This is all the more important as more and more employees work with data that has migrated to the cloud. On the other hand, The Zero Trust Architecture (ZTA) is an enterprise cybersecurity plan that leverages the Zero Trust concept and encapsulates all components of relations, workflow planning, and access policies. Zero trust in the infrastructure of corporate networks (physical, virtual, and operational) exists in all enterprise products and in plans for a zero-trust architecture. ZTA is designed in response to corporate networks used by remote users, user-owned devices (BYOD), and cloud-based assets that are not within the company's original network boundaries. ZTA focuses on protecting resources within a protected network segment. This means that by default, only one person of trust and network verification is required to gain access to resources within the network. In a nutshell, Zero Trust assumes that there is no implicit internal trust that assets and user accounts are privileged due to the physical location of the network, that property, authentication, and authorization of assets is between a person or device on the network, and that discreet functions performed during sessions within the company's network-wide resources. According to Microsoft Zero Trust ; components Identities: Verify and secure each identity with strong authentication across your entire digital estate. Endpoints: Gain visibility into devices accessing the network. Ensure compliance and health status before granting access. Apps: Discover shadow IT, ensure appropriate in-app permissions, gate access based on real-time analytics, and monitor and control user actions. Data: Move from perimeter-based data protection to data-driven protection. Use intelligence to classify and label data. Encrypt and restrict access based on organizational policies. Infrastructure: Use telemetry to detect attacks and anomalies, automatically block and flag risky behavior, and employ least privilege access principles. Network: Ensure devices and users aren’t trusted just because they’re on an internal network. Encrypt all internal communications, limit access by policy, and employ micro-segmentation and real-time threat detection. Cited Sources https://www.infradata.com/resources/what-is-a-zero-trust-architecture/ https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/ https://edge.siriuscom.com/security/4-major-myths-of-zero-trust-architecture https://gcn.com/articles/2021/05/17/disa-zero-trust-architecture.aspx https://www.forcepoint.com/cyber-edu/zero-trust https://www.mcafee.com/enterprise/en-us/security-awareness/cloud/what-is-zero-trust.html https://www.fedscoop.com/nist-zero-trust-architecture-definition/ https://www.jdsupra.com/legalnews/zero-trust-architecture-is-officially-2104792/ https://csrc.nist.gov/publications/detail/sp/800-207/final https://www.zscaler.com/resources/security-terms-glossary/what-is-zero-trust https://www.nccoe.nist.gov/projects/building-blocks/zero-trust-architecture https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/ https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture https://doubleoctopus.com/security-wiki/network-architecture/zero-trust/ https://en.wikipedia.org/wiki/Zero_trust_security_model https://www.illumio.com/cybersecurity-101/zero-trust

Zero Trust Architecture: An Introduction

I work at an organization that has a majority of its services and resources in the Cloud. We use code to manage our cloud infrastructure using Azure DevOps. This article explains how to set up static code analysis for infrastructure as code using Azure DevOps pipelines and Prisma cloud. Static (non-running) code analysis is performed as part of the security development lifecycle, where tools are used to find vulnerabilities such as buffer overflow, SQL injection within application code. What is Infrastructure as Code It is the process of managing infrastructure resources using code. The prominent tools in this field are used for deploying resources. Additionally, tools such as are used for configuration. These tools effectively maintain consistency across multiple deployments and serve as documentation of existing environments. Terraform, Azure Resource Manager templates, Cloud formation templates, and Azure BICEP Ansible, Chef, and Puppet However, this process could introduce vulnerabilities into the infrastructure environment, such as publicly exposed Virtual machines or storage containers. Requirements Azure DevOps / Github. Prisma Cloud Subscription: Prisma Cloud is a product from PaloAlto Networks that offers security protection of cloud-based environments from deployment to real-time monitoring of resources using policies and anomaly detection rules. Prisma Cloud also provides pipeline tasks for Azure DevOps, GitHub, and other CI/CD tools, which can be used to scan infrastructure code for misconfigurations. Design Details Every PR with Terraform code has to pass the validation process in this flow by successfully generating a terraform plan with intended changes. Then, we feed this plan output into the Prisma IAC task to be scanned for vulnerabilities. Post which the PR is peer-reviewed and approved to merge into deployment branch. If the job fails, the PR is blocked from being merged unless open issues are resolved. Implementation Details Setup Service Connection in Azure DevOps: Generate an access key and secret key from Prisma Administrative console. Register the key in Azure DevOps as shown below Pipeline Setup There are two approaches that we can take to use Prisma Cloud Extension for Azure DevOps. However, irrespective of the approach, the controls, and policies applied are the same. Using the pipeline task to scan the entire folder of terraforming code that contains resource definitions for an environment. This approach works best for small deployments where all of the code is hosted within one folder. Using the pipeline task to scan the terraform plan output. This approach works best for complex and extensive Terraform definitions that use multi-module calls from various sources for deploying an environment. Here is the pipeline definition based on the 2nd approach: YAML Now that we have a pipeline definition setup, you can now integrate these tasks into your existing terraform validation and deployment pipelines. Pipeline execution Below is an example of pipeline execution with Prisma Warning that we have one medium issue. Constraints Prisma cloud IAC Scan only supports terraform. However, if you are using platform native tools such as ARM templates or Azure BICEP, you will be able to use services such as Azure Policy to validate your deployment. Azure Policy is a powerful service that can help catch security issues and ensure that the infrastructure definition is right-sized and meets the desired configuration. When Azure Resource Manager templates or Azure BICEP code violates a defined policy, the deployment will fail at the validation state. Since we use the validation as a gating process for all Pull Requests with Infrastructure code, this violation blocks the merge of “faulty code” into our deployment branch. References Static Code Analysis owasp.org Author: Ryan Dewhurst Contributor(s): KirstenS, Nick Bloor, Sarah Baso, James Bowie, Ram ch, EvgeniyRyzhkov, Iberiam… Azure DevOps YML Terraform Pipeline and Pre-Merge Pull Request Validation Secure Your Infrastructure Automation Control deployments by using gates - Azure Pipelines

Stories, News & Mentions about PALOALTONETWORKS

Paloaltonetworks’s Stories on HackerNoon

Paloaltonetworks's News & Mentions