Check Point Cloud Security

Why do you need Check Point Cloud Security?

A cloud account changes daily — which is why a quarterly security review describes the past rather than the present. Misconfigurations, excessive permissions and the lack of a single view across several clouds are problems that a firewall at the edge of the corporate network will not solve, because a public cloud has no single edge. Cloud cybersecurity is primarily a question of configuration posture rather than of the network perimeter.

Check Point Cloud Security is Check Point’s cloud offering, previously presented under the Check Point CloudGuard brand. The vendor describes it as a cloud security platform that lets you prevent threats and prioritize risks across your applications, network and workloads. Today the public offering consists of three elements: Cloud Network Security, Web Application Firewall and cloud-native application protection (CNAPP) in the integrated Check Point and Wiz solution.

Important when choosing: Check Point no longer presents a CNAPP product of its own on its website — the CNAPP link leads to a description of the Wiz integration. Cloud security posture management (CSPM) capabilities are still described in the public administration documentation of the platform (also formerly known as Dome9), and the CSPM descriptions on this page come from that documentation. We confirm the scope of capabilities covered by a specific license before the project.

How does it work?

Cloud Network Security

Cloud-native security gateways provide threat prevention and unified security management across public, private and hybrid clouds. This lets the security team apply one policy across different cloud models instead of maintaining separate rules for each environment.

Web Application Firewall

Cloud-native protection for web applications and APIs. According to the vendor, the WAF uses contextual AI to prevent known and unknown threats and does not rely on signatures.

CNAPP: the Check Point and Wiz integration

Check Point now delivers cloud-native application protection in an integrated solution that combines Check Point cloud network security with the Wiz CNAPP platform. According to the integration description, Wiz provides agentless visibility into vulnerabilities and their prioritization, while Check Point Cloud Network Security and Exposure Management apply threat prevention and virtual patching. The integration connects cloud risk detection with network policy enforcement.

Configuration compliance assessment (CSPM)

According to the vendor’s documentation, the CSPM module checks cloud environments for compliance with industry standards, best practices and the organization’s own policies. It uses rules defined by the user or ready-made sets of rules (rulesets) developed by the vendor’s research team — including PCI DSS, HIPAA and CIS Foundations for AWS, Azure and GCP. The module connects to environments directly through cloud platform APIs and also works across several clouds at once.

Key features

The features below are described in the platform’s public administration documentation.

Rulesets and custom rules

• Ready-made vendor rulesets, updated periodically — they cannot be edited, but they can be cloned and the copy changed
• Custom rules in the GSL language (Governance Specification Language), written as text or in a graphical builder
• Five severity levels for findings, from informational to critical
• Exclusions with a comment for deviations accepted deliberately

Continuous assessment and automatic remediation

• Continuous Posture — a policy associates a ruleset with an environment and a notification; a policy for an entire cloud platform also covers newly onboarded environments
• Email, SNS and webhook notifications; forwarding alerts to systems such as ServiceNow and PagerDuty
• CloudBots — Python scripts invoked when a rule fails an assessment, with an audit trail of their actions
• Assessment history and an Executive Summary report sent on a schedule

Containers, Kubernetes and the CI/CD pipeline

• Visibility into container configuration and Kubernetes data flows
• Image Assurance and Admission Control for images and Kubernetes clusters
• Compliance assessment of a CloudFormation template before deployment and Code Security in the CI/CD pipeline

Permissions and asset visibility

• CIEM — review of cloud users and roles against the principle of least privilege
• A risk score for each asset and visualization of network security policies

Who is it for?

• Organizations with infrastructure in AWS, Azure or GCP — including several clouds at once
• Companies running Kubernetes and containers in production
• DevOps teams that want to check configurations and images before deployment
• Organizations that must regularly demonstrate cloud configuration compliance, e.g. with requirements for payment card data
• Teams responsible for web applications and APIs exposed to the internet
• Companies using Wiz that want to connect risk detection with network policy enforcement through the integration

When does Check Point Cloud Security make sense for your organization?

A cloud security tool makes sense when it is clear which problem it has to solve: drifting configurations, missing compliance evidence or containers that nobody checks before they run. Below are three situations in which such projects typically start.

Many accounts and subscriptions, each configured differently

The organization started with a single AWS account and today has a dozen or more accounts, Azure subscriptions and a GCP project, created by different teams. Each team has its own habits: here a public bucket “just for a moment”, there a security group open to the entire internet. A Continuous Posture policy assigned to an entire cloud platform continuously assesses all onboarded environments, including newly added ones, and reports rules that have stopped passing. For recurring errors, such as overly open Security Groups, you can prepare CloudBots that correct the configuration automatically and leave an audit trail.

The auditor asks for evidence, not declarations

A company that processes payment card data or supplies software to financial sector customers has to show that its cloud configuration meets requirements not only on the day of the audit. Screenshots and a checklist spreadsheet do not answer the question of what happened between audits. Ready-made rulesets (including PCI DSS and CIS Foundations) and the assessment history provide a record of what was checked and with what result, while exclusions with a comment document deviations accepted deliberately. Custom GSL rules let you add internal requirements that no ready-made ruleset covers. We describe the process around such evidence in our guide to continuous cloud compliance.

Containers reach production faster than the security review

In a SaaS company the team ships changes daily and container images are built automatically in the CI/CD pipeline, so a manual security review cannot keep up. Image Assurance analyzes images from registries and clusters at successive stages of their life cycle, Admission Control lets you control operations in Kubernetes clusters, and Code Security together with CloudFormation template assessment moves part of the control into the pipeline — before a misconfiguration reaches production. If the organization already uses Wiz, the integration with Cloud Network Security lets you shield detected vulnerabilities at the traffic level (virtual patching) until the code is fixed.

Which scenario to start with depends on the inventory of accounts and subscriptions and on the results of a cloud configuration review.

Why deploy Check Point Cloud Security with nFlo?

Cloud security depends more on configuration and process than on the tool itself. In a Check Point Cloud Security project, the nFlo team:

• inventories accounts, subscriptions and clusters and determines which of them the compliance assessment covers,
• designs the policies: rulesets, custom GSL rules, exclusions, notifications and the scope of automatic remediation,
• deploys Cloud Network Security gateways, the WAF or the Wiz integration — depending on what the environment requires,
• maintains the configuration and reviews findings together with the cloud and application teams.

A common starting point is the Cloud Security Audit and Protection service, and for organizations connecting a data center with the public cloud — Hybrid Cloud. Start a conversation about your environment through contact; you can read about nFlo’s cooperation with the vendor on the Check Point page.

FAQ

Does Check Point Cloud Security support multiple clouds? Yes. Cloud Network Security works in public, private and hybrid clouds. According to the documentation, the CSPM module covers AWS, Azure, GCP and Kubernetes, among others, and its environment onboarding description also lists Alibaba Cloud and Oracle Cloud Infrastructure.

How does the platform detect and remediate misconfigurations? A Continuous Posture policy continuously assesses the assigned environments and notifies you about rules that failed — the first time a rule fails, not after every subsequent assessment. Automatic remediation works through CloudBots, which have to be deployed in the cloud environment; for some rules the vendor recommends preconfigured CloudBots, for others only custom ones can be used.

Does Check Point Cloud Security integrate with the CI/CD pipeline? Yes. The documentation describes Code Security built into the CI/CD pipeline, compliance assessment of CloudFormation templates before deployment and analysis of container images (Image Assurance). Automation is available through the REST API, Terraform and AWS CloudFormation.

How do you scope Check Point Cloud Security for an organization? The scope depends on what needs protection: network traffic in the cloud (Cloud Network Security), web applications and APIs (WAF), or configuration and vulnerability posture (CNAPP through the Wiz integration, CSPM capabilities). Licensing terms are set by the vendor; nFlo helps define the scope after an inventory of the environments.

Does configuration assessment require installing agents? According to the documentation, the CSPM module connects to environments directly through cloud platform APIs, so configuration assessment of accounts and subscriptions does not rely on software installed on servers. Kubernetes clusters are onboarded through a separate process, and CloudBots have to be deployed in the cloud environment. In the Wiz integration, vulnerability visibility is agentless as well.

How do you report cloud configuration compliance for an audit? For each rule, the assessment result shows the number of tested assets, assets in the scope of the rule, excluded assets and non-compliant assets. The assessment history lets you go back to the result from a chosen day, an Executive Summary report can be sent on a schedule, and exclusions are saved with a comment — so a deviation accepted deliberately is documented.