What Is a Cloud Workload Protection Platform (CWPP)?

A cloud workload protection platform (CWPP) is a security solution built to secure workloads in modern cloud and data center environments. An effective CWPP can deliver consistent security controls and visibility for physical machines, virtual machines, containers, and serverless workloads anywhere. CWPPs scan for known vulnerabilities when workloads are deployed and secure them at runtime with identity-based microsegmentation, host-based intrusion prevention, optional anti-malware, and more.

Why Is CWPP Important?

Legacy network-based technologies generally don’t cross over well into cloud environments. Most enterprises use a combination of cloud service providers (CSPs) and private data centers to house applications, making it difficult for legacy network-based technologies to provide the consistent and full visibility enterprises need for their workloads. Modern enterprises need to put their applications, workloads, and services at the center of their security plans.

Critically, because endpoint protection platforms were originally developed primarily to protect laptops, desktops, and mobile devices—not cloud workloads—they can put enterprise data at risk. A true CWPP has been built from the ground up to secure workloads in the cloud, not simply repurposed from legacy technology built for another use.

Moreover, workload security should be proactive, not reactive. For instance, it’s best to scan cloud workloads at deployment for vulnerabilities and misconfigurations, given that misconfigurations often present a greater risk to organizations than workload compromise.

What to Look for in a CWPP

As enterprises evolve, the need for a CWPP continues to grow. There are a lot of options in the market, not all of them full-featured platforms—so if you’re comparing different CWPP solutions, here are some things to keep in mind:

• In the near future, most enterprise infrastructure will be hybrid, multicloud architecture, so an effective CWPP needs to protect physical machines, VMs, containers, and serverless workloads.
• You should be able to manage a CWPP from one console, managed through a single set of APIs.
• A complete CWPP offering should expose all of its functionality via APIs to facilitate automation in cloud environments.
• CWPP vendors should be able to share a roadmap and architecture design for serverless protection.

CWPP Considerations for Security Leaders

Product features aside, it’s important to consider how to incorporate CWPP functionality in order to achieve future-forward cloud workload protection. Some recommendations:

• Visibility and control: Make sure your architecture provides you consistent visibility and control of all workloads, no matter their location, size, or architecture.
• Container protection: Consider CWPP vendors that provide container security or have clearly roadmapped support for serverless protection, and that offer integrated cloud security posture management (CSPM) to identify risky configurations.
• Scanning and compliance: Workload scanning and compliance should be extended into DevOps as part of a DevSecOps approach (especially with container-based and serverless function PaaS-based development and deployment).
• Zero trust principles: Use a default-deny approach to workload protection where possible at runtime—even if only in detection mode—instead of a strategy based on antivirus.
• Flexibility: Architect for CWPP scenarios where you can’t use runtime agents, or where they don’t make sense.

Zscaler and CWPP

A key component of the Zscaler platform is Zscaler Workload Communications, which delivers comprehensive zero trust security for your cloud workloads. The Zscaler platform inspects all traffic inline to protect against cyberthreats and data loss, establishes the identity and context of the access request, and applies all appropriate policies before establishing connectivity to the internet, SaaS apps, or private workloads.

Zscaler Workload Communications gives your organization the power to:

• Secure mission-critical cloud applications: Prevent zero-day attacks, data loss, and ransomware attacks for mission-critical applications to ensure ongoing business operations.
• Eliminate site-to-site VPNs: Apply least-privileged access policies when connecting your cloud workloads located in different VPCs/VNets, regions, or public clouds with zero trust.
• Accelerate M&A integrations: Streamline post-M&A integration by enabling cross-network application access without connecting networks. Administer universal security posture to protect workloads across multiple VPCs, regions, and public clouds.
• Secure cloud virtual desktop infrastructure: Secure persistent and non-persistent VDI delivered from cloud infrastructure by applying policies to control access to explicitly allowed sites and private applications.