Cloud Network Analyzer

Cloud Network Analyzer (CNA) by Prisma Cloud takes a multi-dimensional approach in identifying overly-exposed assets by providing end-to-end network path visibility from any source, such as an AWS EC2 virtual machine, DB instance, or Lambda application to any destination, such as the internet, another VPC, or on-premises networks. CNA helps you determine the network exposure of your cloud assets and secure them from network threats by providing an end-to-end path analysis. It also helps you in identifying Kubernetes services that are internet exposed.

For example, a compute instance is directly exposed to the internet only when it has an Elastic Network Interface (ENI) with EIP attached to a public subnet and has overly permissive security-group in a VPC that is attached to an gateway with internet connectivity.

CNA also provides visibility into the associations between security groups and compute instances, such as EC2, RDS, or Redshift to identify network security risks before they become incidents. For example, you can address the risk when a compute instance has direct internet access because it has an ENI attached to a public subnet, overly permissive security-group, and is in a VPC that is attached to an internet gateway with route to internet.

Prisma Cloud does not send actual traffic or read network logs for performing network path analysis. The CNA engine correlates multiple data points, including routing paths and security policy configurations using graph-based modeling and then runs a complex calculation to evaluate the net effective action (Allow or Deny).

Some of the important use cases that you can address using CNA are:

• Internet exposed AWS EC2 instances, Azure VMs, interfaces, PaaS, or workloads
• AWS applications or workloads that have unrestricted access to the internet (Egress)
• Overly permissive security groups attached to sensitive workloads
• AWS RDS or sensitive DB workloads exposed to the internet
• Production applications connected to QA or staging environments between cloud accounts or VPCs
• Object storage buckets with sensitive data exposed through network connectivity to external cloud accounts or networks
• Kubernetes services internet exposed and the underlying endpoints and associated deployments.