5 STEPS TO

ZERO TRUST
SECURITY on AWS
A practical and holistic
approach to implement
Zero Trust on AWS

©2019 Check Point Software Technologies Ltd. 1

 Protection from known and unknown threats CLOUDGUARD
NETWORK SECURITY
Firewall and threat prevention

Identity Awareness
Building security infrastructure for the cloud using disparate Granular visibility of users,
groups, and machines
technologies can lead to complexities and inherent security gaps.
CLOUDGUARD
Check Point offers a more practical and holistic approach to POSTURE MANAGEMENT
Visibility, compliance, and consistent
ZERO TRUST SECURITY ON AWS

implement Zero Trust on Amazon Web Services (AWS) policy enforcement

environments, based on single consolidated cyber-security Cloud Identity
architecture. Entitlement Management (CIEM)
Identity entitlement monitoring,
control, and remediation
Organizations can implement all of the Zero Trust principles that
apply to the cloud, focusing on threat prevention, workload CLOUDGUARD SPECTRAL
Code and secret scanning
protection, and powerful management and visibility tools.
With CloudGuard, organizations are empowered to implement CLOUDGUARD APPSEC
Zero Trust maximum security and efficiency. Web application and API protection with
contextual AI and no manual tuning

Check Point brings decades of experience to AWS security CLOUDGUARD

WORKLOAD PROTECTION
solutions, ensuring security is achieved everywhere.
Serverless Security
Security of Lambda functions with
automated runtime protection and
posture management
Container Security
Image assurance and least-privilege
access control for Kubernetes clusters
and more

CLOUDGUARD INTELLIGENCE
Real-time visibility
and threat response

Powered by
THREATCLOUD
Accurate prevention against the most
advanced attacks using AI technology
and big data threat intelligence

www.checkpoint.com ©2022 Check Point Software Technologies Ltd.

 1
ZERO TRUST ARCHITECTURE Prevent malicious activity with segmentation

CLOUDGUARD
NETWORK SECURITY
Set and enforce a unified access policy for
users, devices, applications, and more
across all environments

CLOUDGUARD
APPSEC
Full application protection
and control

ENTERPRISE
DATABASE CODE APP
SERVERS

www.checkpoint.com ©2022 Check Point Software Technologies Ltd.

 2
Protect against unauthorized users
Compare actual behavior vs permissions
ZERO TRUST ENTITLEMENT

CLOUDGUARD
POSTURE MANAGEMENT
CIEM functionality provides identity
entitlement monitoring, control, and
remediation

CLOUDGUARD
NETWORK SECURITY
Identity awareness functionality
integrates with AWS IAM to allow
access only to specific users

www.checkpoint.com ©2022 Check Point Software Technologies Ltd.

 2
Protect against unauthorized users (continued)
With IAM Safety, you can harden your AWS console and protect it against theft, man-in-the-browser
attacks, and more. After you activate IAM Safety, users will be asked to authorize possibly harmful
actions using their mobile device.
ZERO TRUST ENTITLEMENT

CLOUDGUARD
POSTURE MANAGEMENT
CIEM functionality provides identity
entitlement monitoring, control, and
remediation

CIEM:
Cloud Infrastructure Entitlement Management
CLOUDGUARD
NETWORK SECURITY
Identity awareness functionality
integrates with AWS IAM to allow
access only to specific users

www.checkpoint.com ©2022 Check Point Software Technologies Ltd.

 3
Protect AWS workloads
• Seamless integration with AWS
• Detect over-permissive roles, vulnerabilities, and embedded threats
• Multi layer security, leveraging machine learning to profile and protect workloads
• Enforce granular security policies during CI/CD and production for all workloads
ZERO TRUST WORKLOADS

CLOUDGUARD
NETWORK SECURITY
Threat prevention for
north-south traffic
Full control over
east-west traffic
VIRTUAL INSTANCES

CLOUDGUARD
POSTURE MANAGEMENT
AWS LAMBDA Full visibility into AWS
CONTAINERS infrastructure, identity
THREAT PREVENTION misconfigurations and
security gaps, and
FOR NORTH-SOUTH
adaptive access policy
TRAFFIC
EAST-WEST
TRAFFIC

www.checkpoint.com ©2022 Check Point Software Technologies Ltd.

 4
ZERO TRUST INTELLIGENCE Visibility and analytics

CLOUDGUARD
INTELLIGENCE
Intuitive visualization,
querying, intrusion alerts,
and notifications
Identify suspicious activity and Real- time visibility into
track trends billions of log records

CLOUDGUARD
POSTURE MANAGEMENT
Quickly detect and mitigate
threats with a single view
into security risks

Follow real-time forensic alerts on

your CSPM dashboard… …and get full visibility to risks as
well as mitigation options
www.checkpoint.com ©2022 Check Point Software Technologies Ltd.
 5
Protect from known and unknown threats
• Prevention first: highest security effectiveness score with
100% block rate*
• 0% false positives*: Fewer alerts and tickets for security
administrators and uninterrupted user productivity
ZERO TRUST THREAT PREVENTION

CLOUDGUARD
NETWORK SECURITY
Threat prevention for
north-south traffic
Full control over
east-west traffic

Advanced Automated Unified management

threat prevention network security across AWS environments Combines the latest AI
technologies with big data
threat intelligence to prevent
Provides North-South and Supports rapid deployment, Consistent policy to manage the most advanced attacks
East-West protection agility and automation of security across AWS and while reducing false positives
of cloud assets CI/CD workflows hybrid-cloud environments

* Objective third-party lab tests show CloudGuard Network Security has highest security effectiveness
score with 100% block rate, 100% malware prevention, 100% exploit resistance and 0% false positives; Check
Point is ranked as a Leader for 22 consecutive years on the Gartner Magic Quadrant for Network Firewall,
and has a Recommended rating by NSS Labs.

www.checkpoint.com ©2022 Check Point Software Technologies Ltd.

 For more information CLOUDGUARD
NETWORK SECURITY
Firewall and threat prevention

CLOUDGUARD
For nearly thirty years, Check Point has set the standard for POSTURE MANAGEMENT
cyber security. Across the ever-evolving digital world, from Visibility, compliance, and consistent
policy enforcement
enterprise networks through cloud transformations, from
securing remote employees to defending critical infrastructures, CLOUDGUARD CIEM
ZERO TRUST SECURITY ON AWS

we protect organizations from the most imminent cyber threats. Identity entitlement monitoring,
control, and remediation

www.checkpoint.com/cloudguard/amazon-aws-security CLOUDGUARD SPECTRAL

Code and secret scanning

CLOUDGUARD APPSEC
Web application and API protection with
contextual AI and no manual tuning

CLOUDGUARD
WORKLOAD PROTECTION
Serverless Security
Security of Lambda functions with
automated runtime protection and
posture management
Container Security
Image assurance and least-privilege
access control for Kubernetes clusters
and more

CLOUDGUARD INTELLIGENCE
Real-time visibility
and threat response

CHECK POINT
IDENTITY AWARENESS
Granular visibility of users,
groups, and machines

THREATCLOUD
Accurate prevention against the most
advanced attacks using AI technology
and big data threat intelligence

www.checkpoint.com ©2022 Check Point Software Technologies Ltd.