What Is a Cloud Workload Protection Platform (CWPP)? A cloud workload protection platform (CWPP) is a security solution built to secure workloads in modern cloud and data center environments. An effective CWPP can deliver consistent security controls and visibility for physical machines, virtual machines, containers, and serverless workloads anywhere. CWPPs scan for known vulnerabilities when workloads are deployed and secure them at runtime with identity-based microsegmentation, host-based intrusion prevention, optional anti-malware, and more.

Why Is CWPP Important?

Legacy network-based technologies generally don’t cross over well into cloud environments. Most enterprises use a combination of cloud service providers (CSPs) and private data centers to house applications, making it difficult for legacy network-based technologies to provide the consistent and full visibility enterprises need for their workloads. Modern enterprises need to put their applications, workloads, and services at the center of their security plans.

Critically, because endpoint protection platforms were originally developed primarily to protect laptops, desktops, and mobile devices—not cloud workloads—they can put enterprise data at risk. A true CWPP has been built from the ground up to secure workloads in the cloud, not simply repurposed from legacy technology built for another use.

Moreover, workload security should be proactive, not reactive. For instance, it’s best to scan cloud workloads at deployment for vulnerabilities and misconfigurations, given that misconfigurations often present a greater risk to organizations than workload compromise.

What to Look for in a CWPP

As enterprises evolve, the need for a CWPP continues to grow. There are a lot of options in the market, not all of them full-featured platforms—so if you’re comparing different CWPP solutions, here are some things to keep in mind:

• In the near future, most enterprise infrastructure will be hybrid, multicloud architecture, so an effective CWPP needs to protect physical machines, VMs, containers, and serverless workloads.
• You should be able to manage a CWPP from one console, managed through a single set of APIs.
• A complete CWPP offering should expose all of its functionality via APIs to facilitate automation in cloud environments.
• CWPP vendors should be able to share a roadmap and architecture design for serverless protection.

CWPP Considerations for Security Leaders

Product features aside, it’s important to consider how to incorporate CWPP functionality in order to achieve future-forward cloud workload protection. Some recommendations:

• Visibility and control: Make sure your architecture provides you consistent visibility and control of all workloads, no matter their location, size, or architecture.
• Container protection: Consider CWPP vendors that provide container security or have clearly roadmapped support for serverless protection, and that offer integrated cloud security posture management (CSPM) to identify risky configurations.
• Scanning and compliance: Workload scanning and compliance should be extended into DevOps as part of a DevSecOps approach (especially with container-based and serverless function PaaS-based development and deployment).
• Zero trust principles: Use a default-deny approach to workload protection where possible at runtime—even if only in detection mode—instead of a strategy based on antivirus.
• Flexibility: Architect for CWPP scenarios where you can’t use runtime agents, or where they don’t make sense.

Zscaler and CWPP

A key component of the Zscaler platform is Zscaler for Workloads, which offers services critical to protecting workloads, including:

• Cloud security posture management: Misconfiguration of cloud apps is one of the most common sources of cloud data loss. Zscaler Workload Posture quickly identifies and remediates application misconfigurations in IaaS, PaaS, and SaaS environments.
• Zero trust network access (ZTNA): Anything that exposes users and apps to the internet (e.g., VPNs) can increase your network’s risk of being discovered and attacked—every internet-facing firewall or tool expands your attack surface. Zscaler Private Access™, a ZTNA service, gives your workforce, partners, and third parties secure access to cloud applications without placing them on your network or exposing your applications to the internet.
• Secure any-to-any connectivity: Extending your network to public clouds with site-to-site VPNs is costly, dangerous, and complicated. In contrast, Zscaler Workload Protection provides zero trust app-to-app and app-to-internet connectivity across hybrid and multi-clouds, eliminating the complexity and cost of hubs, virtual firewalls, VPNs, and static network-based policies.
• Workload segmentation: IP-based network segmentation increases your risk of exposure and lateral movement because it’s poorly equipped to handle dynamically changing cloud workloads. Zscaler Workload Segmentation provides fast microsegmentation of app workloads, allowing you to quickly identify risk, apply segmentation, and automatically update policies—without network changes and with 90% fewer microsegmentation policies.

Zscaler for Workloads constitutes a comprehensive, future-ready cloud workload protection platform.