This transcript was generated automatically by AI. If you find any mistakes, please email us.
Tomer: In cloud security, the threats are evolving, but so are the misconceptions. Hello everyone, you're listening to Cloud Next, your go-to source for Cloud innovation and leaders' insight brought to you by Global Dots. Welcome to a special short on the ground edition of Cloud Next. I'm Tomer Molfudsen and this episode was recorded live at a closed event hosted by GlobalDots and Cloudflare, focused on one of the hottest topics in modern cloud security, WAF or SaaS and cloud native environments. We sat down for two quick but powerful conversations with people who truly know the space. Moshe Weiss, CISO at Aquasecurity and and Eran Gutman, VP of IT and Security at Pixellot. Short Talks Deep takeaways let's dive in. As someone who knows this space from the inside, what do you think are the most important things to consider when evaluating a WAF solution?
Moshe Weis: Okay, so really I think it comes down to a few different types of features that WAFs provide for the organization. So number one, first and foremost, anything related to what I like to call negative security, being able to black out the objective bad, and then you have the whole area of positive security. So it's not sufficient to just block out the objective bad. You need to also know what you're protecting. You have to understand your applications and based on that you need to create your rule sets for what you want to allow. Because we know that any zero day can easily bypass the negative security modules on waf. So we have the negative security, we have the positive security and then we had everything that has to do with, you know, DDoS or application DDoS, prevention, anything that's to do with flow control. So again there's the objective bad, what's considered a DDoS attack or a volumetric attack which needs to be blocked, or bot classification and protection. And there's also the positive flow control that I know what my application can consume and I want to be able to provide the maximum parameters for that. So I think those three areas pretty much sum up what I would be looking for in a waf.
Tomer: While Moshe focuses on the layered technical capabilities a WAF should offer, Rand Gutman brings a different perspective, emphasizing the importance of visibility and the real time understanding before diving into remediation.
Eran Gutman: First of all, I think the most important thing is visualization. So we need to know what happened, how it happened, from when it happened. So when we got all the visualization then we go into the next level. So the next level is to try to remediate it. Sometimes you have to, you're doing automatic remediation. Sometimes you have to think about the purpose and the process. But eventually you are remediate and you prevent non attack or a dedicated tag on your site or something like that.
Tomer: What's a common mistake you see companies make when it comes to securing cloud native applications? And what should they do differently?
Eran Gutman: I think the most current mistake is to look on the small picture and not all the overall picture. Because cloud security, it's a name but you need all the ecosystem so you need to identify the resources from one side. You need to identify your client or customer, your feature, sometimes your feature maybe look like best practice vulnerabilities and there are not vulnerabilities. This is the one side, that's the other thing. Look over the overall picture. So you need to have visibility of all. You don't use only the cloud security tools, you must have other tools that integrate it. Like let's say the secure code code sometimes because all the problem because you are develop, because you have developed the thing and you came from the code to the production to you understand all the process. Of course the the most thing is to understand the business need. So when you take advisor or integrated some companies they need to understand the business, the value of the business, the way the business work before taking any consumption or other things to remediate security things.
Tomer: While Iran stresses the need to see the bigger picture, the full ecosystem, the business logic and the development process. Moshe Vais takes it a step further pointing to a critical gap in security teams themselves. The lack of modern cloud native expertise.
Moshe Weis: So when it comes to securing cloud native applications, Cloud native applications are different in nature than what we call legacy workloads due to the fact that their lifecycle spans over everything from developers to runtime operations. And that's how cloud native differs and technology is different. We don't use static endpoints, we don't use static IPs. We kind of lost our control in the infrastructure level. And I think that the main mistake that companies make is not having the technological know how in the security staff to be able to secure that. And therefore I believe that security teams need to be more knowledgeable in the DevSecOps and the modern CICD areas. And they need to be able to onboard a proper security tool that understands the cloud native applications both from a runtime perspective, from a shift left perspective and from a posture management perspective when.
Tomer: Dealing with WAF or broader security tools. Where do you think automation brings the most value and where do you still rely on people to get it right?
Moshe Weis: I Think that automation can primarily benefit the reduced time of being operational, ready to implement blocking mode on your waf. And this is simply because one of the main pain points of wafs that we have today is being able to fine tune the system by with the false positive and true negative ratio, which is always the hardest part of operationalizing the waf. And I think that automation can go ahead and be able to assist with creating the fine tuned and granular rules that on one hand will not block false positives and on the other hand will give enough value that it actually block attacks. I think that the human factor is needed because we all know that automation alone, even with the assistance of AI is just not there yet. And it definitely needs the oversight to be able to know what we're actually blocking in production.
Tomer: While Moshe drills into the operational challenge of false positives and the role of fine tuned automation, Ran Gutman takes a broader view, framing automation as an unstoppable shift, a revolution that security leaders must embrace.
Eran Gutman: So the world go into automation, we call it today AI, tomorrow we'll carry something else. But the automation is coming, so you need to be reliable on automation. It should be reliable. It should understand the behavior of the process of the service that you are delivering. And I think we'll go over there. So somehow on the future we don't do the paper just to check if there is no false positive and things like that. Especially not to do the work, the manual work. But I think the world is going to there and you need to align, audit and hug it and join the revolution.
Tomer: If you can't beat them, join them.
Moshe Weis: Right?
Eran Gutman: Yes, of course.
Tomer: Thank you very much for your time and your insights.
Eran Gutman: Thank you.
Tomer: Enjoy the event.
Eran Gutman: Thank you.
Moshe Weis: Thank you very much.
Tomer: There you go folks. Two perspectives, one clear message. WAF is no longer just about blocking threats. It's about visibility, context and knowing what not to block. Thanks again to Moshe Weiss and Aran Gutman for sharing their thoughts and to everyone who joined us at the event. Until next time, stay secure, stay curious. Ask Global DOTS.
Ganesh: This episode was produced and edited by Daniel Ohana and Thoma Morvenson. Sound editing and mix by Bren Russell I'm Ganesh the Awesome and if you're ready to deep dive and start transforming the way you approach cloud practices and cybersecurity strategies, then the team and myself at Global Dots are at your disposal. We are cloud innovation hunters and we search the globe looking for the future tech solutions so we can bring them to you. We've been doing it for over 20 years. It's what we do. And if I don't say so myself, we do it pretty well. So have a word with the experts, don't be shy, and remember that conversations are always for free.
