Code Security
Secure Cloud-Native Applications and
Infrastructure Across the Development Lifecycle
Prisma Cloud reduces the burden on security teams while enabling
engineers to develop secure cloud-native applications and
infrastructure. The platform offers full-stack security from code to
cloud, covering container image scanning, software composition
analysis (SCA), infrastructure as code (IaC) security, secrets security,
and CI/CD security.
Prisma by Palo Alto Networks | Code Security | Datasheet 1
Automated Security from Code to Cloud
Developers and DevOps teams are increasingly using containers, IaC templates, and open-source
software to more quickly provision and update cloud applications and infrastructure. Prisma Cloud
provides visibility, control, and automated fixes for vulnerabilities and misconfigurations to ensure
deployed code is secure. This feedback is embedded in developer tools across the full application lifecycle.
Code Security Capabilities
IaC Security
Prisma Cloud identifies misconfigurations in Terraform, CloudFormation, ARM, Kubernetes,
Dockerfile, and serverless templates by comparing resource blocks against hundreds of policies sourced
from industry benchmarks like CIS, PCI, and HIPAA as well as community contributions. Prisma Cloud
embeds those checks in DevOps tools such as integrated development environments (IDE), version
control systems (VCS), continuous integration, continuous delivery (CI/CD) pipelines, and cloud envi-
ronments. Those integrations provide actionable feedback to engineering teams along with the ability
to block and generate fixes for misconfigurations in the DevOps tools.
Figure 1: IaC pull request comments with fix recommendations in a VCS
Secrets Security
Storing secrets in a file in a VCS like GitHub is not secure yet happens when developers leave secrets in
source code. Once a secret is committed into a repo, it is saved in its history, and any user can easily access
those keys. This is especially risky if the repo contents are made public, making that resource easily found
and utilized by threat actors. To prevent this, Prisma Cloud takes a multidimensional approach to finding
and securing exposed and vulnerable secrets across all files across repositories and CI/CD pipelines.
Figure 2: Secrets security with Checkov
Prisma by Palo Alto Networks | Code Security | Datasheet 2
Container Image Scanning
DevOps teams leveraging containers can find and remediate vulnerabilities in their operating system
and language libraries to improve security posture across the software development lifecycle. Prisma
Cloud scans images locally in the build phase of CI/CD pipelines and registries to identify the exact
layer with vulnerabilities and compliance violations, including malware. The platform also offers fine-
grained controls for blocking images based on the severity with allow lists by base image, CVE, and time
since remediation.
Figure 3: Container image vulnerability and compliance scanning with Prisma Cloud
Software Composition Analysis
Open-source packages make up a majority of modern codebases. Prisma Cloud analyzes these packages
and their complete dependency trees to identify known vulnerabilities and license compliance issues.
By providing automated and granular version bump fixes, blocking violating packages from being
deployed, and connecting vulnerabilities with infrastructure misconfigurations, Prisma Cloud helps
organizations prioritize and address application risk faster.
Figure 4: Open-source vulnerability scanning with Prisma Cloud
Prisma by Palo Alto Networks | Code Security | Datasheet 3
CI/CD Security
CI/CD pipelines are a critical component of cloud-native software development, but they can give bad
actors access to code and secrets if left unsecured. Prisma Cloud provides a powerful yet simple way to
gain visibility and control across CI/CD pipelines. Leverage the Cloud Application Graph (see figure 5) to
map attack pathways through your entire engineering ecosystem.
Figure 5: CI/CD security issues are mapped by system and category to provide visibility into risks
About Prisma Cloud
With Prisma Cloud by Palo AltoNetworks,
Prisma® Cloud is the industry’s most comprehensive cloud-native Sabre gained a centralized view of its
application protection platform (CNAPP) with the broadest securi- environment and resources. With this
ty and compliance coverage—for applications, data, and the entire newfound visibility, the company also shifted
cloud-native technology stack—throughout the development lifecy- security earlier in the development lifecycle
cle and across hybrid and multicloud environments. Our integrated and effectively scaled security across multiple
approach enables security operations and DevOps teams to stay agile, layers and instrumentation platforms.
collaborate effectively, and accelerate secure cloud-native applica-
Read the full case study.
tion development. To learn more, visit us online.
3000 Tannery Way © 2023 Palo Alto Networks, Inc. Palo Alto Networks and the Palo Alto Networks
Santa Clara, CA 95054 logo are registered trademarks of Palo Alto Networks, Inc. A list of our trademarks
can be found at https://www.paloaltonetworks.com/company/trademarks.html.
Main: +1.408.753.4000 All other marks mentioned herein may be trademarks of their respective companies.
Sales: +1.866.320.4788 prisma_ds_cloud-code-security_070523
Support: +1.866.898.9087
www.paloaltonetworks.com
