Virtual firewalls offer the advantage of dynamic scalability, making them ideal for internal segmentation in data centers. They can be quickly deployed, resized, and adjusted to meet the needs of changing workloads and environments, unlike physical firewalls which require fixed hardware resources.

The six pillars include:

1. Business (goals and outcomes)

2. People (who will perform the work)

3. Interfaces (external functions to help achieve goals)

4. Visibility (information needed to accomplish goals)

5. Technology (capabilities needed to provide visibility and enable people)

6. Processes (tactical steps required to execute on goals)

All elements must tie back to the business itself and the goals of the security operations

Data security is the only type of security that the customer is fully responsible for when using a SaaS application. Data security refers to the protection of data from unauthorized access, use, modification, deletion, or disclosure. Data security includes aspects such as encryption, backup, recovery, access control, and compliance12. The customer is responsible for ensuring that their data is secure in transit and at rest, and that they comply with any applicable regulations or policies regarding their data.

The other types of security - physical, platform, and infrastructure - are the responsibility of the SaaS provider. Physical security refers to the protection of the hardware and facilities that host the SaaS application. Platform security refers to the protection of the software and services that run the SaaS application. Infrastructure security refers to the protection of the network and systems that support the SaaS application. The SaaS provider is responsible for ensuring that these layers of security are maintained and updated, and that they meet the required standards and certifications34. References:

SaaS and the Shared Security Model

A Guide to SaaS Shared Responsibility Model

The Shared Responsibility Model for Security in The Cloud (IaaS, PaaS & SaaS)

Shared responsibility in the cloud

Containers encapsulate applications and their dependencies into lightweight, portable units that can run consistently across multiple environments. This abstraction supports cloud-native development by enabling microservices architectures, rapid deployment, and scaling within orchestration platforms like Kubernetes. Containers accelerate cloud migration by decoupling applications from infrastructure, facilitating automation, and continuous integration/continuous deployment (CI/CD) workflows. Palo Alto Networks addresses container security by integrating runtime protection, vulnerability scanning, and compliance enforcement within its Prisma Cloud platform, ensuring safe adoption of cloud-native tools and methodologies.

Attack Surface Management (ASM) platforms focus on continuous discovery and monitoring of all internet-facing assets, both internal and external, to identify attack vectors, vulnerabilities, and exposures that could be exploited by threat actors.

Decryption is required to inspect TLS-encrypted traffic, allowing security tools (such as firewalls or intrusion prevention systems) to analyze the contents of the traffic for threats that would otherwise remain hidden within encrypted sessions.

Assessing severity levels – UEBA data helps prioritize incidents by evaluating the risk and severity based on user and entity behavior.

Detecting and correlating anomalies – UEBA continuously analyzes activity to identify abnormal behavior and correlate anomalies that may indicate insider threats or compromised accounts.

IDSs and IPSs also can be classified as knowledge-based (or signature-based) or behavior-based (or statistical anomaly-based) systems:

● A knowledge-based system uses a database of known vulnerabilities and attack profiles

to identify intrusion attempts. These types of systems have lower false-alarm rates than

behavior-based systems but must be continually updated with new attack signatures to

be effective.

● A behavior-based system uses a baseline of normal network activity to identify unusual

patterns or levels of network activity that may be indicative of an intrusion attempt.

These types of systems are more adaptive than knowledge-based systems and therefore

may be more effective in detecting previously unknown vulnerabilities and attacks, but they have a much higher false-positive rate than knowledge-based systems

From a business perspective, XDR platforms enable organizations to prevent successful cyberattacks as well as simplify and strengthen security processes.