Network Security

Palo Alto Networks Next-Generation CASB is a cloud access security solution that discovers, risk-rates and controls users' interaction with SaaS applications and cloud services through security policies. With shadow IT visibility, application risk analysis, inline and API-based control, data protection and malware prevention, it covers both managed and unmanaged cloud use.

The number of SaaS applications actually in use in an organisation is usually far higher than the list IT has approved. Teams start using file-sharing, note-taking, translation or generative AI tools on their own, and the customer lists, contracts and source code uploaded to them leave the organisation's control. Approved services carry risk too: a folder shared through a public link or a report downloaded to a personal account can become a data leak without any attack at all.

Next-Generation CASB works in two ways. Inline inspection recognises the application, the user and the action (sign-in, upload, share) in traffic passing through a Palo Alto Next-Generation Firewall or Prisma Access, and tells corporate accounts from personal ones — allowing uploads only to the company tenant, for example. API-based inspection connects directly to sanctioned services such as Microsoft 365, Google Workspace, Salesforce, Box and Slack to scan data at rest in the cloud, find sensitive files shared externally and remove the sharing. SaaS Security Posture Management (SSPM) reports misconfigurations in those services. Because it uses the same data definitions as Enterprise DLP, one data policy applies across the firewall, the endpoint and SaaS, and uploaded files are analysed for malware by WildFire.

The organization can see centrally which cloud applications are in use and what data is being shared in them. Risky applications can be blocked or redirected to safe alternatives, and rules on downloading and sharing data can be enforced in approved SaaS services. This visibility reduces shadow IT and data leakage risk without halting cloud adoption, creating a controlled SaaS usage model across security, compliance and business units.

ATEON supports the rollout of CASB on an existing Palo Alto firewall or Prisma Access deployment through application discovery reporting, risk classification, policy design and a phased transition: real usage is measured in monitoring mode first, and blocking rules are written from that data.

Palo Alto Networks Next-Generation Firewall is a next-generation firewall platform that analyses network traffic not by port and protocol alone, but by application, user, content and threat context. It delivers application control, IPS, URL filtering, malware prevention, SSL inspection, DNS security and advanced threat prevention in physical, virtual and cloud form factors.

Detailed visibility of applications and users makes it possible to apply precise policies matched to business need, rather than broad network permissions. Bringing several security functions together under the same policy and management structure reduces operational complexity. The organization can stop known and unknown threats at the network layer, strengthen segmentation, and provide consistent security across data centre, branch and cloud environments.

Prisma Access ZTNA is a cloud-based Zero Trust Network Access solution that lets users reach private and cloud applications on the basis of identity, device posture and continuous risk assessment, regardless of where they are. Instead of the broad network access a traditional VPN provides, it connects the user only to the application they are authorized for and monitors the level of trust throughout the session.

Application-level access limits the ability of a compromised account or device to move laterally within the network. Providing a common access model for remote workers, contractors and branches reduces the complexity of VPN infrastructure. Central policy and cloud scale allow new users and applications to be brought online faster, improve the access experience, and make the Zero Trust strategy measurably enforceable.

Prisma Access Browser is a secure enterprise browser that governs access to corporate applications and data directly at the browser layer. On managed or personal devices it protects SaaS and web applications by controlling actions such as copying, downloading, printing, taking screenshots, uploading files and using extensions according to identity, device and data context.

Browser-based control helps provide secure access without installing a full management agent on the device — particularly useful in BYOD, contractor and merger-and-acquisition scenarios. Corporate data is separated from personal use, reducing the chance of sensitive data persisting on the device or being moved through unauthorized channels. Because it offers fast access without disrupting the user experience, it supports the business while, in certain scenarios, reducing the need for more costly approaches such as VDI.