As more and more organizations migrate their data, applications, and workloads to the cloud, securing the infrastructure remains a challenge. Security teams don’t always know exactly what’s going on in each cloud environment, making it difficult to detect security policy violations.
This is the problem Paladin Cloud aims to solve with its security-as-code platform.
The Paladin Cloud platform is intended to help developers and DevOps teams protect their applications and data, both in test and in production. It achieves this goal by giving teams complete visibility into the organization’s various cloud services and systems. The platform features a plugin-based architecture that helps developers connect and ingest data from sources like code repositories, threat intelligence systems, container analytics, gateways APIs and cloud-based enterprise systems such as Kubernetes.
Supported vendor systems include Qualys Vulnerability Assessment Platform, Bitbucket, Trend Micro Deep Security, Tripwire, Venafi Certificate Management, and Red Hat. Security teams can write rules based on the data collected by these plugins to get a complete picture of the organization’s cloud security posture.
“The platform discovers assets, assesses policy, creates issues for policy violations, and prioritizes remediation,” according to a page on Paladin Cloud’s GitHub repository. If fixes for policy violations have already been set, the platform can go ahead and perform those actions to fix the issues. In this way, the platform provides automatic detection and remediation of violations such as unauthorized access, misconfigured systems, and insecure APIs.
Organizations can also leverage the platform’s extensible policy management to oversee hybrid clouds, where data and applications are hosted on public and private infrastructure.
According to the GitHub page, Paladin Cloud lists various out-of-the-box features on its GitHub page, including continuous asset discovery, the ability to search all discovered resources, custom policies and custom auto-remediation actions, clustering asset dynamics to view compliance. , exception handling, OAuth2 support, and role-based access control.
The platform is now generally available for Amazon Web Services, Google Cloud, and Microsoft Azure. In addition to announcing the platform’s availability, the company announced a $3.3 million seed funding round.