Issue link: https://insights.oneneck.com/i/1458399
34 Data Center & Hybrid Cloud Security For Dummies, Palo Alto Networks Special Edition These materials are © 2020 John Wiley & Sons, Inc. Any dissemination, distribution, or unauthorized use is strictly prohibited. In this chapter, you learn how Zero Trust helps you ensure an effective and consistent security posture across your data center and hybrid cloud environment. Gaining Complete Visibility A Zero Trust architecture requires complete visibility of your orga- nization's protect surface, which is orders of magnitude smaller than its attack surface and is always knowable. Your organiza- tion's protect surface consists of all your critical data, applications, assets, and services (DAAS). This can include: » Data such as protected health information (PHI), personally identifiable information (PII), financial information, and intellectual property (IP) » Applications including commercial off-the-shelf software, software-as-a-service (SaaS), and custom developed software » Assets such as supervisory control and data acquisition (SCADA) systems, point-of-sale (POS) terminals, medical equipment, manufacturing systems, and Internet of Things (IoT) devices » Services such as Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), Active Directory, and Lightweight Directory Access Protocol (LDAP) As discussed in Chapter 1, legacy port-based firewalls do a poor job of identifying applications, content, and users. A next-generation firewall enables comprehensive Layer 7 visibility of your entire data center and hybrid cloud protect surface (see Figure 3-1). It performs true classification of data and application traffic, based not simply on port and protocol (like a port-based firewall) but on contextual factors such as a user, their device, and the applications they need to use to perform their role throughout the day. This classification and filtering activity occurs as an ongoing process of application analysis, decryption, decoding, and heuris- tics as well. These capabilities progressively peel back the layers of a traffic stream to determine its true application identity.