* [Blog](https://www.paloaltonetworks.com/blog)
* [Palo Alto Networks](https://www.paloaltonetworks.com/blog/corporate/)
* [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/)
* Seven Guiding Principles ...

# Seven Guiding Principles to Selecting the Right Cloud Security Solution

[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2019%2F07%2Fseven-guiding-principles-selecting-right-cloud-security-solution%2F)  
[](https://twitter.com/share?text=Seven+Guiding+Principles+to+Selecting+the+Right+Cloud+Security+Solution&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2019%2F07%2Fseven-guiding-principles-selecting-right-cloud-security-solution%2F)  
[](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2019%2F07%2Fseven-guiding-principles-selecting-right-cloud-security-solution%2F&title=Seven+Guiding+Principles+to+Selecting+the+Right+Cloud+Security+Solution&summary=&source=)  
[](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/2019/07/seven-guiding-principles-selecting-right-cloud-security-solution/&ts=markdown)  
\[\](mailto:?subject=Seven Guiding Principles to Selecting the Right Cloud Security Solution)  
Link copied  
By [Jonathan Bregman](https://www.paloaltonetworks.com/blog/author/jonathan-bregman/?ts=markdown "Posts by Jonathan Bregman")  
Jul 16, 2019  
5 minutes  
[Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown)  
[AWS](https://www.paloaltonetworks.com/blog/tag/aws/?ts=markdown)  
[Azure](https://www.paloaltonetworks.com/blog/tag/azure/?ts=markdown)  
[Google Cloud Platform](https://www.paloaltonetworks.com/blog/tag/google-cloud-platform/?ts=markdown)  
[Prisma Public Cloud](https://www.paloaltonetworks.com/blog/tag/prisma-public-cloud/?ts=markdown)

This post is also available in: [简体中文 (Chinese (Simplified))](https://www.paloaltonetworks.com/blog/2019/08/seven-guiding-principles-selecting-right-cloud-security-solution/?lang=zh-hans "Switch to Chinese (Simplified)(简体中文)") [繁體中文 (Chinese (Traditional))](https://www.paloaltonetworks.com/blog/2019/08/seven-guiding-principles-selecting-right-cloud-security-solution/?lang=zh-hant "Switch to Chinese (Traditional)(繁體中文)") [日本語 (Japanese)](https://www.paloaltonetworks.com/blog/2019/08/seven-guiding-principles-selecting-right-cloud-security-solution/?lang=ja "Switch to Japanese(日本語)") [한국어 (Korean)](https://www.paloaltonetworks.com/blog/2019/08/seven-guiding-principles-selecting-right-cloud-security-solution/?lang=ko "Switch to Korean(한국어)") [Português (Portuguese (Brazil))](https://www.paloaltonetworks.com/blog/2019/08/seven-guiding-principles-selecting-right-cloud-security-solution/?lang=pt-br "Switch to Portuguese (Brazil)(Português)")
![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2019/07/allan-kristensen.jpeg)
Allan Kristensen, Sr. Director, Systems Engineering, Public Cloud at Palo Alto Networks.

I recently had the opportunity to chat with Palo Alto Networks Senior Director of Worldwide Public Cloud Security SEs, Allan Kristensen, who brings 15+ years of experience building highly effective solutions engineering (SE) teams. The Palo Alto Networks SE team has firsthand knowledge of the unique and diverse cloud security challenges that prospective customers are looking to solve.

Based on my conversation with Allan, here are seven essential principles to guide you as you evaluate and select the right cloud security offering for your multi-cloud environments, spanning AWS, Azure, and Google Cloud Platform.

**Principle One: Multi-cloud support -- AWS, Azure, and GCP at a minimum**

In our experience, more than three-quarters of our customers have a multi-cloud strategy -- maybe not initially, but definitely down the road. With that in mind, it's important to select a solution that can span clouds and deliver truly integrated multi-cloud support -- with a centralized approach that seamlessly unifies visibility across each of your cloud environments today and in the future.

**Principle Two:** **100% SaaS-based and API driven -- no agents or proxies**

A 100% API-based SaaS solution is the only way you can effectively manage the dynamic, distributed nature of cloud environments. Our experience shows that customers trying to leverage agent or proxy-based point products introduce considerable friction and end up with security blind spots. There is far too much overhead, risk, and manual work required to deploy and maintain non-API based products.

**Principle Three: Continuous resource discovery**

You can't protect what you can't see. It's important to select a solution that continuously monitors and dynamically discovers your cloud resources, such as virtual machines, database instances, storage buckets, users, access keys, security groups, networks, gateways, snapshots, and more. A centralized and auto-updating inventory that displays the security and compliance status of every deployed resource is foundational for a truly effective cloud security strategy.

**Principle Four: Automated resource monitoring**

Equally important is your solution's ability to automatically apply robust security policies and swiftly remediate misconfigurations to ensure adherence to your corporate-defined security policies. These capabilities must cover all the key risk vectors in your cloud environments, including:

* **Configuration checks** *:* [Recent research from Unit 42](https://start.paloaltonetworks.com/5-key-cloud-security-trends) highlights that \*\*32%\*\*of organizations publicly exposed at least one cloud storage service. Configuration checks help ensure any deployed cloud resource is properly configured and within defined guardrails as well as that you don't have any configuration drift across your AWS, Azure, and GCP public cloud environments.
* **Network activities** *:* The same [Unit 42](https://unit42.paloaltonetworks.com/unit-42-cloud-security-trends-tips/)research also shows that **11%** of organizations currently have cryptojacking activities in their environments. To ensure you have complete visibility into suspicious network traffic and activities, your chosen solution must be able to continuously monitor your cloud environments. It's not enough to just have configuration and compliance checks in place, because these will only tell you what *can* go wrong, not what *is* going wrong. Here's an example:

Configuration checks can help detect and alert on loosely configured Security Groups that allow inbound traffic on all ports from all IP addresses. This could be a mission-critical issue. However, without network monitoring, you simply cannot determine if the vulnerability has been exploited, nor whether malicious traffic has penetrated beyond the Security Group.

* **User and access key monitoring** *:* Unit 42 data also indicates \*\*29%\*\*of organizations experienced potential account compromises, which can not only lead to data loss but also loss of control, and ultimately confidence in your cloud environments. User behavior analytics (UBA) and other machine learning (ML)-based capabilities can help detect sneaky activities, such as hijacked credentials. These capabilities help customers look for and alert on anomalous activities. Without UBA, it's nearly impossible to detect sophisticated attacks in time.
* **Host vulnerability and threat detection monitoring** *:* It's important to select a cloud security offering that can correlate and contextualize threat and vulnerability data from third parties.

**Principle Five: Correlate lots of data**

Continuous contextualization of multiple, disparate data sets is critical for building a deep understanding of your security posture. Only once you have a complete understanding of your security profile and risks can you quickly remediate issues. Here are just a couple of common examples:

* Workloads with overly permissive security group configurations, known host vulnerabilities detected, and traffic from suspicious IP addresses etc.
* Identification of privileged user activities across cloud environments which are performed for unusual (not seen before) locations.

**Principle Six: Remediation is good. Auto-remediation is better.**

Having multiple remediation options (both guided and automated) is important for reducing your window of exposure. For example, if the system identifies a publicly accessible Network Security Group associated with a sensitive workload, the ability to automatically restrict access is paramount. The ability to also write custom remediation rules tailored to meet your specific needs is key. A "self-healing" ability enables organizations to ensure that their 'gold standard' security and compliance policies are *always* enforced.

**Principle Seven: Integrate**

Finally, it's important to leverage an open platform, which enables you to send cloud alerts to existing tools and workflows, such as your SIEM, SOAR, ticketing systems, collaboration tools, etc.

[Prisma Public Cloud](https://www.paloaltonetworks.com/cloud-security/prisma-public-cloud?ts=markdown)is the most complete cloud security offering on the market, incorporating all seven principles discussed above. See [the Prisma difference](https://www.paloaltonetworks.com/cloud-security/prisma-public-cloud?ts=markdown) for yourself.

*** ** * ** ***

## Related Blogs

### [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown), [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown)

[#### From 'DevOps vs. SecOps' to DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/devops-vs-secops-devsecops/)

### [Secure the Cloud](https://www.paloaltonetworks.com/blog/category/secure-the-cloud/?ts=markdown)

[#### How Western Asset Management Is Mitigating Cloud Threats](https://www.paloaltonetworks.com/blog/2019/07/western-asset-management-mitigating-cloud-threats/)

### [Cloud NGFW](https://www.paloaltonetworks.com/blog/network-security/category/cloud-ngfw/?ts=markdown), [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown)

[#### From Control to Command: The Future of Multicloud Security](https://www.paloaltonetworks.com/blog/network-security/from-control-to-command-the-future-of-multicloud-security/)

### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Cloud NGFW](https://www.paloaltonetworks.com/blog/network-security/category/cloud-ngfw/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### Cloud NGFW is Essential for AWS \& Azure Cloud Traffic Protection](https://www.paloaltonetworks.com/blog/network-security/cloud-ngfw-is-essential-for-aws-azure-cloud-traffic-protection/)  
[#### Simplifying Network Security for Enterprises in Public Cloud](https://www.paloaltonetworks.com/blog/network-security/for-enterprises-public-cloud/)

### [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Data Security Posture Management](https://www.paloaltonetworks.com/blog/cloud-security/category/data-security-posture-management/?ts=markdown)

[#### Are Cloud Serverless Functions Exposing Your Data?](https://www.paloaltonetworks.com/blog/cloud-security/secure-access-cloud-serverless-functions/)

### Subscribe to the Blog!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up  
Please enter a valid email.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.  
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.  
{#footer} {#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language