Agentless Workload Posture

Benefits

• Deep security visibility with seamless deployment

• Continuous scanning for vulnerabilities and secrets

• Automatic update of scanning tools and vulnerability databases

• Feed for CloudGuard Risk Management solution to identify and prioritize risks

Prerequisites

Your account (AWS account or Azure subscription) must be onboarded to CloudGuard before AWP can scan your virtual machines and serverless functions. If your account is not yet onboarded, see instructions in Onboarding Cloud Environments.

How AWP Works

AWP focuses on the file system of your workload.

AWP does not install an agent to scan the files on the machine. Instead, it makes snapshots of the virtual machine volumes or disks. AWP uses these snapshots to statically scan your packages, dependencies, and libraries on a dedicated AWP scanner machine. During scanning, AWP checks the VMs for known vulnerabilities (such as Log4j) and hardcoded secrets registered in security databases. The databases are updated daily according to the current security trends.

Azure Function Apps scanning is enabled by default when you select to scan Azure VMs with In-Account or Sub-Account mode. You can disable this option when you start onboarding. After initial scanning upon onboarding, AWP scans Function Apps when it detects changes.

After scanning is done, the CloudGuard portal shows the scan results for each supported entity. If AWP detects a vulnerability or a hardcoded secret, it shows you the vulnerable entity and suggests remediation. Then, by default AWP scans your VMs once every 24 hours. For Function Apps, AWP inspects the lastModifiedTimeUtc attribute of the Function App and rescans it when the attribute changes.

You can select one of two modes for AWP:

• SaaS Mode - AWP creates the snapshots of your EC2 volumes or VM disks and scans the snapshots on a virtual machine located in CloudGuard's own AWS account or Azure subscription. With this mode, you do not pay for the scans, and CloudGuard fully manages all the required resources.

• In-Account Mode - AWP scans data locally, so everything stays in your AWS or Azure account. The only data sent to CloudGuard are the AWP scanner findings. With this mode, you can keep all your data private, but the volumes/disks scanning entails additional costs.

Onboarding AWP

To enable AWP in your environment:

1. In the CloudGuard portal, navigate to Assets > Environments.

2. Click Enable AWP for your environment.

3. Follow the instructions on the wizard page that opens. For more details, see:

   1. AWS - AWP for AWS Environments

   2. Azure - AWP for Azure Environments

4. In the CloudGuard wizard, click Next. CloudGuard completes the process to enable AWP scanning.

AWP starts to scan the VMs and functions and shows the first results within several minutes. Depending on the number of assets, the scan can take up to a few hours. The scanned assets appear on the Protected Assets page of the CloudGuard portal.

Viewing Results

To see the scan results:

1. In the CloudGuard portal, go to Assets > Protected Assets and filter the view by the asset type AWS EC2 Instance, Azure Virtual Machine or Azure Function App.

2. Make sure that the Scan Status of the asset that you need is Scanned.

   • In Progress - The asset is being scanned.

   • Internal Error - The asset scan encountered an error.

   • Pending Scan - The asset is not scanned yet.

   • Scanned - AWP scanned the asset, and the results are available.

   • Skipped - AWP excluded the asset from scanning (For types of skipped entities, see Known Limitations).

3. Click the asset to see its page and go to the Vulnerabilities tab that contains the scan results. It shows the most recent scan date and time.

You can search and filter the scan results by appropriate criteria in the Remediation Summary.

See in the tabs these types of vulnerability:

• CVEs - Shows scan of packages installed on the EC2, scanning package managers existing on the machine, and all libraries. Results are sorted by severity. Each package contains a list of CVEs found on it, sorted by severity as well. The header shows the file path, so if the package is installed in more than one place, you must apply the remediation for every found instance of the CVE The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures.. If the issue is fixable, the Remediation section in the header shows the way.

• Secrets - Shows insecure or exposed keys, passwords, and where each of them was found. You find the insecure item in the code and delete it.

• Remediation Summary - Shows the contents of the three previous pages in one location. For secrets and threats, it directs you to the file. For CVEs, it indicates which package requires an upgrade.

To export the scan results:

Use the CloudGuard API to export the results to a file. For details, see the API Reference Guide.

Known Limitations

AWP cannot scan some types of assets and skips them. In the table below, see the reasons for the Skipped status.

More Links

• AWP for AWS Environments

• AWP for Azure Environments

• Unified Onboarding of AWS Environments

• Onboarding Azure Subscriptions

• Risk Management

• Azure documentation: Disk Encryption Overview