CNAPP, CSPM, CWPP, C…What’s the Difference and How Can They Improve My Cloud Security?

If you’re researching how to build out your cloud security practice, it won’t take long before you stumble across at least one of the “C” acronyms. In fact, you’ll probably see one or more of these acronyms at every stop along your research journey.

What do they mean? Why are they useful? How can they help you with your research? Let’s find out…

C Is for Categorization

These acronyms have been created or at least bubbled up from the hard work of various analysts. They help to define the type of security tool and its capabilities.

It turns out these acronyms are quite useful as a research guide, which has led most vendors and projects to at least frame their positioning in these terms.

And because of that genesis, there is no definitive list of criteria required to categorize a tool under a specific acronym. It’s better to think of these categories as colors. There are many shades but they all generally bring the same feel to your design.

For you, the builder or the security professional, these acronyms can help speed up your research and to help make sure you have sufficient tooling in place to meet your security goals.

Let’s take a look at each of the most common “C” acronyms in turn.

CSPM

CSPM stands for Cloud Security Posture Management. 

The first two words in the acronym—cloud security—are straight forward. What does posture management imply?

In this context, posture references to the configuration of the features and services in your cloud account.

Is that Amazon S3 Bucket open to the public? Are you using Azure Private Link to connect to your Azure CosmosDB? Have you built your design to take advantage of Google BigQuery column-level security?

Tools in this category look at the logging and audit data from your cloud service provider (CSP) and compare it to a preferred state.

That preferred state can reference your specific design or—more likely—a commonly accepted best practice.

For example, logging into your AWS account as the user root is a very bad idea. You only need to do that for standalone accounts in order to set up billing and an administrative user in IAM.

A CSPM tool will see activity under the root account and generate an alert.

These tools help provide visibility and protection at the account level.

CWPP

The acronym CWPP is short for Cloud Workload Protection Platform.

Again, half of the words are simple and straightforward. Let’s move past cloud and protection and try to parse out the remaining two.

Let’s start with the easier term, platform. This means many things to many different teams. In the case of this category, the general meaning is a product that meets these three broad criteria:

1. It offers multiple security controls through one implementation (agent and agentless).
2. It has an API to help automate the operations of the product.
3. Via an API or emitted events, you can integrate the product into your security workflow.

For most, these criteria don’t meet the idea of a platform, but it is a start and what passes under this category.

The final term in this acronym is workload. This is the trickiest part. What exactly is a workload in the cloud? Where are its boundaries? How far should these tools reach?

Again, falling back to the general meaning across the category, a workload is commonly referred to as a collection of instances or containers working together.

Under the builder’s mental model, it’s an application or micro service that has N instances/containers running. Where N is the number needed to serve the current traffic level.

CWPP tools let you work using this mental model until there’s a problem that needs to be addressed. Then you can dive into the specific container or instance to gather further details.

The security controls provided by CWPP tools work best at the instance/container level. Think controls like threat detection, intrusion prevention, anti-malware, application control, vulnerability monitoring, and more.

CASB

Unlike the other acronyms covered, CASB is a user-based control. Cloud Access Security Brokers are designed to help provide visibility and control to organizations whose users are taking advantage of Software as a Service (SaaS) tools.

This category of tools address services like Google Workspace, Microsoft Office 365, Dropbox, Box, Salesforce, and more.

CASB products connect to these services either via their APIs, push users through proxy, or both. The goal is to help the organization see what type of data is being used with these services and to provide some level of protection to it.

Common features include reporting, identity and access management, data loss prevention (DLP) scanning, and more.

Remember, this category—like SASE, secure access service edge—focuses on protecting users and user behavior, not what you are building in the cloud.

CIEM

CIEM stands for Cloud Infrastructure Entitlements Management.

There’s a lot of syllables hidden behind this acronym. Let’s unpack the two most confusing words.

Entitlements is just a broader way to refer to access credentials. Honestly, it’s confusing when terms keep changing but here we are.

Knowing that, the entire acronym makes a lot more sense. Cloud Infrastructure Entitlements Management is the evolution of identity governance and administration (IGA) and privileged access management (PGA).

It expands the idea of identity and access management (IAM) beyond people to include resources and services within the cloud.

Tools in this category help you apply the principle of least privilege and to make sure that it stays applied.

That’s a tall order in a very dynamic environment. The CSPs provide a strong layer of native tools to help manage access. However, as your cloud footprint grows, things get challenging very quickly.

CIEM tools provide a layer on top of the features provided by your CSP and make those native tools easier to understand and monitor.

CNAPP

The final—for now—acronym is CNAPP, which stands for Cloud Native Application Protection Platform.

Tools in the CSPM and CWPP categories are often built with a security team perspective in mind. They frame features and information assuming a strong baseline knowledge of cybersecurity.

CNAPP tools expand their user base to include cloud builders. They also extend their feature set to integrate into key development tools like a continuous integration/continuous deployment (CI/CD) pipeline.

CNAPP tools offer a broader feature set to a broader audience than CSPM and CWPP. This category has more of a platform feel to it vs. the comparatively limited scope of CWPP.

The goal of tools in this category is to provide one place to view and manage security controls for cloud accounts and workloads in a manner that can be integrated into a development and cloud operations workflow.

Which One Is Better?

The top questions that teams ask when looking at these categories is, “Which type of tool do I need?” or “Is one type of tool better than the other?”

The honest answers are you’ll need aspects of each of these categories in order to meet your security goals. Cloud environments are dynamic and complex. There’s never one simple solution and even within the same organization, needs change vary greatly.

The goal of these acronyms is to help you quickly understand how a tool approaches the challenges of cloud security. They can help you make sure that you have the right tools in the right place.