Introduction

Paladin Cloud is an extensible, Security-as-Code platform to help developers and security teams significantly reduce risks in their cloud environments. The platform functions as a policy management plane across multi-cloud and enterprise systems to protect your applications and data. The platform contains best practice security policies and performs continuous monitoring of your cloud assets, while prioritizing security violations based on severity levels to help you focus on the events that matter. The platform’s resource discovery capability creates an asset inventory, then security policies are evaluated against each asset. Powerful visualization allows developers to quickly see and remediate violations on a risk adjusted basis. An auto-fix framework provides the ability to automatically respond to policy violations by taking predefined actions. Paladin Cloud is more than a tool to manage cloud misconfiguration, it’s a holistic cloud security platform that can be used to do continuous monitoring and reporting for any domain.

Extend your Coverage

Paladin Cloud's plugin-based connector architecture allows for data ingestion from multiple sources. Plugins allow you to pull data from various cloud-based enterprise systems, such as Kubernetes management, API gateways and threat intelligence systems in order to holistically manage cloud security. Examples include, Qualys Vulnerability Assessment Platform, Bitbucket, TrendMicro Deep Security, Tripwire, Venafi Certificate Management, and Redhat. You can write rules based on data collected by these plugins to get a complete picture of your cloud security posture.

How Does It Work?

Assess -> Report -> Remediate -> Repeat

Assess -> Report -> Remediate -> Repeat Paladin Cloud constantly assesses and monitors you cloud security posture on a near real-time basis. The platform discovers assets, evaluates policy, creates issues for policy violations, and prioritizes remediation. If an auto-fix is configured with the policy, those auto-fixes are executed when the resources fail the evaluation. Policy violations cannot be closed manually, the issue has to be fixed at the inspected asset, then Paladin Cloud will mark it closed in the next scan. Exceptions can be added to policy violations. Sticky exceptions (exception based on resource attribute matching criteria) can be added to exempt the similar resources that may be created in future. Note, use exceptions sparingly and only if aligned with corporate security guidelines. Asset groups are a powerful way to visualize cloud security and compliance. Asset groups are created by defining one or more target resource's attribute matching criteria. For example, you could create an asset group of all running assets by defining criteria to match all EC2 instances with attribute instancestate.name=running. Any new EC2 instance launched after the creation of an asset group will be automatically included in the group. In the Paladin Cloud UI, you can select the scope of the portal to a specific asset group. All the data points shown in the UI will be confined to the selected asset group. It is common practice to create an asset groups per account (or subscription, project), per application, per business unit or per environment. Asset groups are not for just setting the scope of the data shown in the UI. The groups can be used to scope rule execution as well. Policies contain 1 or more rules. These rules can be configured to run against all resources or a specific asset group. The rules will evaluate all resources in the asset group configured as the scope for the rule. This provides an opportunity to write policies which are very specific to an application or Org. A good example is, some of the teams would like to enforce additional tagging standards beyond the global requirements. They implement this policy with their custom rules and configure that to run only on their assets.

Paladin Cloud Key Capabilities

Continuous asset discovery
Continuous security policy evaluation
Detailed reporting
Auto-Fix for policy violations
Ability to search all discovered resources
Simplified policy violation tracking and prioritization
Easy to use Self-Service portal
Custom policies and custom auto-fix actions
Dynamic asset grouping to view compliance
Ability to create multiple compliance domains
Exception management
Email digests
Supports unlimited AWS, Azure, and GCP accounts
Completely automated installer
OAuth2 Support
Azure AD integration for login
Role-based access control

Technology Stack

Front End - Angular
Backend End APIs, Jobs, Rules - Java
Installer - Python and Terraform

Deployment Stack

AWS ECS & ECR - For hosting UI and APIs
AWS Batch - For rules and resource collection jobs
AWS CloudWatch Rules - For rule trigger, scheduler
AWS Elastic Search - Primary data store used by the web application
AWS RDS - For admin CRUD functionalities
AWS S3 - For storing inventory files and persistent storage of historical data
AWS Lambda - policy execution

Paladin Cloud installer automatically launches all of these services and configures them. A typical installation takes about 20 minutes.

Paladin Cloud User Interface

Overview Screen

Violation List View

Asset Detail View

Search results

Category Summary

Asset Group Selection

Installation

Detailed installation instructions are available here

Usage

The installer will launch required AWS services listed in the installation instructions. After successful installation hit the UI load balancer URL. Log into the application using the credentials supplied during the installation. The results from the policy evaluation will start getting populated within 30 minutes. Trend line widgets will be populated when there are at least two data points.

When you install Paladin Cloud, the AWS account where you install is the source account. Paladin Cloud can then monitor other target AWS accounts. Refer to the instructions here to add new accounts to Paladin Cloud. By default the source account will be monitored by Paladin Cloud.

Create/Manage Policies
Create/Manage Rules and associate Rules with Policies
Create/Manage Asset Groups
Create/Manage Sticky Exception
Manage Jobs
Create/Manage Access Roles
Manage Paladin cloud Configurations
See detailed instruction with screenshots on how to use the admin feature here

User Guide / Wiki

Wiki is here.

License

Paladin Cloud is a derivative of T-Mobile's PacBot project. Paladin Cloud is open-sourced under the terms of section 7 of the Apache 2.0 license and is released AS-IS WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.

venkatreddyc/PaladianCloudCE