Prisma SASE with Prisma SD-WAN

Among the many positive aspects, what I liked most about Prisma includes several key features and the significant operational improvements it brought. The most prominent feature was the connectivity options it offered, specifically providing faster access for our end users. We validated this through benchmarking and speed tests. Another major benefit was the simplification and improved integration of our technology stack. This allowed us to retire traditional endpoint clients, such as VPN clients, which often created issues on user endpoints. The reliability also seemed to be enhanced due to its nature as a cloud service. From an intuitive standpoint, I found the interface quite intuitive. The configuration process was straightforward, and we didn't encounter any major complaints from our technical teams during implementation. The decision to adopt Prisma was also driven by several other key factors: It significantly contributed to creating internal operational efficiencies. It improved business process agility and business process outcomes. It helped us improve compliance and risk management. The product functionality and performance were strong. We already had a preexisting relationship with Palo Alto as a platform vendor, which was a preference. The product roadmap and future vision were compelling. The financial organizational stability of the vendor was a factor. The existence of a strong user community was also important. Finally, the breadth of services offered by Palo Alto contributed to our decision.

I like how easy it is with Prisma to connect remote offices without the need for any 3rd parties. I also think the cost is exceptionally high.

Discoverability is the number one feature and its ability to automatically discover all applications & services deployed behind our domain was incredibly valuable. We didn't have to manually write service registries; we simply uploaded the details to their platform, & it automatically generated rules for us. Many other solutions offer software-based security while Palo Alto provides API-based security, which is crucial when we expose APIs to external vendors. This ensures that even if our servers are secured, the APIs themselves are protected from vulnerabilities. Prisma implements DLP layers. These layers protect our databases & any other internal or external systems that have external connections, ensuring that data is secured throughout the system. Regarding the ease of use & adaptability for new members or the intuitiveness, the execution of such software is typically a one-time process involving collaboration between network security & development teams. When onboarding new services, domains, or servers, the process was straightforward: we would access the dashboard, connect, or integrate with our server. If our VPC or network was already connected, it could automatically discover our servers, leveraging the discoverability feature mentioned earlier. We could upload any information onto the platform. For developers the daily workflow involves monitoring server & application performance. It provides dashboards that serve this purpose. The security team monitored these dashboards at an organizational level, while our specific focused on our domain & databases. We received alerts for anomalies. A valuable feature is the automatic blacklisting mechanism. If a database comes under attack, the software automatically blacklists any IP address attempting to access data beyond the allowed request limits. It also sends email alerts to inform us of such actions, providing the flexibility to re-enable IPs from the platform if it was an internal performance test that triggered the alert

When considering areas for improvement or any dislikes, I wouldn't say there were any unmet expectations with Prisma. However, as with any evolving technology, the biggest drawback I observed is that continued improvement and the addition of new feature sets invariably come with cost increases. This is particularly true in the cloud and consumption-based service space, where things tend to become more expensive over time after initial deployment. This upward trend in cost would likely be the most significant drawback. Regarding performance or downtime, my team and I experienced nothing of significance. The reliability of the service was quite good. While every service may experience occasional downtime, I do not recall any significant outages or impactful events that disrupted business operations. Therefore, I would characterize the product as very reliable in its performance.

This part is specifically geared towards Prisma-SDWAN. During the implementation with Palo recommended PS, it seems that the 2 PS engineers assigned didn't really know what they were doing. You could pretty much hear them reading the documentation as they installed which in itself isn't an issue, but some broader knowledge would have been helpful when they faced issues. This, coupled with countless backend issues that we had no control over, which then resulted in me having to fly to the same office multiple times, was a bit of a pain.

There are a few areas I believe could be improved: On-Premise Server Integration: Prisma has excellent connectivity with cloud providers. However, the experience with on-premise servers is not as seamless. Implementing the solution on physical on-premise servers requires manual software installation and multiple configurations. The templates provided for on-premise integration are not up to the mark. I believe that more in-depth documentation or free support for on-premise integration would be highly beneficial. Currently, the need for extensive paid support might limit its adoption to larger organizations, potentially hindering smaller companies from utilizing its plug-and-play potential. Security Web Gateway (SWG) Feature: We encountered an issue with the SWG feature, specifically with false positives. There was a problem where, after enforcing user policies to restrict web gateway access, the dashboard indicated the policy was applied, but some users could still access our services. This manifested as a RBAC vulnerability, where certain users were incorrectly granted administrator privileges, and an admin could create additional super admins who could then delete the original super admin while remaining in the system. Although Palo Alto eventually provided a patch for this, it was a notable concern within the SWG layer. Over-Complication of Deployment: A key lesson learned from our implementation was to avoid over-complicating the deployment. Initially, we deployed Prisma on both the network layer and as a software installation on our on-premise servers. In hindsight, I would advise future teams to implement it only at the network layer. This simpler approach effectively protects on-premise servers behind the firewall without needing direct installation on each server, which significantly reduces the execution time, by three to four times compared to on-premise server installation. Cost: A significant drawback is that the product is very expensive.