Frequently asked questions

Existing cloud security solutions focus on securing the infrastructure or the workloads that make up your cloud environment. This helps you shield your cloud infrastructure from attackers getting in but you still need to protect your most valuable asset (data), especially if it contains sensitive information. Normalyze puts data at the center of your cloud security program so you can get the full picture of your data stores, applications, identities, infrastructure and how they all connect across all cloud service providers (CSPs), PaaS environments (like Snowflake), SaaS applications, and on-prem environments. You can discover, classify, and visualize any sensitive data at risk of compromise, who has access to it and what you need to do to secure it or achieve compliance with various regulatory standards.

These solutions either focus on infrastructure security a la misconfigurations (CSPM), vulnerabilities (CWPP), or access issues (CIEM). Normalyze focuses on identifying sensitive data in your environment first and connects all the dots around it to determine the likelihood of risk – misconfigurations, elevated access and permissions across accounts, vulnerabilities, etc. – that could lead to compromise of sensitive data. Without the data insights you end up with a high number of alerts from various tools that are not actionable and will be difficult to prioritize. 

Data discovery solutions are focused mainly on scanning data to categorize it against certain regulatory frameworks such as PCI, HIPAA and GDPR. They act as recommendation engines rather than enforcement as they don’t bring any context about the environment where the sensitive data resides, who has access to it and what type of access, config or vulns is associated with it. Normalyze is a technology platform that brings it all together so you can discover and classify data then enforce remediation based on risk and attack paths that can lead to sensitive data. If you have built data catalogs in other tools, Normalyze can import these data catalogs and use them while scanning cloud data stores to help you classify sensitive data based on these custom catalogs.

In short,

Normalyze = Data discovery + Data classification + CIEM + CSPM + CNAPP

Normalyze works out of the box and provides a better alternative to doing it yourselves by integrating multiple capabilities instead of amalgamating a solution by multiple vendors.

Behind the scenes, Normalyze operates in 3 phases:

1. Discovery and Analysis: Normalyze builds an intelligent graph with deep context and transitive trust relationships that represents all the data stores as well as compute elements, permissions, apps, etc. that connect to it.

   The Normalyze data scanner then does a deep scan of the data and determine what data stores house sensitive information and automatically maps it to specific profiles such as PCI, HIPAA and GDPR.  

2. Detection and Prioritization: Normalyze prioritization engine identifies risk paths discovered through the graph (likelihood of compromise) and prioritizes them based on sensitivity of the data at risk (impact of the attack). 
3. Remediation and Prevention: Normalyze lets you integrate with a variety of external tools for notification, ticket creation, workflow triggering, etc. so that you can take remediation steps when relevant issues are found. You can automate the remediation based on types of accounts, risks, resources, severity, etc. As a security engineer, your automation rules can be thought of as your policy, and any violations result in actions.

Normalyze also offers all its functionality via REST APIs which can be used to set up rules that prevent risks from ever making it to production.

Normalyze offers a simple process for onboarding of cloud accounts via CloudFormation (AWS), Onboard script (GCP) or Terraform. Onboarding cloud accounts to Normalyze is  typically completed in a few minutes. 

Normalyze only seeks the minimum permissions required in your cloud accounts and creates modular roles that minimize scope of permissions to specific product capabilities being enabled. 

Yes, you can onboard multiple accounts – no upper limit – at once. When you want Normalyze to secure multiple accounts, instead of onboarding each account individually, you can onboard the management account. The process of onboarding a management account is similar to onboarding a standalone account and is completed within minutes. Normalyze automatically discovers all the child accounts under the onboarded account.

You also have the flexibility to pick and choose which accounts under the organization they would like to be monitored. Normalyze provides a URL to create a StackSet in the AWS console and you can select particular OUs or individual accounts under the root account that need to be onboarded.

The Normalyze graph displays a graph of access and trust relationships that includes deep context with fine-grained process names, data store fingerprints, IAM roles, and policies displayed in real time. It quickly helps you to locate all data stores containing sensitive data, find all access paths, and score potential breach paths based on sensitivity, volume, and permissions to show all breaches waiting to happen.

Normalyze deploys lambdas in your cloud environment to do the discovery and scanning of data. Using patent-pending one-pass data scan technology, it scans the data, both structured and unstructured, within your environment and only collects metadata to add to the graph. No sensitive data is collected at any point during scanning. Normalyze deploys the lambdas to the cloud regions where scanned data reside, thus eliminating high egress charges and preserving data residency.

1. High data privacy as no data will leave your environment – whether sensitive or not.
2. Support for both structured and unstructured data stores.
3. The data sampling rate can be tuned giving you the flexibility to save time/cost when scanning large data stores.
4. It’s the most cost-effective scanning solution compared to any other solution – typically 20x cheaper than native CSP scanning.
5. The ability to detect individual sensitive entities such as name, SSN, CCN, etc. and to combine entities via profiles to check for proximity of these entities reduces false positives when identifying sensitive data, especially within unstructured data stores.

We calculated that scanning 1TB should cost about $50. 

In real customer environments, we’d expect sampling as well as scanning on a less frequent basis which should result in much lower costs.

Normalyze data scanners use our patent-pending one-pass architecture. With one-pass scanning, all sensitive data entities and profiles can be detected in a single pass through the text of the data, regardless of how many entities we are looking for.

This has a few benefits:

1. Zero upfront configuration: You don’t need any upfront configuration to figure out what type of sensitive data exists where. We simply look for everything with one-pass, achieving lower time-to-value. Compare this to typical scanners which require a lot of technical training before you get value from the product.
2. High performance: Scan times are much lower. Compute efficiency is much higher, saving money and time. You can iterate faster during incident response. 

Normalyze scanners also allow customization – custom entities, custom profiles – if you choose to do so. Custom entity and profile detection will then become part of the one-pass data scans across all data stores discovered and monitored by Normalyze.

Unstructured data: S3, GCS, Azure Blob, EBS

Structured data: Amazon RDS (MySQL, Postgres, Aurora, MariaDB), Amazon Redshift, Google CloudSQL (MySQL, Postgres), Azure MySQL, Azure Postgres, MongoDB, DocumentDB

Use cases include:

• Data discovery and classification: Rapid and cost-effective discovery and classification of all data stores – even the ones you do not know exist.
• Data access governance: Evaluation of access to your data from all users and identities, and enforcement of the principle of least privilege.
• Data risk management: Identification and visualization of risks in real time based on the data context with integrated remediation workflows to resolve them quickly.
• Regulatory compliance: Continuous checks against regulatory benchmarks to keep you ahead of compliance audits.

The Normalyze common data scanner framework allows the creation of new data store connectors quickly. The framework connects to the various data stores and brings the data into a common format that can be easily parsed and scanned in the same way across all data types.

This is a common scenario for our customers. The sampling process allows Normalyze to get very good visibility into the datastores regardless of the size. Normalyze platform can be scaled horizontally in an automated way to support your large data volumes.

Normalyze is built on open APIs and it can be easily integrated with third-party solutions to bring their data in and integrate it into the Normalyze graph. Any data you see on the UI is also accessible via APIs. Also outbound integrations with ticketing and notification solutions can be easily achieved via webhooks that are available out-of-the-box. If you have specific requests for integrations, let us know and we’ll be happy to build a connector for you.

Entity definitions and profile definitions are fully customizable from within the UI and the APIs. Let us know if you need help with a specific entity and we can help you create one.

Normalyze can import data catalogs from other data management tools and integrate them into its entity/profiling technique so you can maintain the format of sensitive data the same as their existing data catalogs. If you need help on how to do it with the APIs, let us know and we can help you.

The Normalyze query builder is built for this purpose so you can easily create your own “signatures” from specific attack paths in your cloud environment. You can use the query builder interface to create and test this attack path. You can then promote it to the library of signatures that are run each time the graph changes.

1. Only cloud security solution that brings data, access, misconfigurations, vulnerabilities, and compliance into one holistic platform focused on data security.
2. Normalyze one-pass scanner with both pattern matching and NLP capabilities.
3. Lowest cost of data scanning compared to other similar solutions.
4. Common data framework that allows the addition of support for any datastore in a short period of time.
5. Ability to visualize your cloud architecture in real time.
6. Ability to traverse the Normalyze graph and build signatures on the fly to identify any attack path.

1. Data Discovery for Compliance: Discovering data stores with sensitive data and classifying the data with PCI, GDPR, HIPAA, etc. that can be used as evidence for compliance  – CISO, GRC, Data Officer
2. Data Access Governance for Compliance: Discovering users/resources with access to sensitive data that can be used as evidence for compliance – CISO and DevSecOps
3. Data Security: Discovering risk on sensitive data, public exposure, achieving least privileged access and prioritizing security work for devops achieving most ROI  – prioritized by impact and likelihood – Security Ops.
4. Incident Response: Use historic view of the graph as well as ad-hoc queries to analyze your cloud environments – Devops, Security Ops.
5. Cloud Architecture diagram for Compliance: Export the graph view to satisfy typical compliance requirements that require an architecture diagram to be made available at any time – DevOps, Cloud Engineering
6. Access Reviews for Compliance: Export data via reports to help your quarterly/annual access reviews for data assets or any resource within your cloud. Or get ahead of the game and do a continuous access review – CISO
7. Reduce Cloud Security TCO: consolidate multiple cloud security products by eliminating platform costs, man hours, outages – CISO, CIO