Network and Application Security
Security controls are only as strong as the way they are operated.
Cloud Gateway operates the agreed Secure Access, Managed Firewall and Application Security controls within a defined managed-service model that can align with connectivity where both are in scope. Each control keeps its own enforcement capabilities; Cloud Gateway provides governed policy, change, service-health and escalation across the contracted boundary.
Security gaps often emerge
in the space between controls.
A web gateway can block a malicious destination while broad private-network access remains open. A firewall can be fully patched while an obsolete rule still permits unnecessary traffic. A WAF can be healthy while a new application route bypasses it. Fragmented products create separate policies, separate change cycles and separate evidence – leaving the customer to reconcile whether the intended control is actually protecting the service.
- A security control is effective when the relevant traffic reaches it, policy reflects current business intent, exceptions are visible, and the next operational action and escalation route have named owners.
Design the enforcement point. Operate the policy lifecycle.
Cloud Gateway maps the protected flow, the context available to the selected control, the customer policy owner and the operational support owner. We operate the agreed control through onboarding, approved change, service-health monitoring, maintenance, operational incident triage, supplier escalation and reporting. Security-event analysis, threat hunting and breach response follow the separately agreed customer, SOC or incident-response route.
- Reduce gaps between products by joining policy intent, traffic path, operational ownership and evidence.
Network security solutions
Secure
private access
Control how users reach approved applications. Secure Private Access grants app-specific access according to identity, entitlement and device context, where available.
Secure
internet access
Control how users reach the internet and SaaS applications. Secure Internet Access applies web and threat policy to internet-bound traffic including URL filtering and DN inspection.
Managed
firewall
Operate firewall health, configuration, rules, backups, releases, patches and vendor escalation across agreed branch, campus, data-centre, cloud or virtual deployments.
Application
security
Protect public-facing web apps and APIs with managed Layer 7 policy, inspection, tuning and change control. Optional API and bot controls apply only where licensed and included.
Four operational disciplines
Policy intent
Name what the control is meant to permit, deny or inspect, who owns the decision and how an exception is accepted.
Enforcement
Confirm that traffic reaches selected controls and identity, device, application and network context are available to the policy where required.
Lifecycle
Manage rule and config change, release and patching, backup, certificates, health and supplier dependencies through clear processes.
Evidence
Retain policy decisions, change records, service health, incidents, exceptions and reporting to operate and review the service.
Shared control needs
engineered guardrails.
In a fully managed model, Cloud Gateway operates the agreed security service and executes approved change. In a co-managed model, authorised customer engineers can perform defined actions through approved vendor or Cloud Gateway interfaces. Roles, MFA, access scope, approval, audit, rollback and incident responsibility are agreed explicitly; co-management is not unrestricted administrator access.
Shared responsibility
Cloud Gateway
- Operates the controls and support activities included in the Service Definition, including the agreed service-health, change and vendor-escalation processes.
Customer
- Owns business policy intent, identity and application data, user and device lifecycle, risk acceptance, approvals and customer-controlled dependencies.
Technology Partners
- Remain responsible for their underlying platforms, licensed security functions and product-level remediation.
Coverage and boundaries
Protect provides managed security controls and the operational services stated in the selected Service Definition. It is not, by default, a SOC, managed detection and response service, threat-hunting service, digital forensics service or guarantee that attacks cannot succeed. Security-event forwarding to a customer SIEM or SOC may be available where supported and contracted.
Common questions
about Protect
What is SSE (Security Service Edge)?
SSE (Security Service Edge) is the security half of a SASE architecture: cloud-delivered security services including secure web gateway (SWG), zero trust network access (ZTNA), cloud access security broker (CASB) and firewall as a service (FWaaS), with web application firewall (WAF) often included. SSE protects users, applications and data wherever they are, without requiring traffic to be routed through on-premise security appliances.
What is the difference between ZTNA and a VPN?
A VPN (Virtual Private Network) extends the corporate network to a remote user, granting access to the network and trusting the device once connected. ZTNA (Zero Trust Network Access) grants access to specific applications rather than the network, with identity and device posture verified on every connection. ZTNA reduces the attack surface and is the modern replacement for legacy remote access VPNs in most enterprise environments.
What does a managed firewall service include?
A managed firewall service typically includes initial baseline configuration, ongoing policy management, change control with audit trails, firmware and security patching, rule hygiene and posture reviews, incident response, and compliance reporting. Cloud Gateway’s Managed Firewall covers small and branch sites, campus, data centre, and cloud and virtual deployments, with UTM capabilities (DNS filtering, antivirus, intrusion prevention, deep packet inspection) included by default.
Can a managed firewall help with DSPT or CAF compliance?
Yes. A properly managed firewall produces the change records, patch logs, rule ownership documentation and posture reports that auditors expect to see under DSPT (Data Security and Protection Toolkit), CAF (Cyber Assessment Framework), NIS2 and similar frameworks. Cloud Gateway’s Managed Firewall generates this evidence as a by-product of the service, available on demand for assessment cycles rather than assembled ad hoc before audit.
Map policy to the traffic that matters.
A useful security session starts with users, applications, data flows, trust boundaries, existing controls and operational ownership - then identifies the gaps a supportable service can close.