The shortcomings of
existing approaches

Virtual security appliances

Many organizations lean toward extending their data center appliances into the cloud. While this can work, you will be relying on legacy approaches to implement policy versus enjoying the added benefits associated with choosing a solution designed for the cloud.

The disadvantages of continuing to use a legacy approach include a lack of:

Native autoscaling, creating operational complexity due to unsupported scripts and resulting in excessive costs to correctly customize and maintain.
Integration into cloud networking constructs such as AWS transit gateways, making it hard to scale security to tens and hundreds of VPCs, and breaking the cloud network architectures.
Cloud-native workload identity and metadata, resulting in poor security coverage due to manual association of application IDs with cloud workloads.
Cloud scale, resulting in reduced agility due to manual management.
A single dashboard for centralized policy enforcement, along with fragmented visibility across multiple clouds.

Cloud service provider-specific firewalls

In cloud environments, organizations may opt for firewalls provided by their cloud provider. While these reduce complexity and are more cost-effective in comparison to traditional on-premises firewalls, cloud-specific firewalls don’t work across cloud providers, and are often limited to single regions. This lock-in reduces an organization's ability to choose security that best fits their needs, and increases tool sprawl if they onboard another cloud provider into their environment.

IP-based network security policy

In the data center, you can tightly define the IP to server mapping and use them to set the network security policies. Because the IP address won’t change over the lifespan of the server, your network security policies will remain effective over the lifespan. However, they don’t accommodate dynamic environments, such as the cloud, where applications and workloads scale up and down, constantly changing the IP address mapping.

Security groups

Security groups provide basic L3/L4 security segmentation and help reduce your attack surface by restricting network port access. However, threats are becoming more sophisticated by the day, which means contextual awareness and the ability to block application-level attacks, like SQL injection, are the minimal capabilities needed for protecting against modern threats above standard network security groups.