* [Blog](https://www2.paloaltonetworks.com/blog) * [Cloud Security](https://www2.paloaltonetworks.com/blog/cloud-security/) * [Cloud Computing](https://www2.paloaltonetworks.com/blog/category/cloud-computing-2/) * Zero Trust for Applicatio... # Zero Trust for Applications: Securing Content within Transactions [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fzero-trust-for-applications-securing-content-within-transactions%2F) [](https://twitter.com/share?text=Zero+Trust+for+Applications%3A+Securing+Content+within+Transactions&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fzero-trust-for-applications-securing-content-within-transactions%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fzero-trust-for-applications-securing-content-within-transactions%2F&title=Zero+Trust+for+Applications%3A+Securing+Content+within+Transactions&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/cloud-security/zero-trust-for-applications-securing-content-within-transactions/&ts=markdown) \[\](mailto:?subject=Zero Trust for Applications: Securing Content within Transactions) Link copied By [Mohit Bhasin](https://www.paloaltonetworks.com/blog/author/mohit-bhasin/?ts=markdown "Posts by Mohit Bhasin") Mar 15, 2022 5 minutes [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown) [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/?ts=markdown) [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown) [WAAP](https://www.paloaltonetworks.com/blog/tag/waap/?ts=markdown) [WAAS](https://www.paloaltonetworks.com/blog/tag/waas/?ts=markdown) [Zero Trust](https://www.paloaltonetworks.com/blog/tag/zero-trust/?ts=markdown) ### A Critical Component of Zero Trust is Ensuring All Application and API Transactions are Legitimate, Safe, and Secure ![Graphical user interface Description automatically generated with medium confidence](https://www.paloaltonetworks.com/blog/wp-content/uploads/2023/03/graphical-user-interface-description-automaticall-6.png) Over the past few years organizations have been adopting cloud computing technologies. With that comes shifting legacy applications on monolithic architectures to building cloud native applications on microservices. By 2023, over 500 million apps will be developed using cloud-native approaches ([IDC FutureScape](https://www.idc.com/research/viewtoc.jsp?containerId=US45599219)). Organizations moving to the cloud are finding themselves navigating new challenges such as implementing a Zero Trust strategy. Over these years, the concept of zero trust - never trust, always verify - has largely stayed the same. But now cloud architects, devops and security teams face a bigger challenge in securing the content and data when securing the transactions between applications. Let's take a look at why it is critical to secure all content within transactions on your cloud native applications and how Palo Alto Networks solves this problem. ## **The State of Applications and Security** The move to the cloud creates more interconnectivity between applications. Modern apps are leveraging microservices and APIs for building scalable and resilient applications, but security teams should not assume all allowed traffic to and from apps contain safe and legitimate content. According to [Forrester](https://www.forrester.com/report/forrester-analytics-application-security-solutions-forecast-2020-to-2025/RES176225), web application exploits, such as SQL injection, [cross-site scripting (XSS)](https://www.paloaltonetworks.com/cyberpedia/xss-cross-site-scripting), and remote file inclusion, are the most common forms of external attacks. And according to [AV-Test](https://www.av-test.org/en/statistics/malware/), over 160 million new malware variants were detected in 2021. By applying Zero Trust principles to all communications and inspecting the contents of each transaction, organizations can identify and prevent unsafe content from reaching applications. ## **Applying Zero Trust to Transactions** Embedding Zero Trust in the cloud requires continuous validation at every stage of an application or API interaction. Once access to an application has been verified and granted, the content within the transaction must be inspected to determine it is free of any malicious activity, then only the transaction should be authorized. The Zero-Trust approach is crucial when verifying the transaction, rather than implicitly trusting the content in the transaction. Adversaries use allowed communications to execute the most common web application attacks like SQL injection and XSS as well as recent attacks including Apache log4j exploit and Cobalt Strike [command-and-control (C2)](https://www.paloaltonetworks.com/cyberpedia/command-and-control-explained) framework. Organizations adopting a Zero Trust architecture should consider verifying every transaction to increase their defenses against malicious activity within content. ## **How Palo Alto Networks Can Help** At Palo Alto Networks we offer a portfolio designed to deliver on the promise of Zero Trust for applications in the cloud. More specifically, the [VM-Series](https://www.paloaltonetworks.com/network-security/vm-series-virtual-next-generation-firewall) and [CN-Series](https://www.paloaltonetworks.com/network-security/cn-series) software next generation firewalls (NGFWs) together with Prisma Cloud [Web Application and API Security (WAAS)](https://www.paloaltonetworks.com/prisma/cloud/web-application-API-security) are purposely engineered to secure transactions. **![Graphical user interface Description automatically generated](https://www.paloaltonetworks.com/blog/wp-content/uploads/2023/03/graphical-user-interface-description-automaticall-7.png)** ## **Software NGFWs** The software NGFWs inspect application traffic on your network to ensure every transaction is safe from malicious activity and data theft. This is made possible through the integration with Palo Alto Networks' industry-leading cloud delivered security services ([CDSS](https://www.paloaltonetworks.com/network-security/security-subscriptions)). ![ Application Command Center (ACC) analyzes content, URLs, and threat activity](https://www.paloaltonetworks.com/blog/wp-content/uploads/2023/03/graphical-user-interface-application-table-exce-2.png) Application Command Center (ACC) analyzes content, URLs, and threat activity With [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention), the software NGFWs automatically block known malware, vulnerability exploits, and C2 with [100% effectiveness](https://start.paloaltonetworks.com/nss-labs-highest-security-effectiveness-rating.html) as well as 48% more unknown C2 than the industry's leading intrusion prevention (IPS) solution. The [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) functionality inspects transactions to the internet to block known and unknown malicious URLs. The Wildfire [sandboxing](https://www.paloaltonetworks.com/cyberpedia/sandboxing) service uses real-time analysis and threat intelligence to automatically identify unknown threats from attacking your application. The software NGFWs inspect transactions to apply [DNS Security](https://www.paloaltonetworks.com/network-security/dns-security). DNS Security automatically detects and blocks sophisticated DNS-based attacks including malicious domains, Domain Generation Algorithm (DGA) attacks, and other DNS threats. ![Software NGFWs encompass all CDSS capabilities into a single security policy rule ](https://www.paloaltonetworks.com/blog/wp-content/uploads/2023/03/graphical-user-interface-description-automaticall-8.png) Software NGFWs encompass all CDSS capabilities into a single security policy rule Applying [Data Loss Prevention (DLP)](https://www.paloaltonetworks.com/enterprise-data-loss-prevention) ensures the software NGFWs block sensitive data theft attempts. The software NGFWs are designed with Zero Trust in mind to continuously ensure application transactions in the cloud are free of malicious activity and data theft. ## **Prisma Cloud** To secure transactions, security teams must understand the cloud native applications they want to protect. Web App and API Security (WAAS) from Prisma Cloud delivers automatic discovery of all web applications and APIs across any cloud native architecture. ![WAAS Analytics Dashboard Explorer ](https://www.paloaltonetworks.com/blog/wp-content/uploads/2023/03/graphical-user-interface-application-description-2.png) WAAS Analytics Dashboard Explorer WAAS provides Layer 7 security for all HTTP/HTTPs traffic. The built-in Web App Firewall functionality protects against the top 10 most critical web application security vulnerabilities (OWASP Top 10). Customers can choose from different functionality to alert, prevent or ban against attacks on the application. ![App Firewall within WAAS](https://www.paloaltonetworks.com/blog/wp-content/uploads/2023/03/graphical-user-interface-table-description-autom-2.png) App Firewall within WAAS Web-facing applications constantly interact with [bots](https://www.paloaltonetworks.com/blog/prisma-cloud/bot-protection-cloud-native-apps/) on the internet. While not every bot is malicious, organizations can apply Zero Trust principles to secure web-facing transactions. Prisma Cloud verifies every transaction to allow good bots, such as search engine crawlers and news bots, to transact with your applications, but monitor and block abusive bot behavior. Inspecting transactions is required to protect against Denial of Service (DoS) attacks; to prevent attackers from flooding your applications with large amounts of fake traffic. WAAS is able to enforce rate limits on IPs or sessions to protect against high-rate and "low and slow" application layer DoS attacks. In a nutshell Prisma Cloud WAAS provides full coverage across OWASP Top 10, advanced DoS threats, bad bots, file upload, access control attacks, and more. A Zero Security model requires that you secure not only the application, but the transactions between that application. ### **Where can I get started?** Together, Web App and API Security and software NGFWs deliver a Zero Trust solution that secures any application transaction across public cloud, private cloud or hybrid cloud environments. If you want to get your hands on the software NGFWs, then sign up for an [ultimate test drive](https://www.paloaltonetworks.com/resources/test-drives?topic=vm-series-aws). If you want to see how Prisma Cloud Web Application and API Security works in your environment, then [request a 30-day trial](https://www.paloaltonetworks.com/prisma/request-a-prisma-cloud-trial) for Cloud Workload Protection. *** ** * ** *** ## Related Blogs ### [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown) [#### Zero Trust for Applications Best Practices: Securing Cloud Workloads](https://www2.paloaltonetworks.com/blog/cloud-security/zero-trust-cloud-workloads/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown) [#### WAAS-Up with Cryptojacking Microservice-Based Web Apps?](https://www2.paloaltonetworks.com/blog/cloud-security/waas-cryptojacking-microservice-based-web-apps/) ### [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/?ts=markdown), [Cloud Runtime Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-runtime-security/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown) [#### Agent Vs Agentless: Determining the Right Deployment Option for Cloud Workload Protection (CWP)](https://www2.paloaltonetworks.com/blog/cloud-security/agent-vs-agentless-cwp/) ### [Announcement](https://www.paloaltonetworks.com/blog/cloud-security/category/announcement/?ts=markdown), [Cloud Native Application Protection Platform](https://www.paloaltonetworks.com/blog/category/cloud-native-application-protection-platforms/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown) [#### Forrester Names Prisma Cloud a Leader in Cloud Workload Security](https://www2.paloaltonetworks.com/blog/cloud-security/forrester-wave-cloud-workload-security-leader-2024/) ### [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown), [Web Application \& API Security](https://www.paloaltonetworks.com/blog/category/web-application-api-security/?ts=markdown) [#### Instant Protection with Virtual Patches](https://www2.paloaltonetworks.com/blog/cloud-security/protection-with-virtual-patches/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [Cloud Network Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-network-security/?ts=markdown) [#### Zero Trust for Applications: Verifying Access Between Workloads](https://www2.paloaltonetworks.com/blog/cloud-security/zero-trust-for-applications-access/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language