AWS Control Tower vs. Check Point CloudGuard Posture Management

We were wanting to prove the concept of a low touch process for quickly spinning up boilerplate AWS environments. We were able to get started quickly and to ensure that the AWS Well-Architected Framework principles were followed - at least upfront - however, we found that for our use case and expertise level it ultimately wasn't a fit. We have the skills on our team to manage more of this on our own. My recommendation would be contingent on what skills are already available on your team: if you can "do it yourself" you might as well so that you don't pay for resources you don't need and you have finer grain control over what's created.

Incentivized

Scenarios most suited - 1) All the Cyber Security focused development environments 2) Definitely a must for Financial Clients since it deals with live money transactions - Hence it is imperative to keep the Network and tech asset environment secure, and compliant to standards 3) IAM is another area where it plays an IMP part - For eg one of our healthcare clients where they wanted to restrict access 4) Dashboards are also great, we can share the results to GISO/CISO level folks - Custom dashboard feature

Incentivized

• Easily create new AWS accounts.
• Easily secure and manage AWS accounts.
• Landing zone with SSO is a huge win for larger teams.

Incentivized

• Integration with public cloud providers.
• Rich UI with great dashboards.
• Great assets inventory.
• Clarity module.

Incentivized

• The AWS SSO GUI is not very intuitive and determining how to apply policies to users without creating redundant logins has been a challenge.
• The default guardrails do not fully encompass all the security checks that we needed.
• There does not appear to be any way to control roles at the IAM level from the control tower account through the GUI.
• Some features on AWS accounts still require logging into the individual account with the root user and cannot be done from AWS Control Tower.

Incentivized

• There is not a comprehensive amount of documentation on how to set up best practices.
• Our initial set up assistance from Proofpoint approved vendor did not go smoothly.
• The ability to add more customized widgets in the main overview screen would be helpful.

Incentivized

There is no way to easily close an AWS account whether it was created manually or via the AWS Control Tower. It takes too many steps to close it vs to provision a new AWS account

Incentivized

Is easy to use, and the standad configuration is well prepared.

Incentivized

I haven't dealt so much with support but we are enjoying the tool!

Incentivized

Using AWS Systems Manager and other slightly lower level components has been helpful for us to manage parts of our AWS presence at a more granular level than AWS Control Tower was designed for. It's not at all an apples-to-apples comparison as they solve different use cases, but for us, the use case associated with AWS Systems Manager was a better fit for our specific needs and skillsets. We did not need everything that AWS Control Tower was doing for us.

Incentivized

First and foremost reason of our client selecting CheckPoint CloudGuard Posture Management / Dome9 was because they already had CheckPoint Firewalls which are in active use e.g. R75.40 and R82.x products. Customization Vs these other Vendors is another great asset Reporting is one more standout feature, + Multi-cloud capabilities Centralized dashboarding is smooth to navigate as compared to other Vendors Syslog handling is much better as compared to some other vendors , Memory and space issues if planned well are less

Incentivized

• Less time manually deploying accounts which was error prone.
• Central logging allowed us to have 1 place to view logs.

Incentivized

• For production environments it is worth the investment.
• Getting to know how many assets you have helps with cost savings.

Incentivized