Running a scan with Cloud Security Guardian will now also check whether your web applications have Web Application Firewalls deployed in front of them. Many standards, including PCI-DSS, require a WAF in front of all public-facing web applications.

In addition, we will check your incoming email configuration and report if you do not seem to be running an email security solution. Though email security is typically not in scope of a CSPM audit, since so many business compromises start with an email, it is prudent to ensure that vector is protected as well.

You can turn off either of these scans by modifying your Security Policy. Simply uncheck the scans you want to turn off on the Barracuda Best Practices tab.