## How BBVA Streamlined Its Web & API Security Across

## Cloud Native Mobile Banking Apps

**INDUSTRY**  
Financial Services

**HEADQUARTERS**  
Madrid, Spain

**COMPANY SIZE**  
50,000+ employees

## OVERVIEW

Banco Bilbao Vizcaya Argentaria, S.A., better  
known as BBVA, is a Spanish multinational  
financial services company and is one of the  
largest financial institutions in the world. BBVA is  
committed to providing banking solutions using the  
latest technologies, to extend frictionless real-time  
banking services to their customers.

## OUR SOLUTION

CloudGuard  
Secure the Cloud

## CHALLENGE

Providing end to end web APP & API protection for a large network of Services and Apps.

BBVA required an enterprise grade WAF to protect a large network of services, applications and APIs. The  
bank needed to increase visibility and easy management that can support wide scale development and CI/CD  
automation to accelerate their application modernization strategy.

## “

CloudGuard WAF gives us visibility, operational  
flexibility and most important allow us to protect  
the Bank’s applications with the highest security  
standards thanks to pre-emptive protection against  
both zero-days and OWASP-Top-10 vulnerabilities.  
*Felipe Rodero, Security Architect, BBVA*

---

## SOLUTION

As a highly trusted financial services supplier, BBVA needed to increase protection in some services,  
applications, content management systems, and APIs. The challenge was that while BBVA were accelerating  
their cloud native development, they wanted to improve control in some environments that could be complex  
with “legacy” tools: zero-day exploits (leaving them exposed for a long period) or blocking legitimate traffic.

BBVA also required a solution that could keep up with their application expansion strategy at the speed of  
DevOps including deploying in Public Cloud infrastructures . This required both flexible deployment options  
and multiple integration points with SDLC tools.

In those environments, They chose Check Point CloudGuard WAF with Automated Web Application and API  
Protection (WAAP) to give them a leading-edge to protect against known and unknown cyber-attacks while  
securing applications in their cloud environment built on any architecture. CloudGuard’s ability to precisely  
detect and eliminate risk while eradicating the need to constantly tune false positives allows security teams  
to manage Application and API security with minimal overheads and in prevent mode.

## OUTCOME

Results at a Glance:

## • Zero-day Protection

Some Services and Applications are protected against zero-day attacks thanks to CloudGuard pre-emptive  
ML-based approach which doesn’t require signature updates. A notable example is protection against  
Log4J which allows the security team peace of mind knowing that systems are protected while they are  
being patched.

## • Visibility and Control

The bank had gained considerably easier management using a single dashboard and had achieved much  
wider and granular visibility into his workload and API eco-system.

We were pleased to find out that CloudGuard WAF  
provided us with protection against Log4J preemptively. We like very much the fact that there is no  
need for signature/rules updates and tuning.  
*Felipe Rodero, Security Architect, BBVA*

---

## • Integration & Automation

The bank has been able to deploy and integrate CloudGuard WAF smoothly with various CSPs and is easily  
integrated into IaC and CI/CD processes. The Customer has also been fully supported by Check Point’s  
technical teams to address any issue or assist with large scale integrations.

## Final Results:

• BBVA has been successfully pursuing its expansion while easily deploying CloudGuard WAF instances and  
integrating with a wide array of cloud native applications.

• BBVA can now safely offer a wide range of services over Services and Apps worldwide without worrying  
about zero-day exploits.

• Working with Check Point as a trusted industry leader adds value to BBVA’s service and offering that is  
based on data security and seamless transactions.

## ABOUT CHECK POINT

Check Point Software Technologies Ltd. (<u>www.checkpoint.com</u>) is a leading AI-powered, cloud-delivered  
cyber security platform provider protecting over 100,000 organizations worldwide. Check Point leverages the  
power of AI everywhere to enhance cyber security efficiency and accuracy through its Infinity Platform, with  
industry-leading catch rates enabling proactive threat anticipation and smarter, faster response times. The  
comprehensive platform includes cloud-delivered technologies consisting of Check Point Harmony to secure  
the workspace, Check Point CloudGuard to secure  
the cloud, Check Point Quantum to secure the network,  
and Check Point Infinity Core Services for collaborative security operations and services.