CASB — Your new best friend for safe cloud adoption? The explosive growth of cloud adoption, “cloud first” initiatives and BYOD have created security and compliance blind spots. Forcepoint’s session examines the growing popularity of the Cloud Access Security Broker as a means to assist security leaders to support business innovation and manage cloud risk.

1. Copyright © 2018 Forcepoint. | 1
CASB – Your New Best Friend
For Safe Cloud Adoption ?
Carl Leonard,
Principal Security Analyst
PUBLIC

2. Copyright © 2018 Forcepoint. | 2
SANCTIONED CLOUD APPLICATION ADOPTION
Source: https://www.okta.com/businesses-at-work/2018-01/

3. Copyright © 2018 Forcepoint. | 3
ARE YOU READY FOR THE NEXT WAVE OF SHADOW IT INNOVATION?
Source: chiefmartec.com http://cdn.chiefmartec.com/wp-content/uploads/2016/03/marketing_technology_landscape_2016_3000px.jpg

4. Copyright © 2018 Forcepoint. | 4
CSA - TREACHEROUS 12
1. Data Breaches
2. Weak Identity, Credential and Access Management
3. Insecure APIs
4. System and Application Vulnerabilities
5. Account Hijacking
6. Malicious Insiders
7. Advanced Persistent Threats (APTs)
8. Data Loss
9. Insufficient Due Diligence
10. Abuse and Nefarious Use of Cloud Services
11. Denial of Service
12. Shared Technology Issues

5. Copyright © 2018 Forcepoint. | 5
ProviderManaged
ProviderManaged
THE SHARED SECURITY MODEL
Enterprise IT
Infrastructure
(as a Service)
Platform
(as a Service)
Software
(as a Service)
Identity & Access
Management
Client & Endpoint Protection
Data Classification &
Accountability
Identity & Access
Management
Client & Endpoint Protection
Data Classification &
Accountability
Identity & Access
Management
Client & Endpoint Protection
Data Classification &
Accountability
Identity & Access
Management
Client & Endpoint Protection
Data Classification &
Accountability
Databases
Security
Applications
Servers
Virtualization
Operating Systems
Data Centers
Networking
Storage
Databases
Security
Applications
Operating Systems
Databases
Security
Applications
Servers
Virtualization
Operating Systems
Data Centers
Networking
Storage
Databases
Security
Applications
Servers
Virtualization
Operating Systems
Data Centers
Networking
Storage
CustomerManaged
CustomerManaged
CustomerManaged
CustomerManaged
ProviderManaged
Servers
Virtualization
Data Centers
Networking
Storage

6. Copyright © 2018 Forcepoint. | 6
THE SPECTRUM OF INSIDERS PUTTING DATA AT RISK
Meet Your Workforce…

7. Copyright © 2018 Forcepoint. | 7
Inadvertent
Behaviors
Poorly communicated
policies and user
awareness
Broken Business
Process
Data where it shouldn’t
be, not where it should
be
Rogue
Employee
Leaving the
company, poor
performance
review
Criminal Actor
Employees
Corporate espionage,
national espionage,
organized crime
Malware
Infections
Phishing targets,
breaches, BYOD
contamination
Stolen
Credentials
Credential exfiltration,
social engineering,
device control hygiene
MALICIOUS INSIDER COMPROMISED INSIDERACCIDENTAL INSIDER
THE SPECTRUM OF INSIDERS PUTTING DATA AT RISK

8. Copyright © 2018 Forcepoint. | 8
Inadvertent
Behaviors
Poorly communicated
policies and user
awareness
Broken Business
Process
Data where it shouldn’t
be, not where it should
be
Rogue
Employee
Leaving the
company, poor
performance
review
Criminal Actor
Employees
Corporate espionage,
national espionage,
organized crime
Malware
Infections
Phishing targets,
breaches, BYOD
contamination
Stolen
Credentials
Credential exfiltration,
social engineering,
device control hygiene
MALICIOUS INSIDER COMPROMIZED INSIDERACCIDENTAL INSIDER
MALICIOUS INSIDER COMPROMISED INSIDERACCIDENTAL INSIDER
10%22%68%
THE SPECTRUM OF INSIDERS PUTTING DATA AT RISK

9. Copyright © 2018 Forcepoint. | 9
$207
$347
$493
$0
$100
$200
$300
$400
$500
$600
Thousands
Average Cost Per Incident
Accidental Insider Malicious User Compromised Insider
$2,292
$1,228
$776
$0
$500
$1,000
$1,500
$2,000
$2,500
Thousands
Average Annualised Cost
Accidental User Malicious User Compromised User
COST OF AN INSIDER BREACH
Source Ponemon 2016

10. Copyright © 2018 Forcepoint. | 10
Data Loss
Prevention
Data Loss PreventionData Loss Prevention
POST - BREACHPRE - BREACH
IDENTIFY
Understand how
much your critical
data is held & Where
it resides
PROTECT
Protect critical data
from malicious attack
and misuse
DETECT
Provide rapid
detection of insider
threats and data
incidents
RESPOND
Reduce response
times to insider
incidents to comply
and protect the
brand
RECOVER
Get back to ‘normal’
and learn from event
– feed back to
‘prepare’
User Activity Monitoring
Inventory for
Personal Data
Map, Manage &
Control Personal
Data Flows
Respond to Data Incidents in a Timely Manner
GDPR Use-Cases
Insider protection technologies mapped to the GDPR
User & Entity
Behavioural Analytics

11. Copyright © 2018 Forcepoint. | 11
CASB – IS IT YOUR NEW BEST FRIEND?
CASB

12. Copyright © 2018 Forcepoint. | 12
Authorised users accessing
approved cloud applications from
unmanaged endpoint devices
Authorised users accessing
unsanctioned cloud app (Shadow IT)
from unmanaged endpoint devices
Authorised users accessing
approved cloud apps from managed
endpoint devices
Cybercriminals/malicious insiders
using stolen credentials to access
cloud applications
4 TOP USE-CASES FOR THE WHENEVER, WHEREVER WORKFORCE
1 2
3 4

13. Copyright © 2018 Forcepoint. | 13
ANALYST GUIDANCE FOR CASB ADOPTION
MEDIUM RISK
(General Deployment)
HIGHER RISK
(As Exception)
LOW RISK
(Early Adoption)
Shadow IT
Discover Shadow IT
Monitor Users & Data
Semi-Real-Time Enforcement
Hard Real-Time Enforcement
Strict Policy Enforcement
Data Encryption &
Tokenization

14. Copyright © 2018 Forcepoint. | 14
CASB INTEGRATION WITH EXISTING PROXY
API
DLP
Encrypt
Tokenize
Device
Mgmt.
Logging
Identity
User
Activity
CASB
MANAGED
DEVICES
UN-MANAGED
DEVICES
BYOK
UNSANCTIONED
CLOUD
SANCTIONED CLOUD
Existing
Proxy

15. Copyright © 2018 Forcepoint. | 15
IDENTIFY CLOUD APPLICATIONS IN USE

16. Copyright © 2018 Forcepoint. | 16
RISK ASSESSMENT METHODOLOGY
https://appdirectory.skyfence.com

17. Copyright © 2018 Forcepoint. | 17
MONITOR & AUDIT USER ACTIVITY

18. Copyright © 2018 Forcepoint. | 18
CASB - API
MANAGED
DEVICES
UN-MANAGED
DEVICES
UNSANCTIONED
CLOUD
SANCTIONED CLOUD
Existing
Proxy
API
DLP
Encrypt
Tokenize
Device
Mgmt.
Logging
Identity
User
Activity
CASB
BYOK

19. Copyright © 2018 Forcepoint. | 19
BENCHMARK CLOUD APPS TO INDUSTRY STANDARDS

20. Copyright © 2018 Forcepoint. | 20
IDENTIFY SENSITIVE DATA IN CLOUD APPLICATIONS

21. Copyright © 2018 Forcepoint. | 21

22. Copyright © 2018 Forcepoint. | 22
IDENTIFY MALWARE IN CLOUD APPLICATIONS

23. Copyright © 2018 Forcepoint. | 23
CASB
CASB – REVERSE & FORWARD PROXY
Reverse Proxy
MANAGED
DEVICES
UN-MANAGED
DEVICES
UNSANCTIONED
CLOUD
SANCTIONED CLOUD
Existing
Proxy
API
DLP
Encrypt
Tokenize
Device
Mgmt.
Logging
Identity
User
Activity
BYOK
Forward
Proxy

24. Copyright © 2018 Forcepoint. | 24
USER BEHAVIOUR ANALYTICS – TO IDENTIFY HIGH RISK USERS

25. Copyright © 2018 Forcepoint. | 25
IDENTIFY USER RISK

26. Copyright © 2018 Forcepoint. | 26
USER ACCESS MANAGEMENT

27. Copyright © 2018 Forcepoint. | 27
CSA - TREACHEROUS 12
1. Data Breaches
2. Weak Identity, Credential and Access Management
3. Insecure APIs
4. System and Application Vulnerabilities
5. Account Hijacking
6. Malicious Insiders
7. Advanced Persistent Threats (APTs)
8. Data Loss
9. Insufficient Due Diligence
10. Abuse and Nefarious Use of Cloud Services
11. Denial of Service
12. Shared Technology Issues

28. Copyright © 2018 Forcepoint. | 28
HOW CAN CASB HELP IN THEORY?
1. Data Breaches
2. Weak Identity, Credential and Access Management
3. Insecure APIs
4. System and Application Vulnerabilities
5. Account Hijacking
6. Malicious Insiders
7. Advanced Persistent Threats (APTs)
8. Data Loss
9. Insufficient Due Diligence
10. Abuse and Nefarious Use of Cloud Services
11. Denial of Service
12. Shared Technology Issues

29. Copyright © 2018 Forcepoint. | 29
CASB – IS IT YOUR NEW BEST FRIEND?
CASB

30. Copyright © 2018 Forcepoint. | 30
4 TOP USE-CASES FOR THE WHENEVER, WHEREVER WORKFORCE
1
Authorised users accessing approved cloud
applications from unmanaged endpoint devices
2
Authorised users accessing approved cloud apps
from managed endpoint devices
3
Authorised users accessing unsanctioned
cloud app (Shadow IT) from unmanaged
endpoint devices 4
Cybercriminals/malicious insiders using stolen
credentials to access cloud applications
Implement Data Protection & User access controls
based on device, destination, user or application
Understand user risk & behaviour
Enforce application-based controls
Apply data protection policies to prevent loss or theft of data
Detect malicious code embedded in documents in cloud storage
Discover Cloud App use from proxies & firewall
Manage unsanctioned cloud app use
Block High risk cloud app access from network
Employ UEBA to detect anomalies and protect & remediate
account takeover threats in real-time
Identify high risk user patterns and apply security polices to
trigger remediation actions (Like account blocking)
Detect unsanctioned application use putting data at risk

31. Copyright © 2018 Forcepoint. | 31
Thank you
FOR MORE INFORMATION
or to sign up for a Cloud Threat Assessment
https://www.forcepoint.com/cloud-threat-assessment