1. Perimeters and Unicorns: Two Things That Only Exist in IT Fairyland Gary Paluch, CISSP, Sr. Sales Engineer
We’re all familiar with the term “Shadow IT’. Perhaps too familiar. In fact, we’re all probably a little tired of hearing it – I know I am.
So I’d like to take a different look at this and contend that Shadow IT doesn’t have to be shady. To get there, though, we do need to talk about this dilemma – so let’s get started.

2. The perimeter as you know it is
GONE

3. The Rise of Consumer-Driven IT
TODAY
SaaS App
Explosion
2007
(iPhone is born)
BYO and Consumerization
MOBILITY
2000
Remote and Line of Business SaaS usage
Salesforce.com is born
Campus-based
client/server
VIRTUALIZATION & CLOUD

4. There are 10,000 enterprise apps today (and growing).
There are 4000 enterprise apps today. This is up from 3,000 6 months ago and we’re adding somewhere in the range of of these apps per month on average. These are the most common apps and some apps you’ve never even heard of. I talk to customers who a year ago were trying to get their heads around deployments of apps we’ve all heard of like Evernote and HipChat… today these customers are calling me about apps like Trello and Seamless. These things aren’t just grow up in numbers, they’re growing out in category redundancy – we’ll talk about that in a minute. But why is this happening? How has it come to be?
The answer is closer to you than you think. Reach into your pocket and pull out your phone. Take out that tablet. Grab 1 of the 3 devices we all carry around with us everyday… We love these devices and we love these apps!

5. © 2015 Netskope. All Rights Reserved.
How Do Cloud Apps Get In?
10%
IT-led
Sanctioned
70%
Business-led
Mostly Unsanctioned
20%
User-led
One framework we use to think about cloud apps starts with how those apps come into your environment, and whether they’re sanctioned or not. Some are brought in by IT, some by lines-of-business, and some by individuals. Each of these app types has an important, and often business-critical, role to play in the success of your organization. Even Twitter is a must-have for many organizations and not just in marketing, but in customer support, business development, and the executive team. We at Netskope have thought through how to safely enable apps, whether sanctioned or not, and regardless of how they come into your environment.
© 2015 Netskope. All Rights Reserved.

6. These were controlled by IT
IT estimate:
40-50
Not just individuals…
64 Marketing
47 Collaboration
40 HR
Actual:
715
These were controlled by IT
Beyond the sheer volume of apps, the number of apps in business-critical or risky categories is surprising.
And when measured for enterprise-readiness you’ll find that more than three-quarters of them score a “medium” or below. This is based on Netskope’s Cloud Confidence Index which is modeled and developed in collaboration with the Cloud Security Alliances Cloud Controls Matrix. This means that these apps don’t meet enterprise standards for security, auditability, and business continuity.
With the majority of cloud app procurement happening outside of IT, there is risk – risk of security events, data loss, and non-compliance. All of this basically sets up one giant catch-22: IT must enable the very cloud that it has to protect the business from.
And you can see this dilemma playing out. We simply haven’t been able to move fast enough from a technology or policy point of view… <next slide>
Source: Netskope Data

7. apps users activities data Malicious or non- intentional
700+ cloud apps per enterprise
90% are not enterprise-ready
users
Malicious or non- intentional
15% of corporate users have had their account credentials compromised
activities
Cloud makes it easy to share
When is an activity an anomaly?
data
18% of files in cloud apps constitute a policy violation
22% of those files are shared publicly
With more than 700 cloud apps being used by a typical enterprise, what is the risk associated with all this cloud usage?
<advance to data breaches build> Let’s start with the elephant in the room - security breaches. It seems like a day doesn’t pass without news of another data breach has been a tough year so far with more than 107M records exposed.
<advance to policy violation build> Data breaches present a big risk because the type of data that is exposed. Nearly a fifth are sensitive and another fifth of those are shared publicly. Sensitive content combined with files shared publicly is a recipe for disaster.
<advance to probability of a data breach build> You have spent a good amount of investment on perimeter security technology to help mitigate security risks associated with your enterprise infrastructure, but now that your perimeter has been extended to cloud apps, you have blind spots and are more vulnerable to attacks and potential loss of sensitive data. According to the Ponemon Institute, using the cloud can increase the probability of a data breach by more than 3 times.
<advance to risk factors build> There are four risk factors to consider and address when it comes to cloud usage. Cloud apps, users, activities, and data.

8. Catch-22
There is a catch-22 between using the cloud and being safe. The question is should you block everything to mitigate your risk? That may not be the best solution as many people rely on the cloud for anytime, anywhere, access to data and to help them be more productive.
Next Slide…

9. Allow is the new block (allow is new block green light slide)
Netskope believes that Allow is the New Block and you should allow cloud applications, but block the risky activities instead.

10. 6 Steps to Mitigating Cloud Usage Risk (without blocking everything)

11. Discover the cloud apps running in your enterprise and assess risk
STEP 1:
Discover the cloud apps running in your enterprise and assess risk
Step 1: Let’s rip off our blind folds. Seeing is believing and knowing definitively the number of cloud apps people are using in your enterprise is the first step.

12. Understand cloud usage details
STEP 2:
Understand cloud usage details v
Bob in accounting v
Bob’s credentials have been compromised v
Uploading customer data to Dropbox v
From his
mobile phone
Step 1: Let’s rip off our blind folds. Seeing is believing and knowing definitively the number of cloud apps people are using in your enterprise is the first step.

13. Traditional perimeter security is blind to cloud activity
Cloud Security 2.0
Number of cloud apps
Hundreds
Thousands
Bytes ✔️
Basic session Info
Cloud app enterprise-readiness score
Activity-level details for all cloud apps
Content-level details for files tied to an activity or for files stored in a cloud app
© 2015 Netskope. All Rights Reserved.

14. Perimeter security lacks activity and content visibility
Identity
App
Activity
Data
Summary
Login as:
Browser/OS
From: IP address
To: IP address
URL Category: File Sharing/ Storage
HTTP GET/POST/ DELETE/CONNECT
HTTP headers
GET and POST
Body
Web session start
Web session end
Login:
URL: Box
Category: File Sharing
Using: Macbook, Safari 6.0
From: IP address
To: IP address
Perimeter Security
PII/PCI/PHI data
Other sensitive classifications
Login:
Box: ID
App: Box
Instance: Corporate
Using: Macbook, Safari 6.0
From: Mountain View, CA
Activities: Create Folder, Move Files (4), Share Folder w/
Anomalies: Downloaded a PII doc from SFDC, uploaded to box
Login as:
Box ID:
Using: Macbook/Safari
From: Mtn View, CA
Destination: App located in Germany
To user: sharing a doc with
App: Box
Category: Cloud Storage
App Instance: Corporate
CCL: High
Risk: High
Login
Upload
Download
Share
Logout
Invite
Edit
View…
Cloud Security 2.0
© 2015 Netskope. All Rights Reserved.

15. STEP 3: Monitor activities, detect anomalies, and conduct forensics
Step 3 Let’s face it, we’re adapting to a time where you can’t wait to vet everything and you need to trust and then verify rather than the other way around. So put tools and analytics in place that lets you see things proactively.

16. Find sensitive data tied to an activity or stored in a cloud app
STEP 4:
Find sensitive data tied to an activity or stored in a cloud app
Step 1: Let’s rip off our blind folds. Seeing is believing and knowing definitively the number of cloud apps people are using in your enterprise is the first step.

17. Use surgical precision in your policies, leveraging contextual data
STEP 5:
Use surgical precision in your policies, leveraging contextual data
Step 4: With all the information you’ve gathered in step 2, you can start to come up with a plan and start making decisions.

18. Examples of using context in your policies
Quarantine PII data uploaded to risky cloud storage apps
Allow marketing and support teams to post to social media, but block finance team
Don’t allow data marked “confidential” to be shared outside of our company
Alert users using their personal Dropbox to use a sanctioned cloud app instead
© 2015 Netskope. All Rights Reserved.

19. STEP 6: Don’t leave users in the dark. Coach them on safe usage.
Step 8: In the immortal words of Jerry McGuire… Help me, help you! You want security, they want to use apps. Help them get use these apps securely by communicating.
Best practices:
Customize your coaching messages based on the situation
Involve users as part of the workflow; enable them to justify their actions
Implement an automated quarantine process for sensitive data and a workflow to approve or deny content

20. 1: 4:
Find sensitive data part associated with an activity or stored in a cloud app
Discover the cloud apps running in your enterprise and assess risk 5:
Use surgical precision in your policies, leveraging contextual data 2:
Understand cloud usage details 3:
Monitor activities, detect anomalies, conduct forensics, and find sensitive data 6:
Don’t leave users in the dark. Coach them on safe usage.
Here, in summary, are my 6 steps. I think it’s a good starting point and I hope you think so to. Because ultimately …. <click>