1. Identity Driven Security
Cloud App Security
With more than 80 percent of employees admitting to using non-approved SaaS apps for their jobs, how can you maintain visibility, control, and protection of your cloud apps?
With this fast transition to cloud apps, we know you may be concerned about storing corporate data in the cloud and how to make it accessible to users anywhere without comprehensive visibility, auditing, or controls. Legacy security solutions are not designed to protect data in SaaS applications. Traditional network security solutions, such as firewalls and IPS, don’t offer visibility into the transactions that are unique to each application and traffic off-premises, including how data is being used and stored. Classic controls fail to provide protection for cloud apps as they monitor only a small subset of cloud traffic and have limited understanding of app-level activities.
We have your solution: Microsoft Cloud App Security
Why Cloud App Security?
Shadow IT discovery – no agents required
Enchanced threat protection with Microsoft intelligent security graphs
Granular controls of your sanctioned apps
Builds on broader Microsoft platforms
It’s enterprise grade and easy to use
It’s deep intergration with Office
CLICK STEP(S).
Click anywhere on the slide to begin

2. Here you are presented the Microsoft Cloud App Security console.
You have four key menus to choose from: “Discover”, “Investigate”, “Control” and “Alerts”
These menus provide you a wide set of capabilities including visibility, comprehensive data controls and threat prevention for your cloud apps.
Let’s go ahead and start with the discovery dashboard.
CLICK STEP(S)
Click the Discover menu.

3. CLICK STEP(S)
Click on Cloud Discovery dashboard.

4. The Discovery dashboard provides an overview of cloud apps used in your organization with details.
CLICK STEP(S)
On the right, click on the scroll bar to scroll down.

5. It also identifies all users and IP addresses accessing the application while also conducting risk assessment and automated risk score for each app.
Point Out: Top Users/Top IP Addresses Tile
Your users do not need to deploy any additional agents on their devices for Cloud App Security to provide this analysis because we collect information from the firewalls and proxies.
CLICK STEP(S)
On the right, click on the scroll bar to scroll up.

6. The dashboard provides an overall understanding of your organization’s cloud app usage.
However, to get more detailed information about the apps being used, let’s navigate to Discovered apps.
CLICK STEP(S)
On the Cloud Discovery navigation bar, click on Discovered apps

7. Here you see all of the discovered apps in the organization, including a lot of additional data, such as amount of users using the app, the amount of IPs the app is being accessed from or the total number of transactions to name a few.
CLICK STEP(S)
On the right, click the scroll bar to scroll down.

8. You also can easily filter based on the name, activity time frame or the risk score associated with the application.
Let’s filter for collaboration apps.
CLICK STEP(S)
On the left, click Collaboration.

9. You can also have the ability to drill down on a specific app.
Let’s review Office 365.
CLICK STEP(S)
Under the Score column, click on 10 for Office 365.

10. Cloud App Security not only discovers more than 13,000 cloud applications in use but it also provides an automated risk score by evaluating each discovered service against more than 60 parameters.
CLICK STEP(S)
On the right, click the scroll bar to scroll down

11. Here you can see all of the different parameters used for the risk evaluation.
Let’s look at an example of a parameter breakdown.
CLICK STEP(S)
On the bottom right of the slide, click on HTTP security headers.

12. You can dive into more details for a specific parameter to get a breakdown on the score.
You can see the weight of this parameter in this category and which factors are considered for risk assessment.
You can interact with this risk assessment by reporting new data or requesting a score update.
CLICK STEP(S)
On the right, click the scroll bar to scroll up.

13. CLICK STEP(S)
Under the Name column, click on Office 365 to navigate to charts.

14. Discovering which apps are in use across your organization is just the first step in making sure your sensitive corporate data is protected.
CLICK STEP(S)
On the right, click on the scroll bar to scroll down.

15. You also have access to powerful reporting and analytics capabilities for you to gain the complete context of your cloud usage: such as usage patterns, upload/download traffic and top users.
Next, let’s see how you can investigate and gain detailed visibility on a file level.
To do this we will navigate to the Investigate menu.
CLICK STEP(S)
On the top navigation bar, click on Investigate to expand the drop down menu.

16. CLICK STEP(S)
Click Files.

17. The Investigate menu provides you with deep visibility into all activities, files and accounts.
Here you can see all files in your cloud environment with an easy and powerful query engine.
Let’s set the Access level filter to sort for all public files.
CLICK STEP(S) In the middle of the filtering bar, click on the Access Level drop down menu to expand.

18. CLICK STEP(S)
Click Public.

19. Security vulnerabilities or data leakage are always a concern and it is very easy for an employee to accidentally make a file link public.
No one has the time to go through all publically shared files to ensure no sensitive customer or company data has been leaked.
However, this can be done easily by navigating to the policies page, where you have the option of creating new policies or monitoring current existing policies for violations.
CLICK STEP(S)
On the top navigation bar, click on the Control menu to expand.

20. CLICK STEP(S)
Click Policies.

21. Here you are presented all of the active policies which are monitoring all apps used in your organization.
Within the Policy page, we will review 2 different scenarios:
Walkthrough the creation of a new policy using a template
File level investigation:
Authorizing a legitimate file
How to take action against suspicious/unauthorized file activity.
For the 1st scenario, you will see how simple and straight forward it is to create a new policy.
CLICK STEP(S)
Click Create Policy.

22. Cloud App Security provides you a variety of different types of policy types to choose from.
Each possessing their own policy specific templates but still allowing you the ability to customize it to your need(s).
For today, let’s just focus on a new App Discovery policy.
CLICK STEP(S)
Click App Discovery Policy.

23. When creating a new policy, you have the option of using “out of the box” templates or customizing your own policy.
Today, we will be using an “out of the box” template.
CLICK STEP(S)
Click the Policy Template drop down menu.

24. To reiterate, the primary reason behind the creation of this policy is to target possible “risky” apps.
So let’s select the “New Risky App” template.
CLICK STEP(S)
Click New Risky App.

25. CLICK STEP(S)
Click Apply Template.

26. Now that the template has been applied, let’s review the policy.
Point Out: Policy Description statement and review the criteria described that will generate an alert.
CLICK STEP(S)
Click scroll bar to scroll down.

27. Even though an “out of the box” template has been used, you still have the ability to alter any of the values to fit your requirements.
Point Out: Create a filter section and note the risk scores being targeted
Point out: Trigger a policy match section, showing another set of criteria that will trigger an alert.
Now moving onto the 2nd scenario, file level investigation.
CLICK STEP(S)
Click Cancel.

28. For the 2 file investigation sub scenarios you will refer to the PCI compliance policy which identifies sensitive, publicly shared files containing customer credit card numbers.
As you can see, the PCI policy is currently detecting 2 files in violation of it’s policy.
Point Out: 2 matches on the PCI Compliance policy line.
Let’s investigate these violations.
CLICK STEP(S)
Click on the PCI COMPLIANCE policy.

29. For the 1st file level investigation scenario, you will see how you can authorize legitimate activity using the Test_file_for_DLP_test.docx.
CLICK STEP(S)
Click on the Payment schedule and details.xlsx file to minimize.

30. CLICK STEP(S)
Click on the Test_file_for_DLP_test.docx file.

31. To further investigate, you want to view the hierarchy, which you know shows where this file resides.
CLICK STEP(S)
Under the File Name, click View Hierarchy.

32. Viewing the hierarchy, you can now determine that this is a test file as the file is located in a folder labelled “Test Files”.
CLICK STEP(S)
Click Done to exit.

33. Since this file is a legitimate test file, you can now proceed to authorize this file.
CLICK STEP(S)
To the left of the more information icon, click the check mark to authorize this file.

34. Moving onto the 2nd file level investigation scenario, you will see how Cloud App Security allows you to react and take action against suspicious activity and/or violations.
The document that will be used for this scenario is the Payment schedule and details.xlsx spreadsheet.
Let’s click on the spreadsheet to expand the file details.
CLICK STEP(S)
Click on Payment schedule and details.xlsx.

35. Within the file details, you can see the owner of the file, all the collaborators, when it was created and when it was modified.
By looking at the URL, you can see that the files is shared publicly to everyone via SharePoint.
Point Out: Shared with everyone section of the URL
/Shared with Everyone/Tiderc.txt
You can also see that this file contains an Azure Information Protection classification label, specifically the Secret: Finance Only label.
Point Out: File Tag: Secret (external), Finance Only (external)
To further investigate, let’s see where this file resides, by viewing the file’s hierarchy.
CLICK STEP(S)
Under the File Name, click View Hierarchy.

36. You can see that this file is located under one of our customer information folders and should not be shared publicly.
CLICK STEP(S)
On the far right side, click on the more information icon (3 vertically stacked dots) for the Payment schedule and details.xlsx file.

37. You can now make an accurate assessment with the given evidence and take action, by either “put in user quarantine” or “make the link private”.
CLICK STEP(S)
Click Done to exit Hierarchy window.

38. Deeper visibility and stronger controls are key components of providing enterprise grade security for your applications, but you don’t stop there.
Cloud App Security not only provides you discovery and data control features but also a powerful threat detection engine.
Let’s see how Cloud App Security helps you detect anomalies and prevent threats.
For this let’s navigate to the Alerts menu.
CLICK STEP(S)
On the top navigation bar, click on Alerts.

39. The alerts center will generate an alert if any active policies are violated.
Let’s investigate a General Anomaly Detection alert.
CLICK STEP(S)
Click on the 3rd alert, General Anomaly Detection

40. Cloud App Security advanced machine learning heuristics learns how each user interacts with each SaaS app and through behavioral analysis, assesses the risk in each transaction.
Here you can see a user who is an administrator performing suspicious activities such as logging in from a new anonymous location and two countries simultaneously within an hour with several failed login attempts.
Point Out: is an administrator
CLICK STEP(S)
On the right, click on the scroll bar to scroll down.

41. Using the Activity Log, you are presented each action performed by the suspected user.
Through this alert, you are also provided the option of remediating the threat or adjusting the policy as needed.
Closing remarks:
Through Microsoft Cloud App Security, you will have deeper visibility, comprehensive controls, and improved protection for your cloud applications.
Cloud App Security is designed to help you extend the visibility, auditing, and control you have on-premises to your cloud applications.