Cloud Application Risks You Can t Manage What You Can t See

Transcription

1 The Unique Alternative t the Big Fur Clud Applicatin Risks Yu Can t Manage What Yu Can t See Managing Unapprved and Apprved Emplyee Clud Adptin March 18, 2015

2 Agenda Shadw IT trends that are creating visibility and cntrl gaps fr enterprises Appraches fr clud applicatin discvery Factrs that make clud applicatins risky Hw t align clud risk scres t yur firm s risk tlerance and psture Hw t use risk intelligence t mve users frm high-risk, unapprved cluds t lw-risk, apprved cluds Hw nging visibility int clud applicatin usage can enhance yur rganizatin's gvernance, risk management practices, and regulatry expectatins 2015 Crwe Hrwath LLP 2

3 NA EU The average glbal enterprise utilizes ver 1,100 clud applicatins. Surce: CipherClud Clud Adptin and Risk Reprt 2015 Crwe Hrwath LLP 3

4 Surce: CipherClud Clud Adptin and Risk Reprt 2015 Crwe Hrwath LLP 4

5 86% f clud applicatins used by enterprises are unsanctined shadw IT. Surce: CipherClud Clud Adptin and Risk Reprt 2015 Crwe Hrwath LLP 5

6 Publishing, scial, and career cluds are 2014 s mst risky clud categries. Surce: CipherClud Clud Adptin and Risk Reprt 2015 Crwe Hrwath LLP 6

7 Eurpe is narrwing the gap f clud adptin t Nrth America. Surce: CipherClud Clud Adptin and Risk Reprt 2015 Crwe Hrwath LLP 7

8 69% f U.S. clud apps used by EU firms are nt Safe Harbr apprved. Surce: CipherClud Clud Adptin and Risk Reprt 2015 Crwe Hrwath LLP 8

9 IT must play catch-up with users and business lines bring yur wn trend Mbile Clud Scial 50% f Users BYOD 67% LOB Sanctin BYOA 75% f Users want t BYOI 90% use public netwrks fr wrk access 100+ clud apps per enterprise 15+ passwrds per emplyee Key cncerns Seeing user activity acrss clud applicatins Measuring the risk prfile f clud applicatins Understanding what factrs make clud applicatins risky Cnverting user activity and clud risk factrs int actinable intelligence 2015 Crwe Hrwath LLP 9

10 Apps and Peple n the Mve = N Visibility, Unknwn Risks Hme-based Users Mbile Users SaaS IaaS/PaaS On-site IT Staff? applicatins? User adpted and missin critical applicatins increasingly reside utside the enterprise narrwing visibility and intrducing unknwn risks Crwe Hrwath LLP 4 10

11 Cybersecurity Risks With Clud Cmputing SaaS Risks Hw are user accunts prvisined and managed? Hw are yu managing yur data? PaaS Risks Hw are yur develpment practices affected? Hw is yur system develpment life cycle affected? IaaS Risks The CSP prvides a management cnsle that allws fr the applicatin develpment in PaaS and administratin f clud assets including data strage and virtual machines, ruters, and firewalls in IaaS. Hw d yu knw the clud assets are prperly cnfigured and hardened t ensure they cannt be inapprpriately accessed r mdified, which culd lead t the lss f the cnfidentiality, integrity, r availability f data? 2015 Crwe Hrwath LLP 11

12 Cybersecurity Risks With Clud Cmputing New Cybersecurity risks include: Lack f well-designed and thught-thrugh plicies and prcedures t gvern the clud services Weak identity and access management cntrls t administer user accunts and manage access Unsecured cnnectins t data in strage r transprt There are many new specific risks assciated with each service mdel that shuld be understd and assessed Crwe Hrwath LLP 12

13 Crwe Clud Security Wrkfrce Review 1. Scanning Scan fr bth knwn and unknwn (unauthrized) netwrk-based hsts fr the mst ppular services fr string and transferring data in the clud. Lg Analysis Active and Passive Scanning Survey 2. Passively Mnitr Utilize netwrk infrastructure t passive mnitr fr netwrk cnnectins traversing the netwrk. 3. Lg Analysis Pwered by CipherClud fr Clud Discvery Perfrm an firewall and web prxy lg aggregatin and analysis. 4. Survey Cnduct a wrkfrce survey t gain feedback directly frm emplyees n clud services they currently use, have used, r wuld like t use. Shadw IT Risk 2015 Crwe Hrwath LLP 13

14 CipherClud Slutin Overview 2015 Crwe Hrwath LLP 14

15 CipherClud fr Clud Discvery Overview Hw it wrks Cntinuus scanning f firewall, web prxy and ther lg types Cllect and aggregate by IP address, user id, device id and lcatin Analyze and reprt trends by time perids, app categry, risk level and mre Sensitive lg files never leave yur rganizatin Clud r On-premises Deplyed Firewall Web Prxy Other 1 Scan TIME IP UID GB IN GB OUT 2 Cllect GEO OFFICE DEVICE USER 3 Analyze LOGS 2015 Crwe Hrwath LLP 15

16 CludSurce Risk Scring Overview CipherClud uses ver 40 factrs cvering 100+ attributes t calculate the verall applicatin risk scre. The attributes are spread acrss: Security Privacy Envirnment Cmpliance Multi-Factr Authenticatin Single Sign-On Encryptin f data-at-rest SSL/TLS Landing dmain Lgin dmain HTTP headers Privacy plicy Ckie plicy Data retentin Data wnership Third-party access Business Transactins Privacy Cmpliance (e.g. TRUSTe) Lcatin Service Level Agreement Disaster recvery Multi-tenancy Type f usage Cntrl f envirnment Data breaches Safe Harbr Cmd ISO PCI AC HIPAA FedRAMP CSA CCM SAS 70 SSAE16 SOC 1,2, Crwe Hrwath LLP 16

17 CipherClud fr Clud Discvery Architecture Clud Apps Crwd Surced Data Independent Verificatin Standards aligned Methdlgy CipherClud Risk Intelligence Lab Autmated & Researched Data CludSurce Knwledge Base Raming Users Clud r On-premises Deplyed HTTPS Web Prxy CipherClud fr Clud Discvery Lg Surces Brwser Internal and External User Activity Firewalls Web Prxies Other Lgs Internal Users Lg Parser Cntinuus Lg Analysis Lg Cllectin & Aggregatin CludSurce Lcal Cache Visibility and Risk Management CISO, Security and LOB Managers Visibility Dashbards Risk Dashbards Scalable, High Perfrmance Infrastructure Reprting Gvernance, Risk, and Cmpliance Managers 2015 Crwe Hrwath LLP 17

18 Use Case: Glbal Clud Applicatin Visibility Challenge Easy fr users t adpt multiple clud applicatins IT can t see wh is ding what What applicatins are used? Hw many users access each app? What is the level f activity? Maintain security f sensitive lgs Blck high risk cluds CipherClud Slutin Lgs files never leave enterprise Discvers all clud applicatins Tracks relevant user and activity patterns Generate blcking scripts Aggregates lg analysis acrss all lcatins and devices Multiple lg frmats frm multiple surces Cntinuus and autmated scheduling f lg scans 2015 Crwe Hrwath LLP 18

19 CipherClud Clud Applicatin Visibility 2015 Crwe Hrwath LLP 19

20 Use Case: Clud Risk Ratings Challenge Measure and cmpare clud applicatin risk Acrss all clud applicatins and applicatin categries Cntent sharing, cllabratin, CRM, IT Infrastructure etc. Establish risk metrics suitable fr yur industry and gvernance plicy CipherClud Slutin CludSurce crwd surced enhanced knwledge base Accurate risk scres fr thusands f applicatins Custmize risk index H, M, L threshlds and risk scre Adjust risk weightings fr specific risk factrs acrss: Security Privacy Envirnment Cmpliance 2015 Crwe Hrwath LLP 20

21 CipherClud Risk Ratings 2015 Crwe Hrwath LLP 21

22 Use Case: Clud Risk Intelligence Challenge Detailed risk analytics acrss enterprise clud envirnment Gvernance and risk reprting On-ging and accurate intelligence n Changing risk psture New applicatins New risk attributes CipherClud Slutin Dashbards enables aggregate analysis Summary and drill dwn by risk, activity, users and time perid Filter by risk level, applicatin categry and time perid CipherClud Risk Intelligence Lab Expert research by dedicated staff Transparent, standards aligned methdlgy 2015 Crwe Hrwath LLP 22

23 2015 Crwe Hrwath LLP 23

24 Use Case: Clud Applicatin Life Cycle Prtectin Challenge Discver applicatins and data Prevent data lss Prtect structured and unstructured data Withut disruptin t peratins and user experience Mnitr against internal and external threats Supprt the lifecycle with a single platfrm CipherClud Slutin Single pen platfrm fr multiple cluds Clud and data discvery & mnitring Unprecedented visibility and cmpliance scanning Missin-critical architecture fr high perfrmance AES-256 bit encryptin, rbust key management Patented Searchable Strng Encryptin Tkenizatin Malware detectin 2015 Crwe Hrwath LLP 24

25 Business Benefits Data Breach Avidance Identify risky clud applicatins that are a ptential surce f a breach Find the users and grups that use risky applicatins Blck high risk applicatins and manage lw risk applicatins Clud Applicatin Cnslidatin Cmpare clud applicatin categries (e.g. cntent sharing) Mve t sanctined clud apps while keeping users happy and prductive Reduce subscriptin fees and ther csts frm duplicate r unused accunts Agility, Flexibility & Gvernance Tame Shadw IT thrugh risk intelligence and clud applicatin analytics Guide LOB in clud applicatin adptin while prtecting clud infrmatin Manage risk thrugh increased visibility, reprting and cmpliance 2015 Crwe Hrwath LLP 25

26 CipherClud fr Clud Discvery Advantages Cmpete platfrm Mve frm discvery t prtectin and mnitring with ne pen platfrm acrss clud applicatins. Cntinuus discvery User activity is analyzed cntinuusly ensuring a cmplete, up-t-date picture f yur clud envirnment. Perfrmance and scalability Perfrm big data analytics n terabytes f user activity lgs CipherClud is architected t scale t the largest enterprise requirements. Discvery and visibility advantages Risk intelligence expertise A dedicated team f clud risk experts uses advanced research techniques t gather risk factrs fr thusands f applicatins. The pwer f crwd surcing Mre than 100 critical risk attributes are cntinuusly expanded and refined thrugh CipherClud s CludSurce knwledge base. Free risk assessment Get a detailed reprt f yur rganizatin s clud risk psture and a risk cnsultatin call. In partnership with Crwe Hrwath. Risk intelligence advantages 2015 Crwe Hrwath LLP 26

27 Get the Clud Adptin and Risk Reprt Fr additinal infrmatin: Schedule a dem: cludrisk@cipherclud.cm Website: LinkedIn: Crwe Hrwath LLP 27

28 Questins? 2015 Crwe Hrwath LLP 28

29 Fr mre infrmatin, cntact: Jared Hamiltn Crwe Hrwath LLP David Berman Directr, Clud Discvery and DLP Slutins CipherClud Crwe Hrwath LLP is an independent member f Crwe Hrwath Internatinal, a Swiss verein. Each member firm f Crwe Hrwath Internatinal is a separate and independent legal entity. Crwe Hrwath LLP and its affiliates are nt respnsible r liable fr any acts r missins f Crwe Hrwath Internatinal r any ther member f Crwe Hrwath Internatinal and specifically disclaim any and all respnsibility r liability fr acts r missins f Crwe Hrwath Internatinal r any ther Crwe Hrwath Internatinal member. Accuntancy services in Kansas and Nrth Carlina are rendered by Crwe Chizek LLP, which is nt a member f Crwe Hrwath Internatinal. This material is fr infrmatinal purpses nly and shuld nt be cnstrued as financial r legal advice. Please seek guidance specific t yur rganizatin frm qualified advisers in yur jurisdictin Crwe Hrwath LLP 2015 Crwe Hrwath LLP 29