Control access to Cloud applications… and to all the others

The explosion of Cloud applications is playing an active part in the digital transformation of business lines. IT teams can now focus their efforts on usage (the what) far more than on the infrastructure required (the how). Security nevertheless remains a constant concern; otherwise, company data risks being compromised sooner or later.

CASB & SASE

Introduced by Gartner around ten years ago, CASB (Cloud Access Security Broker) places security mechanisms between users and Cloud applications.

These mechanisms aim to reflect the company's security policy: user identity, application access control, data protection and encryption. The arrival of SASE (Secure Access Service Edge), defined by Gartner in 2019, now unifies all network and security services.

Like web gateways, firewalls and intrusion and malware protection, CASB is one of the SASE security services.

Within a true SASE platform, all traffic is analysed and processed in line with the organisation's security policy. It finally becomes possible to apply the famous "who is allowed to do what":

• At user level (identity management)
• Whatever the way of working (Zero Trust Network Access)
• And whatever the internal or Cloud application used (CASB)

Getting "shadow IT" under control

Built into the SASE model, the CASB function can process all traffic bound for Cloud applications.

This is particularly useful given that:

• More than 97% of the Cloud applications used in companies are unknown to IT teams
• This represents nearly a thousand applications for a mid-sized company and concerns 80% of users on average
• Nearly 70% of employees use their own collaboration tools, especially for file sharing
• These "shadow IT" applications account for at least 50% of the IT budget each year
• 40% of organisations have experienced a data leak in the last 12 months

What approach should be taken?

Given this situation, banning everything that IT does not support would have a direct impact on the business.

The answer is to adopt a structured, iterative approach that keeps business usage and the company's security policy aligned over time.

Step 1 – Get a clear picture

The first step is to obtain an exhaustive view of Cloud usage in order to determine:

• Which Cloud applications are used?
• By whom?
• How often: frequency, volumes?

All the inventory information is provided by the CASB engine built into the SASE platform, which analyses every user connection, in the office or on the move.

Together with the business lines, it is also necessary to identify the uses associated with these applications and their business criticality.

Step 2 – Assess the level of risk

Once the inventory step is complete, it is important to determine the level of risk associated with each application. This must take into account:

• The vendor's reputation
• The application's security level (MFA, SSO, verified certificates, encryption, etc.)
• How well it meets compliance requirements (PCI DSS, ISO 27001, SOX, etc.)

This information, which is not always easy to gather and keep up to date, must be an integral part of the CASB.

Step 3 – Bring into compliance

Based on the risk analysis of each application, the IT team can decide which applications to approve and under what conditions.

The CASB must make it possible to define the access policy for each application:

• Who can access it, when and how?
• For what type of use?

For example, it will be possible to restrict the use of Microsoft 365 to the company's environment, or to allow only file downloads from an application such as Box.

It will also be possible to monitor the associated usage in order to detect any unauthorised behaviour.

Step 4 – Protect

Once the security policy has been applied to Cloud applications, all the security mechanisms built into a SASE platform protect the company's users and data:

• Protection against intrusions and malware (IPS, NGAM)
• Data loss protection (DLP)

Example: Cato Networks CASB built into its SASE platform

The implementation of CASB by Cato Networks is a natural extension of the security features of its SASE platform. All traffic from client sites and mobile users is already processed by Cato's points of presence (TLS inspection, firewalling, IPS, anti-malware, visibility of application traffic, etc.). Adding the CASB function brings no extra complexity or latency.

The CASB function is characterised by two key elements:

1 – Visibility of SaaS / Cloud applications

Through a dashboard in Cato's unified management interface, IT teams can "discover" all the Cloud and SaaS applications carried on their network, whether approved or not (Shadow IT discovery):

• Consumption of Cloud applications over a given period, new applications detected since the previous period
• List of users concerned
• Risk score for these applications (calculated from the vendor's reputation, compliance with current regulations, the security mechanisms implemented, etc.)

2 – Filtering of in-app activities

Once full visibility is achieved, usage rules can be applied to the various Cloud applications.

For example, employees can be prevented from sending files through applications not approved by IT, without banning the application altogether. Partners and clients can therefore still send files.

This filtering is the first step towards data loss prevention (DLP), coming soon to the Cato Networks platform.

Key takeaways

In summary, implementing a security policy for access to Cloud applications is an iterative, long-term process.

With an exhaustive view of the traffic crossing its SASE network infrastructure, the IT team can identify and secure the applications the business needs.

It is the integration of CASB features at the heart of a SASE platform that delivers this complete control of the IT environment.

Whatever the way users work, applications accessible anytime, anywhere will comply with the company's overall security policy.

Op-ed by Jérôme BEAUFILS, President of SASETY, and Christophe LOPEZ-CASTEL, South EMEA Channel Manager at Cato Networks

To see in practice what CASB brings through Cato Networks' Cato Cloud, nothing beats a demo! 📅 👇

Book a demo →

In the press

globalsecuritymag.fr

undernews.fr