Download to read offline
Uploaded byNorth Texas Chapter of the ISSA
Luncheon 2015-03-19 - If Your Traffic is Going to the Cloud, Why Aren’t You Securing it There? by Rob Davis
The document discusses the optimal scenarios for leveraging cloud solutions in web security, emphasizing the need for effective alert management and resource allocation. It highlights the rapid adoption of cloud applications like Microsoft Office 365 and the importance of comprehensive security measures against emerging threats, particularly noting the risks associated with SSL traffic. The content also addresses budget constraints and strategic considerations for implementing cloud security while maintaining compliance and minimizing risks.
More Related Content
![[Infographic] In-House vs. Virtual Servers](https://cdn.slidesharecdn.com/ss_thumbnails/inhousevsvirtualservers-150407132331-conversion-gate01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Luncheon 2015-03-19 - If Your Traffic is Going to the Cloud, Why Aren’t You Securing it There? by Rob Davis
More from North Texas Chapter of the ISSA
![How Big Brands are Taking Your Traffic in Alberta [Data Inside].pptx](https://cdn.slidesharecdn.com/ss_thumbnails/howbigbrandsaretakingyourtrafficinalbertadatainside-260123180142-42d276f3-thumbnail.jpg?width=640&height=640&fit=bounds)
Luncheon 2015-03-19 - If Your Traffic is Going to the Cloud, Why Aren’t You Securing it There? by Rob Davis
- 1.
- 2.
- 3. Becoming more effective: §Are you getting right alerts? § Reduce false positives § Reduce time to investigate § Increase headcount § Reduce time “maintaining tools” Example: 40 alerts requiring investigation per day X .5 hrs/investigation / 8 hrs/day = 2.5 headcount
- 4. 4 Ongoing 90% 10% Software/Hardware Costs The90% • Apply fixes, patches, upgrades • Downtime • Performance Tuning • Rewrite customizations • Rewrite integrations • Maintain/upgrade hardware • Power, cooling, rackspace
- 5. People love theircloud apps, and for good reason Anywhere Access TimeCost 5
- 7.
- 8. 8 STEP 1: Requirements for WebContent Security
- 10. 10© 2014 CriticalStart LLC The Magic Quadrant That Doesn’t Exist Ongoing 90% • Dynamic Malware Prevention • Anti-Virus (known bad) • Data Loss Prevention • SSL Inspection • File Type Control • Browser Control • Authentication Proxy • URL Filtering • Caching • Bandwidth Controls
- 11. 11© 2014 CriticalStart LLC Flow management Load balancers Edge firewall SSL Server – side SSL tunnel Aggregation firewall SSL PAC File 1 2 3 28 27 26 10 15, 16 Client - side SSL tunnel SSLSandboxWeb Filter 11 Log files Content Inspection Best of Breed is Best
- 12. When Does CloudMake Sense?
- 13. 13 Provide Protection atEvery Location
- 14. 14© 2014 CriticalStart LLC Eliminate the Need to Backhaul Internet Traffic VPN Gateway(s) MPLS HQ Unprotected ! MOBILE – 3G, 4G Unprotected ! PRIVATE CLOUD | MOBILE APPS | CONSUMER CLOUD COMMERCIAL CLOUD | PUBLIC CLOUD BRANCH REGIONAL HUB BRANCH BRANCH ON-THE-GO HOME/HOTSPOT
- 15. 15© 2014 CriticalStart LLC Close Visibility Gaps Ongoing 90% “Less than 20% of organizations with a firewall, an intrusion prevention system (IPS) or a unified threat management (UTM) appliance decrypt inbound or outbound SSL traffic.” Gartner
- 16. The Advent of 2048 Bit SSL Certificates § Some proxy vendors typically bypass SSL – performance overhead §Customers using SSL decryption are buying new hardware Banking Enterprise Webmail Social Networking Search SSL on Internet Login Transactions All App Coverage Performance Security 1024 bit 2048 bit 80% Performance Drop
- 17. 17© 2014 CriticalStart LLC The Future of SSL Attacks Ongoing 90% “Gartner believes that by 2017 more than 50% of the network attacks targeting enterprises will use SSL encryption. For this majority of organizations that do not decrypt data, most lack the ability to decrypt and inspect encrypted communications to assess these threats.” Gartner
- 18. 18© 2014 CriticalStart LLC Anti-Virus and Dynamic Malware Analysis Ongoing 90% • Dynamic Malware Prevention • Anti-Virus (known bad) • SSL Inspection • File Type Control § EXE, encrypted archive • Protection for remote laptops
- 19. 19© 2014 CriticalStart LLC Tight Budgets and Few Resources Multiple appliances at every Internet gateway All Cloud Delivered
- 20. 20© 2014 CriticalStart LLC Best of Breed Requires the Expertise on Each Point Product ©2013 Zscaler, Inc. All rights reserved.
- 21. 21© 2014 CriticalStart LLC Conduct an Annual Security Tools Assessment
- 22.
- 23. The real face of shadow IT is you, me and even IT. We’re being asked to solve this and to be strategic. It’s a new dynamic that we need to embrace. (big picture/words) Business Risk is the real shadow Balancing people, budget, andrisk tolerance Ultimately, this is simply another business decision.
- 24. • Complex dataloss prevention use cases • Multi-vector dynamic malware • Complex proxy requirements • Regulatory constraints • Bandwidth shaping between sites • Very old NW equipment (tunnels) • I can do it better § Security budget to afford § People and expertise to operate When To Avoid Cloud Only
- 25. 25© 2014 CriticalStart LLC Example Cloud Architecture Mobile AppsConsumer Cloud Private Cloud Commercial Cloud Public Cloud On-the-go Home officeHQ Regional offices Factories Internet of things Branches / stores Mobile
- 27.
Editor's Notes
- #2 I talk to customers that say “We don’t like the cloud” or “Should we be using the cloud”. What is the question that should be asked? How do I leverage the cloud while still applying the same controls used internally?
- #5 Beyond the sheer volume of apps, the number of apps in business-critical or risky categories is surprising. In HR Netskope find an average of 35 apps, and in finance/accounting, they find an average of 18. And when measured for enterprise-readiness you’ll find that more than three-quarters of them score a “medium” or below. This is based on Netskope’s Cloud Confidence Index which is modeled and developed in collaboration with the Cloud Security Alliances Cloud Controls Matrix. This means that these apps don’t meet enterprise standards for security, auditability, and business continuity. With the majority of cloud app procurement happening outside of IT, there is risk – risk of security events, data loss, and non-compliance. All of this basically sets up one giant catch-22: IT must enable the very cloud that it has to protect the business from. And you can see this dilemma playing out. We simply haven’t been able to move fast enough from a technology or policy point of view… <next slide>
- #6 In nearly every survey, people cite “business agility” as the primary driver for cloud adoption – even more so than cost. People want to be productive now, not after the software rollout next spring. They want to access apps from any of their devices (we now count an average of 3.5 devices per knowledge worker). And they want to collaborate with colleagues and business partners in a seamless, frictionless way. Beyond paving the way for productivity gains, this shift has also created a new opportunity for IT – to become an enabler and innovator in facilitating the use of these apps.
- #7 First and foremost, it shouldn’t come as a surprise that cloud computing is one of the most dramatic workplace shifts we’ve seen in decades. People are buying new mobile devices every two years, versus new PCs every 3-5 years. When we think about cloud app growth, it’s often about individuals’ usage of apps like Box and Dropbox. The reality is every line of business is adopting cloud apps, whether for HR, finance, supply chain, or business intelligence. Mobile, the other major crossover we’re seeing – with mobile devices and access surpassing that of PCs in virtually every measure – has fueled this shift. Cloud is no longer a question – it’s the way we do business. Cloud revenue expected to be $250B by 2017 (Gartner) By 2016 over a quarter of all applications (48 million) will be available in the cloud Worldwide SaaS market forecasted to grow from $18.2 in 2012 to $45.6 billion in 2017 Around 58% of enterprises spend more than 10% of their annual budgets on cloud services (The Everest Group)
- #8 And it’s a way of doing business for IT and lines of business. You can’t turn left or right these days without running into a cloud app deployment or project of some kind. Look at this. Last year, projects alone doubled from the first half of the year to the second half. And we’re not talking about moving from 1 to 2 projects… <next slide>
- #9 Step 1: Let’s rip off our blind folds. Seeing is believing and knowing definitively the number of cloud apps people are using in your enterprise is the first step. Your firewall alone isn’t going to be able to tell you this. You need a tool that’s tuned to see the 4000+ apps in existence that traverse your firewall or web gateway. And to be honest, that’s just the beginning. The portion of apps that will never touch a perimeter device is growing, so consider how you discover in real-time, beyond the network and in remote and mobile situations Once you discover, take a moment and resist the urge to blacklist apps. You’ll find that many of these apps are actually considered business critical today. We’ll talk about what that means in step 7
- #11 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware
- #14 Step 3: With all the information you’ve gathered, you can start to come up with a plan and start making decisions.
- #15 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware
- #16 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware
- #18 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware
- #19 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware
- #20 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware
- #22 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware
- #24 Here’s the real face of shadow IT. A lot of the time it’s not at all sinister. They’re people like you and me, getting their jobs done and trying to do a better job of that all the time. And for IT, let’s just face it. It’s just a risk that has gone unmanaged and for quite some time now. So let’s do something about it… But during that, let’s remember not to repeat the heavy-handed sins of the past instead, remember a simple mantra <click>
- #26 Firewalls Intrusion Prevention System Secure Web Gateways Data Loss Prevention Anti-Malware