Skyhigh Cloud Security Part 1: Let there be light

I believe we all agree cloud adoption grows exponentially at 2015. We can agree almost every businesses using cloud services – as a service in any form. Yet still the number one CIO’s concern for cloud adoption is security according to various researchers and surveys.

If the security is the number one concern of cloud adoption, what about the cloud usage inside enterprise without CIO’s knowledge let alone approved by IT. According to McAfee and Skyhigh, 80% of workers admit using cloud services at work without IT’s approval. This is what we call Shadow IT. The cloud usage of Shadow IT is 10 times the size of approved cloud usage. In many cases the average company uses more than 1000 cloud services in total (1089 average cloud services based on PwC and Skyhigh Network 2015 Q2 survey). The Shadow IT introduces security & privacy (data leakage and breaches through the high-risk use of low risk services), compliance, audit  and legal risks especially if you are bound with regulatory standards.

Cloud services provide uniquely different threat vectors which enterprises need to be able to address below problems:

• The “What’s my exposure” problem
• The “Who has access” problem
• The “Where’s my data” problem
• The “How do I know” problem
• The “Why Have I been breached” problem

The question is: How IT can be the service broker and enabler while at the same time secure the information and reduce the risks ? The answer is: ” Let there be light !” Bring the Shadow IT to the light and separate the light from the darkness, separate the services which help the business to grow from the services that might cause harm to your business.

Skyhigh network can address our problems by discovery, analysis and control of cloud services usage inside our environment. There are three main features of Skyhigh:

1. Discovery
   Skyhigh rapid discovery capability can be achieved by ingesting logs from firewall, proxy and SIEM systems with optional corp Active Directory integration (LDAP). This will provide information of cloud services being used by corp employees,  provide the risks assessment and enable the services with industry best practices
2. Analysis
   Skyhigh will build statistical and behavioural models based on users, devices, services and data interactions in order to expose inconsistencies of our firewalls and proxies policy enforcement, identify overlapping services to help with service consolidation, detect anomalies that may indicate of security breach and data leaks.
3. Control
   Access Control to the cloud services based on contextual policies and protect data at rest by encrypting data with keys reside at inside our network.

Diagram below illustrates Skyhigh for Shadow IT conceptual solution design:

The information at Skyhigh is tokenized with salt and hash and never detokenized by Skyhigh. The keys reside inside our network and we manage where to store and we have full control for the data.

Next post we will discuss further details on Skyhigh solution.