27
SonicWall ® Cloud App Security (Shadow IT) User Guide

Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

  • Upload
    others

  • View
    2

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

SonicWall® Cloud App Security (Shadow IT)User Guide

Page 2: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

SonicWall Cloud App Security (Shadow IT) User Guide

Contents

1

2

About SonicWall Cloud App Security (Shadow IT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Using Cloud App Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Understanding Risk Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Classifying Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Browser Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

MySonicWall Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Firewall Types and Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Licensing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Configuring SonicOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Launching Cloud App Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Using the Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Risk Posture charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Cloud Apps Used chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Users/IPs chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Traffic chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Using the Dashboard charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Top Applications charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Top Applications By Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Top Applications By User/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Top Applications By Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Top Users charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Top Users/IPs By Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Top Users by App . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Top Users/IPs By Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

App Locations map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Using the Discovery View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Applications tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Filtering the Applications list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Displaying All of the Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Displaying Applications by Date Used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Viewing Cloud Application Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Classifying Cloud Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Controlling Access to Cloud Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

User Activities tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Displaying Users by Date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Viewing User Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

SonicWall Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Contents

Page 3: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

1

About SonicWall Cloud App Security(Shadow IT)

SonicWall® Cloud App Security (Shadow IT) is a cloud-based security service that enables organizations to monitor and manage cloud application usage and reduce the risk of shadow IT. Delivered through SonicWall Capture Security Center, Cloud App Security (Shadow IT) is a critical part of the Capture Cloud platform and seamlessly integrates with your existing SonicWall infrastructure. The solution provides CASB-like functionality, delivering real-time visibility and control of cloud application usage.

A comprehensive dashboard enables administrators to monitor usage of risky applications, track user activity, and set block and unblocked policies on sanctioned and unsanctioned applications. The solution ensures safe adoption of cloud-based applications without impacting employee productivity at a low total cost of ownership.

SonicWall Cloud App Security (Shadow IT) User Guide

About SonicWall Cloud App Security (Shadow IT)3

Page 4: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

The key features of SonicWall Cloud App Security (Shadow IT) include:

• Shadow IT discovery – Leverage existing firewall logs to automate cloud discovery to identify applications being used and their risk posture.

• Real-time application visibility – Monitor usage in real-time with an intuitive dashboard view that provides details of applications being used, traffic volume, user activity and location of use.

• Application classification and control – Set policies for unmanaged cloud applications based on an application risk score derived from regulations, security certifications and reputation databases to classify as sanctioned (approved by IT) or unsanctioned (allowed, but not approved by IT) applications.

SonicWall Cloud App Security (Shadow IT) provides you with two views into your cloud application environment:

• Dashboard – real-time views of the number and categories of cloud applications being used, number of users accessing cloud applications, and the amount of data traffic used by cloud applications

• Discovery – details about both the cloud applications and the users who accessed them within your organization

Topics:

• Using Cloud App Security

• System Requirements

• Launching Cloud App Security

Using Cloud App SecuritySonicWall Cloud App Security (Shadow IT) delivers real-time visibility and control of cloud application usage. A comprehensive dashboard enables administrators to discover usage of risky applications, track user activity, and set blocked and unblocked policies on sanctioned and unsanctioned applications to protect sensitive data.

Using SonicWall Cloud App Security (Shadow IT), you can:

1 Discover which cloud applications are being accessed by users in your organization and understand the risks associated with those applications.

2 Classify those applications as being Sanctioned or Unsanctioned.

3 Control which cloud applications users can access by setting policies to block or unblock them.

4 Monitor the usage of those cloud applications, such as the amount of data uploaded to and downloaded from them, and identify the users who access them.

SonicWall Cloud App Security (Shadow IT) User Guide

About SonicWall Cloud App Security (Shadow IT)4

Page 5: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Topics:

• Understanding Risk Levels

• Classifying Applications

Understanding Risk LevelsSonicWall Cloud App Security (Shadow IT) assigns one of these Risk Levels to each cloud application:

The Risk Level of a cloud application is determined based on several factors, including its:

• adherence to security standards, such as Identity and Access Control, Data Confidentiality and Leak Prevention, and Threat and Vulnerability Management.

• compliance with established security certifications, such as FISMA, HIPAA, Safe Harbor, and SOC.

You can view the details of the risk assessment of a cloud application by viewing its App Profile in the Discovery view.

Classifying ApplicationsCloud applications can be classified as:

In addition to being classified, access to cloud applications can also be blocked.

System RequirementsYour security infrastructure must meet certain minimum requirements:

• Browser Levels

• MySonicWall Account

• Firewall Types and Firmware

• Licensing Requirements

• Configuring SonicOS

Risk Level Icon

Low Risk

Medium Risk

High Risk

Classification Icon Description

Sanctioned Approved by your IT organization

Unsanctioned Allowed, but not approved by your IT organization

Unclassified This is the default classification for all cloud applications.

SonicWall Cloud App Security (Shadow IT) User Guide

About SonicWall Cloud App Security (Shadow IT)5

Page 6: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Browser LevelsSince SonicWall Cloud App Security (Shadow IT) is a cloud service, you only need access to a web browser and an Internet connection to access the Capture Security Center. The following browser levels are supported:

MySonicWall AccountTo login into the Capture Security Center and access SonicWall Cloud App Security (Shadow IT):

• You must have an active MySonicWall account.

• You account must be associated with specialized cloud access.

Firewall Types and FirmwareTo effectively manage the network security appliances with Analytics Services or Management Services from the Capture Security Center, the appliances in the environment need to meet the following requirements:

• The firewalls can be an NSA, TZ or NSv series device.

• Each firewall needs to be licensed with either the Comprehensive Gateway Security Suite (CGSS) or Advanced Gateway Security Suite (AGSS).

• The firewalls in the configuration must not be associated with Cloud GMS 1.0.

• The firewalls in the configuration must be a part of a group.

• Each firewall must have a HTTPS management port enabled.

• The firewalls must be running SonicOS firmware version 6.5.1.1 42n or later..

Licensing RequirementsSonicWall Cloud App Security (Shadow IT) (CAS) 1.0 is bundled with Capture Security Center (CSC) Analytics. Only users with CSC Analytics licenses can access the SonicWall Cloud App Security (Shadow IT) service. There is no separate license for SonicWall Cloud App Security (Shadow IT).

Configuring SonicOSYou need to configure your firewall in order to view the data about the cloud applications being monitored.

To configure SonicOS for SonicWall Cloud App Security (Shadow IT):

1 Navigate to the MANAGE page.

2 Navigate to Security Services > Content Filter.

Browser Supported Notes

Google Chrome (latest version) This is the preferred browser for real-time graphics display on the Dashboard.

Apple Safari (latest version)

Internet Explorer 11 Do not use compatibility mode.

Mozilla Firefox (latest version)

IMPORTANT: If a firewall is behind a NAT device, then the firewall must have a HTTPS management port enabled and opened for the cloud services to communicate with the firewall.

SonicWall Cloud App Security (Shadow IT) User Guide

About SonicWall Cloud App Security (Shadow IT)6

Page 7: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

3 In the Global Settings section, make sure that these options are selected:

• Enable Content Filtering Service

• Enable HTTPS Content Filtering

4 Click ACCEPT.

5 Navigate to Policies > Objects > Content Filter Objects.

6 Click CFS Action Objects.

7 Click the Edit icon for the CFS Default Action.

8 In the CFS Action Object section, make sure that Enable Flow Reporting is selected.

9 Click OK.

Launching Cloud App Security1 Navigate to cloud.sonicwall.com.

2 Login with your MySonicWall credentials to get to the Capture Security Center.

3 Click the CAS tile to start SonicWall Cloud App Security (Shadow IT).

4 Follow the instructions provided in this guide on how to configure and use SonicWall Cloud App Security (Shadow IT).

SonicWall products must be registered on MySonicWall to enable full functionality and the benefits of SonicWall software updates and technical support. Log in or register for a MySonicWall account at https://mysonicwall.com.

NOTE: It may take up to 30 minutes for data to be visible in the Cloud App Security (Shadow IT) Dashboard. If data is not being displayed after that time, verify that the settings on your firewall are properly configured.

SonicWall Cloud App Security (Shadow IT) User Guide

About SonicWall Cloud App Security (Shadow IT)7

Page 8: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

2

Using the Dashboard

The Dashboard displays real-time views of:

• number and type of cloud applications being used, highlighting those with a High

• number of users accessing cloud applications, highlighting those at High, Medium, and Low Risk

• amount of data traffic being used by cloud applications, highlighting those at High, Medium, and Low Risk

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard8

Page 9: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

The Dashboard displays information in summary charts for the:

• Risk Posture

• Top Applications

• Top Users/IPs

The Dashboard displays information for only one network security appliance at a time. Select the network security appliance for which you want to view the cloud application information by selecting it from the drop-down list at the top left of the Dashboard.

Click the Reload icon on the top right of the Dashboard to refresh the information being displayed.

Risk Posture chartsThe Risk Posture charts display a summary of the current Risk Levels for your organization for:

• Total Apps Used

• Total Users/IPs

• Total Traffic

The top bar of the Dashboard shows you the current total counts for these important metrics.

• Total Apps: total number of cloud applications accessed

• High Risk Apps: total number of cloud applications accessed with a High Risk Level

• Total Users/IPs: total number of current users (User Activities tab on the Discovery View)

• Total Traffic: cloud applications accessed sorted by the total traffic (Applications tab on the Discovery View)

Click on the label or the count next to it to view the details associated with that total count.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard9

Page 10: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Cloud Apps Used chartThe Cloud Apps Used chart displays the number of cloud applications accessed during the past 30 days, highlighting those with Risk Levels of High Risk, Medium Risk, and Low Risk.

Hover over individual points in the charts to see the number of cloud applications used at each Risk Level. (See Understanding Risk Levels for information about how Risk Levels are determined.)

Users/IPs chartThe Users/IPs chart displays the number of users accessing cloud applications during the past 30 days, highlighting those with Risk Levels of High Risk, Medium Risk, and Low Risk. (See Understanding Risk Levels for information about how Risk Levels are determined.)

Hover over individual points in the charts to see the number of users accessing cloud applications, tracked by Risk Level, at those specific points in time.

Traffic chartThe Traffic chart displays the amount of data traffic sent and received from the cloud applications during the past 30 days.

Hover over individual points in the charts to see the amount of data traffic sent and received from the cloud applications, tracked by Risk Level, at those specific points in time. (See Understanding Risk Levels for information about how Risk Levels are determined.)

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard10

Page 11: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Using the Dashboard chartsThe Dashboard charts display information about various aspects of cloud application usage and user traffic of those applications. You can view additional details by hovering the cursor over sections of the charts.

• Hover over the icon to see the name of the cloud application.

• Hover over the icon to see the name associated with the Risk Levels of the cloud application.

See Understanding Risk Levels for information about how Risk Levels are determined.

• Hover over the icon to see how the cloud application has been classified (Sanctioned, Unsanctioned, or Unclassified).

See Classifying Applications for information about you can classify cloud applications.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard11

Page 12: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

• Hover over a section of the circular chart to see the detail for that item (the color matches the colored square next to the item in the list on the left).

• Hover over the user or IP address to see the application usage for that user.

Top Applications chartsThe Top Applications charts list the most accessed cloud applications:

• Top Applications By Traffic

• Top Applications By User/IP

• Top Applications By Usage

Top Applications By TrafficTop Applications By Traffic lists the top ten cloud applications ranked by the amount of data traffic sent and received from those cloud applications during the past 7 days.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard12

Page 13: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Top Applications By User/IPThe Top Applications By User/IP chart displays the top cloud applications ranked by the number of users who accessed cloud applications during the past 7 days.

Top Applications By UsageThe Top Applications By Usage chart displays the top cloud applications ranked by the number of times they were accessed during the past 7 days.

Top Users chartsThe Top Users charts list the top users:

• Top Users/IPs By Traffic

• Top Users by App

• Top Users/IPs By Usage

Top Users/IPs By TrafficThe Top Users/IPs By Traffic chart displays the top users of cloud applications ranked about the amount of traffic they used during the past 7 days.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard13

Page 14: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Top Users by AppThe Top Users by App chart displays the top cloud applications ranked by the number of users who accessed the cloud applications during the past 7 days.

Top Users/IPs By UsageThe Top Users/IPs By Usage chart display the top users of cloud applications ranked by the number of times they accessed the discovered cloud applications during the past 7 days.

App Locations mapThe App Locations map displays the locations from where the cloud applications were accessed. Hover over the location dot to see the name of the application and more precise location.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard14

Page 15: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

You can also filter the results to only display the locations of cloud applications within a specific category by selecting it from the drop-down list on the upper right.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Dashboard15

Page 16: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

3

Using the Discovery View

Use the Discovery view to learn about the details of the cloud applications used within your organization.

The Discovery view contains two tabs:

• Applications tab

• User Activities tab

You can use the back arrow icon next to Discovery at the top of the view to return to the Dashboard view as an alternative to clicking on Dashboard in the left navigation pane.

You should use this icon to return to the Dashboard rather than using the Back button on your browser.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View16

Page 17: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Applications tab

The Applications tab displays:

• Application: the name of the cloud application. Expand this by clicking on the arrow to the left of the name to view:

• App Profile: a breakdown of the cloud application, listing its organization profile, its adherence to secure practices and standards, and compliance certifications.

• User List: IP addresses of the users who have accessed the application, how much data was uploaded to and downloaded from the application.

• Risk Score: computed based off the adherence of the cloud application to secure practices, standards, and compliance certifications. The points are based on the weight assigned to each attribute of adherence, and its importance and relevance to the associated category risk. Hover over the icon and value to see the Risk Level (Low Risk, Medium Risk, or High Risk). (See Understanding Risk Levels for information about how Risk Levels are determined.)

• User/IP: number of users (by IP address) who have accessed the application. Hover over the number to see a list of IP addresses associated with those users.

• Transactions: number of transactions performed with the application

• Data Uploaded: amount of data uploaded to the application

• Data Downloaded: amount of data downloaded from the application

• Classification: the classification of the application: Unclassified, Sanctioned, or Unsanctioned. By default, all cloud applications are classified as Unclassified, allowing you to classify the cloud applications based on the requirements of your organization.

• Control: whether the application is Blocked or Unblocked (this is the default)

By default, only 10 applications are listed at a time on the Applications tab. You can view more applications at one time by selecting a different value from the drop-down list at the bottom left of the table.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View17

Page 18: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Filtering the Applications listClick the Filter icon on the far left of the Applications tab toolbar to customize what is displayed on the Applications tab.

You can:

• In the Application section:

• Search for a specific applications by entering part or all of their names

• Select a specific y of applications

• Select a specific Risk Level: High, Medium, or Low. (The name to the right shows how many applications have been assigned that Risk Level.)

• Select a specific Classification: Sanctioned, Unsanctioned, or Unclassified.

• Select a specific Control setting: Blocked or Unblocked.

The number in blue to the right of the filter option displays the number of items that would be displayed if that filter option is selected.

Once selected, the filter option you selected takes effect immediately.

To reset all of the filter settings:

1 Click the Reset filters icon located second from the right on the Applications tab toolbar.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View18

Page 19: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Displaying All of the ApplicationsBy default, only the cloud applications accessed during the past 7 days are listed in the table. To view a list of all discovered cloud applications, uncheck the Recently accessed apps checkbox. The complete list of all applications available in the cloud application registry will be displayed.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View19

Page 20: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Displaying Applications by Date UsedBy default, the cloud applications accessed on current date are listed. You can select an earlier date within the past 30 days by using the slider to entering a specific Custom date.

To view the cloud applications accessed on a date within the last 30 days:

1 Slide the date slider next to the Recently accessed apps checkbox to the left. The list of cloud applications will update to display the cloud applications accessed on that date.

To view the cloud applications accessed on a specific date:

1 Select the Custom button.

2 Select a date from the displayed Calendar. The list of cloud applications will update to display the cloud applications accessed on that date.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View20

Page 21: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Viewing Cloud Application DetailsTo view the details of a cloud application, click the arrow to the left of the name of icon and name of the application.

Classifying Cloud ApplicationsCloud applications can be classified as:

• Sanctioned

• Unsanctioned

• Unclassified (this is the default)

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View21

Page 22: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

To classify cloud applications:

1 Select the cloud applications that you want to classify by selecting the checkbox to the left of the application name.

2 Click the icon in the right section of the Applications tab toolbar for the classification you want to assign to the application. The classification will be assigned to the selected applications and their Classification updated in the list.

Controlling Access to Cloud ApplicationsAccess to cloud applications can be:

• Blocked

• Unblocked (this is the default)

To control Access to Cloud Applications:

1 Select the cloud applications that you want to set the control status by selecting the checkbox to the left of the application name.

2 Click the icon in the right section of the Applications tab toolbar to set the control status for the applications. The control level will be assigned to the selected applications and their Control status updated in the list.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View22

Page 23: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

User Activities tabThe User Activities tab displays:

• User/IP: User ID or IP address of the user who accessed a cloud application. Hover over the number to see the User ID associated with that user. Expand this by clicking on the arrow to the left of the IP address to view additional information about the cloud applications that the user has accessed.

• Activity: the number of applications accessed by the user.

• Applications: the cloud applications that were accessed by that user. Hover over the icon to see the name of the application.

• Transactions: the total number of transactions performed with all of the cloud applications accessed by the user.

• Data Uploaded: the total amount of data uploaded to all of the cloud applications accessed by the user.

• Data Downloaded: the total amount of data downloaded from all of the cloud applications accessed by the user.

By default, the users are listed based on their successful access of the cloud applications.

To view a list of users who attempted to access cloud applications:

1 Select Attempted on the left of the User Activities toolbar. The list of users will update to display users who attempted to access cloud applications.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View23

Page 24: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

Displaying Users by DateBy default, the users are listed for the current date. You can select an earlier date within the past 7 days by using the slider or by entering a specific Custom date.

To view the list of users on a date within the last 7 days:

1 Slide the date slider next to the Recently accessed apps checkbox to the left. The list of users will update to display the users who accessed cloud applications on that date.

To view the list of users on a specific date:

1 Select the Custom button.

2 Select a date from the displayed Calendar. The list of users will update to display the users who accessed cloud applications on that date.

Viewing User DetailsTo view the list of cloud applications that a user has accessed, as well as additional information about those applications, click on the arrow to the left of the IP address of the user. A list of the ten cloud applications most recently accessed by that user is displayed. You can use the scroll bar at the bottom right to view additional applications.

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View24

Page 25: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

For each application, this information is displayed:

• Application: the icon and name of the application accessed by that user. Click on the icon or name of the cloud application to view details about the application. (See Viewing Cloud Application Details for information on viewing the detailed information for the cloud applications.)

• Category: the category for the cloud application accessed by that user

• Risk Score: computed based off the adherence of the cloud application to secure practices, standards, and compliance certifications. The points are based on the weight assigned to each attribute of adherence, and its importance and relevance to the associated risk category. Hover over the icon and value to see the Risk Level (Low Risk, Medium Risk, or High Risk). (See Understanding Risk Levels for information about how Risk Levels are determined.)

• Transactions: number of transactions performed with the cloud application

• Data Uploaded: amount of data uploaded to the cloud application

• Data Downloaded: amount of data downloaded from the cloud application

SonicWall Cloud App Security (Shadow IT) User Guide

Using the Discovery View25

Page 26: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

4

SonicWall Support

Technical support is available to customers who have purchased SonicWall products with a valid maintenance contract and to customers who have trial versions.

The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. To access the Support Portal, go to https://www.sonicwall.com/support.

The Support Portal enables you to:

• View knowledge base articles and technical documentation

• View video tutorials

• Access MySonicWall

• Learn about SonicWall professional services

• Review SonicWall Support services and warranty information

• Register for training and certification

• Request technical support or customer service

To contact SonicWall Support, visit https://www.sonicwall.com/support/contact-support.

SonicWall Cloud App Security (Shadow IT) User Guide

SonicWall Support26

Page 27: Cloud App Security (Shadow IT) User Guide · 2020. 9. 14. · Using SonicWall Cloud App Security (Shadow IT), you can: 1 Discover which cloud applications are being accessed by users

About This Document

SonicWall Cloud App Security (Shadow IT) User GuideUpdated - April 2019Software Version - 1.0232-004700-00 Rev A

Copyright © 2018 SonicWall Inc. All rights reserved.

SonicWall is a trademark or registered trademark of SonicWall Inc. and/or its affiliates in the U.S.A. and/or other countries. All other trademarks and registered trademarks are property of their respective owners

The information in this document is provided in connection with SonicWall Inc. and/or its affiliates’ products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of SonicWall products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, SONICWALL AND/OR ITS AFFILIATES ASSUME NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON- INFRINGEMENT. IN NO EVENT SHALL SONICWALL AND/OR ITS AFFILIATES BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF SONICWALL AND/OR ITS AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SonicWall and/or its affiliates make no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. SonicWall Inc. and/or its affiliates do not make any commitment to update the information contained in this document.

For more information, visit https://www.sonicwall.com/legal.

End User Product Agreement

To view the SonicWall End User Product Agreement, go to: https://www.sonicwall.com/en-us/legal/license-agreements.

Open Source Code

SonicWall is able to provide a machine-readable copy of open source code with restrictive licenses such as GPL, LGPL, AGPL when applicable per license requirements. To obtain a complete machine-readable copy, send your written requests, along with certified check or money order in the amount of USD 25.00 payable to “SonicWall Inc.”, to:

General Public License Source Code Request SonicWall Inc. Attn: Jennifer Anderson1033 McCarthy BlvdMilpitas, CA 95035

Legend

WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death.

CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed.

IMPORTANT, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information.

SonicWall Cloud App Security (Shadow IT) User Guide

SonicWall Support27