Embed Size (px)
DESCRIPTION
Shadow IT is often used in a derogatory manner, but what if the apps and services a company's employees are bringing into the enterprise were actually the secret to their success? What if the efficiency and productivity gains your company is experiencing are owed, in part, to these apps that IT isn't responsible for sourcing and enabling? In this presentation Netskope discusses the challenges and opportunities that come from the use of rogue apps in the enterprise and how IT can turn the corner and end the catch-22 between enablement and security.
Citation preview
Making Shadow IT Work
Dear ,
I love you, I hate you.
Regards,The CIO
CLOUD CAGR FOR ‘13-’17 WILL BE 5XOF IT INDUSTRY AS A WHOLE
ORGANIZATIONS ARE PUTTING THECLOUD TO WORK FOR BUSINESS
Who?
What?
When?
with Whom?
unsanctioned CLOUD APPS 72%
* OneLogin Survey 2012
of people admit to using
of CLOUD APPS don’t make the grade
75% Cloud App
Cloud App
Cloud App
Cloud App
REPORT CARD
* Netskope Research, Adapted from CSA’s Cloud Controls Matrix
Evaluating Apps on Objective Criteria
• Measure of a cloud app’s enterprise-readiness• Based on the app’s security, auditability, and
business continuity• Based on 30+ objective criteria adapted from the
Cloud Security Alliance
EXCELLENT HIGH MEDIUM LOW POOR
* Netskope Research, Adapted from CSA’s Cloud Controls Matrix
1%
22%34%16%27%
EXCELLENT
HIGH
MEDIUM
LOW
POOR
* Netskope Research, Adapted from CSA’s Cloud Controls Matrix
* Netskope Research, Adapted from CSA’s Cloud Controls Matrix
Reasons Apps Do Well and Fall Short
* Netskope Research, Adapted from CSA’s Cloud Controls Matrix
* Netskope Research, Adapted from CSA’s Cloud Controls Matrix
Example: User and Admin Audit• Admin audit logs• Change/upgrade notifications• Data access logs• Infrastructure status reports• User audit logs
Example: Certifications and Compliance• Compliance certifications– HIPAA– PCIDSS– etc.
• Datacenter certifications– SOC-1, -2– ISO27001– etc.
Key Capabilities• Audit and alert capabilities• Certifications and compliance• Data classification capabilities• Disaster recovery and business continuity• Encryption• File sharing• Policy enforcement and access control
April 14, 202317
10%
90%
Most Organizations Underestimate
Cloud App Usage by 90%
CLOUD HAS CREATED A BLIND SPOT
The average number of security
While the percent of people stating they “don’t know”
Source: PwC
In the past 2 years…
if they’ve had a security breach increased 100%
incidents has risen 25%
The Multiplier Effect of a Cloud Breach
3.3 devices perknowledge worker
50% of people share content via unapproved cloud services
90% of organizationsthat lost sensitivecontent via file sharing
5 out of top 10 data breaches involved cloud
?Source: Cisco Source: Ponemon
Source: CRNSource: Ponemon
0100011 110 01 1
1010
Cost of a data breach:
$5.4 million
Source: Ponemon
• Remediation costs• Brand and reputation impact• Loss of intellectual property• Fines for non-compliance• Cost and time for reporting and prevention
Yet, people love their cloud apps, and for good
reasonAnywhere Access CollaborationProductivity
CAN’T COMPLY WITH SOX, ETC.
• Public biosciences co. would like to embrace cloud, but doesn’t know what services are running
• Can’t evaluate new services
• Can’t attest to access/auth usage for SOX and other regs, e.g., HIPAA
POTENTIAL DATA LEAKAGE
• Large media firm discovered a dozen cloud storage apps, plus others in which data could be shared
• IT must see what sensitive data are being uploaded
• Then, see whether data are being shared, and with whom
POST-EVENT FORENSICS
• High tech company suspects theft of proprietary documents by a departing employee
• IT must construct audit trail, showing user download from corporate account and subsequent upload to and share from personal account
DISCOVER APPS & EVALUATE RISK
• Discover all apps, known or not• Objectively evaluate apps’
enterprise-readiness • Score apps on security,
auditability, and business continuity
ANALYZE USAGE
• Discover who’s using what apps, from where, and on what device
• See what class of data are being uploaded, downloaded, shared
• See with whom data are shared
LIMIT ACTIVITIES VS. BLOCK APPS
• Rather than block an app, limit usage (e.g., don’t share with people outside of the company)
• Use context such as user, location, device, data class, and user activity
VERIFY AND THEN TRUST
• Create risk model of scenarios involving user, app, data, activity, and other contextual factors
• Set watch lists on scenarios that represent the most risk
CONSIDER CONTEXT IN EVERYTHING YOU
DO• Consider contextual factors when
shining a light on shadow IT, running analytics and setting policies
• Think about user, group, location, time, device, OS, app, and app score
1. DISCOVER cloud apps and evaluate risk2. Analyze USAGE3. LIMIT activities vs. blocking apps4. VERIFY and then trust5. Consider CONTEXT in everything you do
THANK YOU
