Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment mode
-
Upload
himani-singh -
Category
Technology
-
view
359 -
download
3
Transcript of Cloud security, Cloud security Access broker, CSAB's 4 pillar, deployment mode
Device to cloud:Cloud security,Cloud Security Access Brokers, CASB’s four pillars, deployment mode comparisonHimani Singh
Sept 2016
Agenda• An overview of cloud ecosystem • Security in the cloud• Cloud security solutions• What is CASB
• CASB’s responsibility and use cases• Deployment modes• Benefit of deployment mode
• Cloud glossary
An overview of cloud ecosystem
• The cloud is a metaphor for the internet, It can simply be defined as the distributed infrastructure that is made up with bare metal, virtual machines, storage, network and is always available
• Cloud computing refers to applications, services or IT resources delivered from the cloud (via internet) with pay-as-you-go model
XaaS
DaaS
IaaS
PaaS
SaaS
BaaSUcaaS
DRaaS
ITMaaS
Cloud layers• Infrastructure as a Service (IaaS)
• When you want to host• Hardware, network resources as service• Dynamic scaling, virtualization • Multiple users with single piece of hardware• Examples: AWS, Azure, Rack space
• Platform as a Service (PaaS)• When you want to build• Develop, test, deploy, host and maintain applications• Multi-tenant architecture, include load balancer and failover• Heroku, Google App Engine, IBM Red Hat’s OpenShift, Salesforce
as a cloud • Software as a Service
• When you want to consume • Pay-as-you-go, APIs • User don’t do patch management• Box, O365, Salesforce, Google apps
Business & Technical Serv
Data
Runtimes
Middleware
Database
Operating System
Virtualization
Servers
Application
Storage
Networking
On-premise
Software as a Service
Platform as a Service
Infrastructure as a Service
Devices
People
Types of cloud Private, public, community and hybrid • Public cloud
• SaaS, PaaS and IaaS is delivered by the external vendor • Multiple unknown user s• No visibility about the user and Multi tenancy • Example – Box, O365 email
• Private cloud• Dedicated to only one organization( not shared with other organizations)• More expensive and more secure in comparison of public clouds
• On-premise private clouds, those are exclusively used by one organization on the premises. For example AWS hosting the cloud for any military organization.
• Externally hosted private clouds. This is hosted by a third party in cloud infrastructure for one organization.
• Hybrid cloud • Some critical part of data is hosted in the organization and some are hosted in public. In most of the cased, there will be tunnel or
connection between public and private cloud.• Community cloud
• A form of public cloud that is reserved for the member of community• Multi tenancy • Example all government in state using the same cloud
What about security control points ?
With IT, HR, Productivity software, infrastructure, build platforms moving to or delivering through the cloud, Security Control Points (SCPs) are distributed in the cloud. In this case, when SCP’s are not on perimeter, the traditional security devices such as IPS, NGFW, SWGs’ are inadequate.
Cloud Security is a perfect storm
Security in the cloud is in perfect storm• CISO/ISO concerns
• How to apply security controls on a highly distributed environment ?• Need unified view of application, type of traffic, action, resource and data usage over multiple clouds
such as Salesforce for CRM, Microsoft 365, workday • How to apply access control and data protection to the resources stored in the cloud ? Although Cloud
Service providers(CSP) may provide some security majors but it is your organization’s reputation.• Maintain Compliance and Governance of the data • Threat protection that SaaS vendor can’t provide such as account hijacking..• How to track the compute and storage uses for organizations over Microsoft Azure or and Amazon Web
Services?• Breach detection, needs aggregated view of all SaaS, PaaS and IaaS
cloud data protection Cloud Data Governance
cloud access policy and intelligence
Cloud workload Security audit and Management
Cloud Security solutions: cloud data protection
• Sensitive Data protection• Largest of any security category • Protection of employee and customer PII and intellectual property • Encryption/Decryption for sensitive data • Key management outside the cloud service provider • Protection when Data-in-transit( from Device to cloud) Data-at-rest ( in
cloud or at device)• Protect all data type, structured and unstructured
• Vendors • CipherCloud, CloudLock(Cisco), Perspecsys(Bluecoat), Vaultive, Netskope
Cloud Security Solutions: Cloud Data Governance
• Cloud data governance• Compliance • Regulations• HIPPA • Policy
• Companies: CloudLock (Cisco), Better Cloud, JumpCloud
Cloud security solutions: cloud access policy and intelligence • Cloud access policy and intelligence
• Who can access the data in cloud • What device, frequency and quantity of the data • Build the good behavior • Detect the anomaly with the variation from the good behavior.
• Companies : Adallom(Microsoft) , Skyfence, Elastica ( Bluecoat), Netskope, Threatstack
Cloud security solutions : cloud workload security audit and monitoring
• IaaS protection solution • Works on AWS, Azure or rack space• Malware protection, IDS, IPS, FW, virtualization support, File integrity monitoring
and log management• This is an emerging category• Vendors can either support (1) Cloud only solution that security workload in IaaS
and PaaS, Analyze the access and security logs and (2) Securing, analysis the on-premises solution virtualization and bare-metal
• Companies • HyTrust, Trend Micro, Illumio, Dome9, Symantec , FortyCloud, Palerra, Cloud Passage
Cloud Security Access Broker (CASB) Cloud access security brokers (CASBs) are a software (and technology ) that provide the cloud-based security control points that provides the visibility, access control, security intelligence, and protection for cloud based resources and users.CASB can be inline( that is, between cloud resource and consumer) or can be out-of-the band (API based)CASB vendors ensure the secure access to recourse from any device (corporate, private, managed, unmanaged), any location( office, home, airport), for any user (admin, non-admin) to any resource ( file, db) in any cloud-app(box, O365)..
The need for CASB
• With highly distributed IT Infrastructure, when everything is derived as service, CEO/CISO/CIO needs the cloud-based security-policy enforcement points (SPEPs)
• CASBs address three out of four main cloud security concerns • Cloud data protection • Cloud data Governance • Cloud access policy and intelligence
• By using all security intelligence, Also provide • Visibility• Threat protection• Breach detection • User behavior analytic
CASB conceptual overview
Corporate office, Servers, desktop, mobile phone and tablet
Unmanaged mobile or personal devices Remote users
IaaSAWS, Azure, Soft layer
PaaSOracle cloud, Google API,
Bluemix
SaaSBox, workday,
O365 salesforce
CASBVisibility Data Protection
Continuous Monitoring
Data Governance Compliance
Threat Protection
FW or SWG Proxy
CASB Technology overview-visibility • Visibility
• Organizations are suffering from unsanctioned app(shadow IT) used in the organization. Visibility is one way to look inside your network.
• CASB gives the detailed view of organization’s traffic as six W’s :• Which user, • What device(mac, mobile, chrome book), • Which app(box, one drive), • When (time),• What activity ( view, download),• What resource (file)
• Visibility is achieved by either logs from NGFW/web proxies(web sense, Bluecoat) or all traffic passing through CASB.
CASB
NGFWWeb proxies
LDAP, Enterprise integratio
n
Internet
CASB technology overview – visibilityA dashboard will provide the graphic and searchable view of following-
• Unsanctioned and sanctioned app list• Application risk-based-score • Single User behavior over multiple cloud apps and single app with multiple users• Pass through traffic and policy based alerts• API based logs
These logs can be used for defining the baseline for entity(user, app, devise)behavior.Application risk-based-score • Many CASB vendor calculate the risk-score for an application( or an vendor)• Risk is calculated the risk on many data points such as CAS, who owns the data, review
Service Organization controls (SOC ) reports, research, CSA Trust, Physical data center location
• CASB vendors use this data-points and put in complex matrix to calculate the App-risk score
CASB technology overview – Data protection • Cloud services make it easy to inappropriately( intentionally or by mistake) share
the data• CASB offers the Data protection on file, field or object level based on the policy• Following are the technique used for data protection
• Data loss protection• Encryption/decryption• Tokenization• DRM
• Cover all grounds in policy ( can be very complex polices)• User centric – user, location, user action(share, view, download ), application,• Device centric- device, native client vs browser, managed or unmanaged device • Data centric -type of data, time, app, data-at-rest or data-at-move,
CASB technology overview – Data protection use case• Data loss prevention(DLP)
• Both unstructured data and structured data should be searched • Pattern matches are done either
• Inline when data is flowing through the CASB• Through APIs when data is at rest
• Many methods to match content• Regular expression evaluation • Pre-defined library for PII, CC, SSN, medical conditions and more• Document fingerprinting• Keyword matching • Directory match
• Action after policy match• Action can be encryption, block, contain, quarantine, watermark, DRM, block user, compress with
password or alert
CASB technology overview – Data protection use case• Enterprise data could be tagged as “ top confidential”
• If CASB vendor can read the tag, policies can be configured as data can’t be stored without encryption or can’t be copied or can’t be shared
CASB technology overview – Data protection – Encryption and tokenization • Encryption
• File level• Protect data at rest ( cloud or mobile device)• Encryption done when data is upload and decrypt when downloaded.• Keys can be managed by third party or CASB itself• Same keys can be used for multiple cloud
• Tokenization• Field level data obfuscation • Fields in the can be replace by the some random data ( or with some pattern
depending on Tokenization scheme)• Token is stored in token vault, and it is retrieve to read the data
CASB technology overview – compliance and data Governance • Compliance and Governance is when external legislation and internal
rules are applied from. Example are following• Some data can’t leave the regional boundary, such as EULA• Regulations like PCI, HIPPA • Most CASB vendors will provide the DB of attributes tracked for a cloud
service, the attributes may be • The number of attribute tracked for each cloud application • Encryption strength• Two-factor authentication• A cloud risk scoring system• Detailed auditing that have five W’s (who, when, what, where, why)
CASB technology overview – Threat Protection• Malware has new playground in cloud • Since CABSs are “single point of control “ in cloud, it has an added responsibility to
detect and prevent the threat.• Threat detection included scanning of traffic and checking the IP, URL, location,
files, hash of the files against the know-bad-database.• Once threat is detected, the object can be blocked, quarantined or send an alert
• Block traffic based on geo-locations• On the application level
• Account hijacking• Stale accounts• Selective wipe
CASB technology overview – Threat Protection • User behavior analysis on multiple clouds
• One user login at saleforce.com from San Jose, CA and within 30 minutes it login box.com from Huston, TX.
• Some other user downloading 10 times of his usual files on his personal device.
• Action could be• Block, selective wipe, alert • Ask for 2F authentication• Account lockout
CASB log based discovery
• What is Discovery• An organization can understand the traffic pattern by analyzing the logs • No agent needed but Enterprise integration can help to identify users
• Logs • These logs are provided by FWs, NGFW, SWG• Logs can be uploaded
• Manually , using syslog or received the logs in tap mode • Can be uploaded as zip and compress mode• Most CASBs have inbuilt log parsers for popular FWs
• What is discovered • Any or unknown apps can be identified • Provide the baseline for your network as cloud apps used, traffic per app,
users files and more
CASB
NGFWWeb proxies
LDAP, Enterprise
Integration
Internet
Logs
CASB deployment modes • CASB can be divided into two deployment mode
• API mode (non-intrusive mode)• This is out-of-band mode • Agent-less and known as cloud application integration
• Proxy mode ( inline)• Two modes of proxy
• Reverse proxy• Forward proxy
• CASB (software) is installed in the public cloud or some vendors own data center• Traffic is redirected to the Proxy before it goes to SaaS Server • While passing through, traffic is being scanned and all attributes such as app, IP,
user-name, action (and more) are being collected and analyzed for session data• Decision can be made and Polices can be applied.
CASB Deployment mode -API
• Out of the band deployment• Best used for scrubbing the cloud • The API integration for the known SaaS
applications• API crawl the cloud for historic data for an SaaS
app and apply the policy for DLP, invalid sharing or malware detection.
• Control can be applied for any future action • Polling based
• When a worker is watching the cloud and any change will alert the system
• Change will be scanned and polices will be applied • Callback mode
• Some cloud app support the API, in that case SaaS informs any significant changes
Corporate office, Servers, desktop, mobile phone and tablet
Unmanaged mobile or personal devices
Remote users
IaaSAWS, Azure,
Soft layer
PaaSOracle cloud, Google API,
Bluemix
SaaSBox, workday,
O365 salesforce
CASB
Visibility Data Protection
Continuous Monitoring
Data Governance Compliance
Threat Protection
FW or SWG Proxy
CASB API mode – Pros and cons
• Advantage • Zero latency introduced by API• Can scrub the cloud • Agentless and cover both managed and unmanaged device• Covers SaaS, PaaS and IaaS traffic • Fast deploy, no need for DNS redirection, proxy chaining, reverse proxy or agent
• Disadvantage • Works only for known SaaS• Most of the time it is reporting, in advanced cases decision can be made after
the fact
CASB Deploy mode – forward proxy
• Forward Proxy • Traffic, from End-user and admin,
is redirected to the forward proxy • Traffic can be forwarded
• by agent that is installed on the end devices like laptop, mobile
• By DNS redirection, that is change the DNS server address in the end point to a particular DNS server
• PAC file or explicit proxy in browser
• Once Proxy receives the traffic, decision is made according to policies
Corporate office, Servers, desktop, mobile phone and tablet
Unmanaged mobile or personal devices Remote users
PaaSOracle cloud, Google API,
Bluemix
SaaSBox, workday,
O365 salesforce
CASBVisibility Data Protection
Continuous Monitoring
Data Governance Compliance
Threat Protection
Proxy Chaining, Traffic redirection, agent agent
Enterprise Integratio
n
Deploy mode – Forward Proxy Pros and Cons
• Advantage • Real time, that is an advantage over API mode• Knows user, devices with enterprise integration(LDAP)• Deep packet inspection • Can work with applications’ client, that is if box or outlook is been installed on the laptop,
that traffic can be scanned too• That is an advantage over reverse proxy
• Disadvantage • Latency, because of proxy in comparison to API• Single point of failure • Forward proxy can’t support unmanaged devices ( no agent no DNS redirection) • Mostly focus on SaaS traffic
CASB Deploy mode-reverse proxy
• Reverse Proxy• This is inline mode• Traffic, both the end-user and
administration, is been redirected to the CASB Proxy
• The redirection is been used achieved by URL rewriting
• The decision is made when traffic is been analysis URL rewrite, traffic redirection, IDM, IDaaS, SSO,
Corporate office, Servers, desktop, mobile phone and tablet
Unmanaged mobile or personal devices Remote users
PaaSOracle cloud, Google API,
Bluemix
SaaSBox, workday,
O365 salesforce
CASBVisibility Data Protection
Continuous Monitoring
Data Governance Compliance
Threat Protection Enterprise Integration
CASB Deploy mode-reverse proxy redirection
Web client Unmanaged mobile or
personal devices
PaaSOracle cloud, Google API,
Bluemix
SaaSBox, workday,
O365 salesforce
CASB12
Identity Provider
3 45
6
Packet flow1. Web Client makes a connection request to SaaS, for example “abc.box.com”2. Cloud app redirects the browser to
“identity provider”. That is configured as cloud application
3. The ID-Provider retunes to the browser to another redirection with SAML SSO token
4. Using that SSO token, browser automatically connects to the CASB
5. Now CASB is inline
CASB Deploy mode-reverse proxy advantage and disadvantage • Advantage
• Real time (advantage over API mode)• Agentless• Knows user, devices with enterprise integration(LDAP)• Best for unmanaged devices, can work with managed devices
• Disadvantage • Latency because of proxy in comparison to API• Single point of failure • Reverse proxy only works with browser
• If SaaS’s native client ( like outlook for O365) is used to send the traffic, reverse proxy will not redirect the traffic.
• Works with known apps• Mostly focus on SaaS traffic
Technology Integrations• MDM integration
• Can be used to push the CASB agents on the mobile • Agents can be configure to forward particular domain ranges to the CASB• Advantage : traffic redirection
• Enterprise secure web gateways• Used for proxy chaining in case of forward proxy • Only selected traffic can be forwarded to CASB and other traffic can pass through• Advantage : traffic redirection
• On- premises integration • LDAP or active directory integration with CASB• It can be an IAM solution installed on enterprise • A software can be installed that pulls user, group information for directory services and
push to CASB• Advantage : polices can be applied based on user, group, IP to user mapping, Ongoing user
addition updating updates the user status, Bulk update on the users, roles
Technology Integrations
• Identity and access management as a Service (IDaaS) • Useful in traffic redirection in the case of reverse proxy• Cloud applications single sign-on(SSO) • Advantage: traffic redirection. Bulk update and ongoing update for user,
roles. • SAML and OAuth: Single Sign-on tokens, used in allow user to authenticate
at identity provider • Security information and event management (SIEM) integration
• Provides visibility • Active Sync proxy
CASB Deploy mode summary Log based discovery
API based (out of band ) Forward proxy( real time)
Reverse Proxy( real time)
Offline, log is uploaded
only sanctioned app those have API support
Agent, DNS redirection or chain proxy
Web client, sanctioned apps
Visibility Yes Yes Yes ( any traffic) Yes
Network latency No No yes yesResource access control No On going and cloud scrubbing
(after the fact)yes Yes
Compliance No yes Yes YesUnmanaged device support Yes No No YesManaged device support Not applicable yes yes yesData loss prevention and data protection Encryption
No Yes, on going and cloud scrubbing
yes yes
Managed device support No applicable yes yes yes
CASB Deploy mode summary Log based discovery
API based (out of band ) Forward proxy( real time)
Reverse Proxy( real time)
Enterprise and cloud integration (IAM and IDaaS)
yes yes Yes
SaaS Native client support Not applicable yes yes NoContinuous Monitoring Yes ( tap mode) yes yes Yes Single point of failure Not applicable No Yes Yes Secure IaaS, PaaS and SaaS Yes Yes Focused on SaaS Focused on
SaaS
Choose your CASB for SaaS highway
• Every deployment mode has pros and cons • The sequence
• Start with log-based discovery • Then chose either API and/or finally proxy based
• Multimode CASB• If an organization has NGFW and SWG on premises then add log-based discovery and API-
based CASB• If your concern is about many unmanaged devices/mobiles and sanctioned apps, probably
reverse proxy based is better.• If it is more of organization and managed devices, forward proxy plus API is best approach.Most organizations will put multimode CASB
Cloud glossary • Web app:
• Only used by web browser and have a combination of server side and client side script. Online shopping, webEx, eBay and more
• Cloud app :• Service delivered by cloud that can be deceived by web browser or a native client.
In most cases web interface is used as alternative methods. Cloud app example is: outlook on your mac/window or office 365 login, box, Evernote, salesforce and more.
• Data can be accessed in offline mode by download is locally and can be synched periodically.
• Shadow IT:• A user targeted cloud app or unseasoned app used organization personal without
organization IT approval.
Cloud glossary • Structured and Unstructured data :
• Structure data: A data with columns and can be easily searchable by basic algorithms. Examples include spreadsheets and relational databases.
• Unstructured data is like human use and searching is hard. Example is emails, binary, word docs, social media posts, images, audio and more
• Identity and Access Management (IAM) • It is mission critical security practice that ensure the enables the right individuals to access
the right resources at the right times for the right reasons.1 • IAM solution providers are Okta, onelogin, PingIdetity, Centrify
• Identity as a service (IDaaS) • An IAM cloud based service, that is used by an organization to authentic a user or service
using Single Sign-on(SSO using SAML or OIDC) for multiple software and cloud-based applications. It can be for multi-tenant or dedicated organizations.
Cloud glossary • XaaS: Anything as a Service• DaaS : Desktop as a Service • IaaS: Infrastructure as a Service• SaaS: Software as a Service • BDaaS: Bigdata as a Service• HDaaS: HaDoop as a Service • BaaS : Backup as a Service • SCaaS : Security as a Service • MaaS : Monitoring as a Service• DRaaS : Disaster recovery as a Service