CASBs and Office 365
the security menace
STORYBOARDS
office 365 is the leading SaaS productivity suite:deployed in over a third of organizations, office 365 is
2015
google apps office 365
other
16.3%
7.7%
76%
22.8%
25.2%
52%40.7%
24.5%
34.8%
2016
STORYBOARDS
the traditional approach to
security is inadequate
STORYBOARDS
the dark side:enterprises can’t rely solely on native app security
enterprise(CASB)
end-user devicesvisibility & analytics
data protectionidentity & access control
applicationstorageserversnetwork
4
STORYBOARDS
cloud security menacesbenefits outweigh drawbacks, but risks remain
■ Lack of visibility and control over sensitive data
■ Difficult to identify malicious activity
■ Easy external sharing can result in unauthorized access
■ Cloud extends access to risky unmanaged devices
poll:what are your
office 365 migration
plans?
STORYBOARDS
components of o365 security
identity
cloud
access
mobile
STORYBOARDS
cloud:not a trap if adequately secured
■ External sharing opens the door to unintended leaks
○ API-based controls can restrict sharing of sensitive data
■ User behavior analytics, logging
○ Little in-app visibility, no cross-app visibility
○ Third-party solutions are built with compliance in mind
STORYBOARDS
access:native security provides limited visibility
■ More access, greater risk of data leakage
○ Granular access controls can limit risky access
○ Allow/block is not sufficient
■ DLP is critical to securing sensitive data in risky contexts○ Complete security solutions should
be content-aware, apply DLP at access
STORYBOARDS
mobile:fear of unmanaged devices is a path to the dark side
■ Employees have rejected MDM and MAM
■ IT must securely enable access to frequently used apps
■ Allow different levels of mobile access based on device type, user, etc.
STORYBOARDS
identity:centralized identity management will be with you always■ Cloud app identity management
should maintain the best practices of on-prem identity
■ O365 can identify some but not all high-risk logins
■ Prevent use of compromised credentials with cross-app IAM, step-up MFA
STORYBOARDS
office 365 native dlp:this is not the dlp you’re looking for■ BYOD blindspot - O365 DLP focused on
data at rest.
■ High operational overhead - Complex to configure.
■ Difficult deployment - OneDrive DLP requires Office 2016.
■ High cost - Must have top of the line license.
■ Point solution - Support focused on O365, what about other cloud apps?
poll:which of the
following security
functions is most critical?
STORYBOARDS
casbs uniquely strike the balance between agility and security
data protection for all user devices – managed and unmanaged
fast and flexible agentless deployments
future proof and adaptable
STORYBOARDS
casb security:a data-centric approach
o365 requires a new force, a new security architecture■ Cross-device, cross-application
agentless data security■ Real-time data protection■ Limit high-risk activities like external
file sharing, unmanaged access
■ User behavior analytics
STORYBOARDS
how casb security works
reverse proxy■ unmanaged device controls without agents
forward proxy■ managed devices controls
activesync proxy■ secure email, calendar, etc on any mobile
device■ device level security - wipe, encryption, PIN
etc
STORYBOARDS
casb identitycentralized identity management is key in securing data
■ CASBs offer integrated identity management across apps
■ Limit potential breaches with step-up multifactor auth for high risk logins
STORYBOARDS
managed devices
application access mode data protection
unmanaged devices &
mobiles
in the cloud
● profile-agent● VPN+IP-restriction
● DLP/DRM/encryption ● Device controls, e.g PIN● Agentless Selective wipe● Client apps: allow/block ● OneDrive
● Sharepoint ● API● Quarantine DLP● Block external shares● Alert on DLP events
office 365 use case:real-time inline data protection on any device
Legacy Auth Apps e.g Office 2010
● Full access
Modern Auth Apps e.g Office 2013+
● profile agent● VPN+IP-restriction● certificates
● Full access
● Browser● ActiveSync Mail● Client apps
● Reverse-proxy + AJAX-VM● ActiveSync Proxy
18
STORYBOARDS
challenge
■ Ensure OneDrive usage is HIPAA-compliant■ Prevent leakage of PII and PHI■ Maintain end user privacy■ Enforce data security policies on managed
and unmanaged devicessolution
■ Real-time inline data protection on any device
■ Block downloads of PHI and PII to unmanaged devices
■ Agentless BYOD with selective wipe■ Ability to support future enterprise-wide
SaaS deployments
19
180,000 users
secure office 365
+ byod
healthcare giant
STORYBOARDS
secure salesforce
+ office 365
20
client
■ $6T in assets
■ Subject to GLB, PCI-DSS, privacy laws that vary by region
challenge
■ Reduce risk presented by enterprise-wide Salesforce and Office 365 migration
■ Control Salesforce data residency
solution
■ Maintenance of full Salesforce frontend and backend functionality
■ Preserve SOQL API integrations
■ Full control of encryption keys■ Bidirectional remediation of customer PII
and PIFI in Sharepoint and Yammer
financial servicesgiant
STORYBOARDS
about bitglass
total data
protectionoutside the
firewall est. jan 2013
tier 1 VCs
21
200+ customer
s
STORYBOARDS
trustedby the
Global 2000
financial services
22
healthcare
manufacturing
and more...
resources:more info about office 365 security
■ whitepaper: definitive guide to casbs
■ case study: fortune 100 healthcare firm secures o365
■ video: securing office 365
STORYBOARDS
bitglass.com@bitglass
Top Related