|
Gain Usage Insight Many cloud services are well-designed, secure, enterprise-friendly and relatively risk free. However, improper use of even a sanctioned and well-managed cloud service may generate unacceptable and unforeseen risks. For example, if an employee attempts a mass download of numerous contacts from Salesforce.com on a weekend evening and then joins a competitor the following Monday. Alternatively, even technically savvy employees might subject an enterprise to serious risks without knowing they have done so. In January 2013, the most popular public SaaS software code repository GitHub sent out a warning to its users that many of the repositories users had thought were private were actually being indexed by Google. Engineers at enterprises had, in some cases, stored key password, SSH, and API keys in those repositories, potentially exposing their company’s infrastructure and software to grave danger. Even in instances where employees are breaking cloud services security rules willfully with the best intentions can present tremendous risks. Doctors using approved, cloud-based storage services in unapproved ways - perhaps to view x-rays and patient data on tablets or laptops at home - might be breaching a healthcare organization’s HIPAA compliance. These are just a handful of the myriad ways that basically safe cloud services can present major enterprise risks it usage is not monitored and well understood. Detecting anomalous usage that may indicate security breach or data loss requires two basic considerations. Either confidential data stored in a cloud service may be at risk or confidential data from within the enterprise may be exfiltrated using a cloud service. For example, confidential data stored in a relatively secure service but not overseen by IT security could present an anomalous usage case. Similarly, confidential data such as product plans may be exported 140 characters at a time through Twitter which your firewalls and proxies today can not block (even if configured to block Twitter.com there are newer ways to get to Twitter that today are unclassified by existing egress infrastructure). Conversely, collecting usage insights may identify the most useful and popular services and categories for employees. Similar to visibility and service insight, usage insight is also a continuous activity. An anomalous use at 3pm will not be detected by an assessment prior to 3pm. Use the Visibility and Insight to Control With total visibility, CIOs are no longer operating in the dark and have all the information they need to develop proper policies to control cloud services. Some organizations have more liberal cloud services policies that allow employees significant latitude. Others allow only approved cloud services and ban all others. Control may entail blocking certain unauthorized services or it may entail setting up behavioral and usage triggers that will block any service when a threshold is crossed. CIOs may also wish to apply controls based on organizational roles and privileges or even down to specific file types or types of network traffic. Some control can be enforced at the network edge of the enterprise by either blocking exiting data or by delivering configurations to existing egress devices. To exert control without negatively impacting employee activities, CIOs will need to perform an initial comprehensive cloud services policy review that aligns business objectives and ongoing usage with acceptable risk and service management. CIOs should periodically review these policies to ensure that the alignment between security and management goals and business objectives remains sound. Likewise, could services management configurations will change over time as new high-risk services need to be blocked, problems with previously sanctioned services emerge, and IT security teams accumulate a better understanding of risky usage patterns. Identify and Manage Enterprise Cloud Services Identify select services that are enterprise-critical, blessed and procured. These may include Salesforce, Box, Office365, Google and Amazon Web Services. Require employees wishing to access services to use their corporate identity and route access through encrypted channels using reverse proxies. As a result, access to an enterprise's cloud service account can be simply controlled both in terms of who can access the account but also what happens to data moving to, coming from, or residing on that service. When appropriate, CIOs can use encryption to protect data at rest in remote cloud services and manage the encryption keys on premises to achieve higher levels of security and assurance. In this way, even if a cloud service is compromised, enterprise data stored in the service remains secure. It is critical to ensure that enterprise policies for control of cloud services can be consistently enforced on premises as well as off when employees use corporate-issued mobile devices and laptops. For employees operating personal mobile devices (BYOD), access to enterprise cloud accounts should be controlled but without requiring the traffic from those personal devices to be first back-hauled into the enterprise network edge. Doing so would introduce friction and latency, irritating employees and encouraging them to resort to Shadow IT. Similarly, it is critical that cloud services control policies can be enforced without requiring employees to install or download agents or software onto their devices. Get Ahead of the Game Enterprises should identify cloud services that meet both risk criteria and business objectives that may not even yet be in use inside the organization. In fact, building a cloud services catalog or “app store” can proactively introduce your employees and business units to both cloud and industry best practices. This way an IT organization transforms from "Just say no!" entity to be avoided and bypassed (leading to Shadow IT) to a part of the organization that is considered to be an enabler and approver of new things. As a result, business units and employees are incented to work with the IT organization in a collaborative fashion. Thus, employees get the best of cloud services without compromising on the enterprise needs for operational efficiency, security, Cloud Governance, risk, and compliance – a win-win for an enterprise.
Related Articles -
Cloud governance, cloud governance service,
|
