90% of cloud apps in the enterprise are being used without IT’s knowledge. Whether brought in by individuals or lines of business, there’s an average of 508 apps per enterprise and more than 5,000 in the world from which people can choose. Where things get even more interesting is when cloud and mobile combine and the opportunity for data loss and breaches multiply. These slides are from a webinar where leading identity management, cloud security, and fraud management expert Andras Cser from Forrester and Netskope’s Sr. Director of Product Marketing Bob Gilbert talk about the importance of understanding which employees are using which cloud apps and from where they’re accessing them. View the on-demand webinar here: http://www.netskope.com/webinars/securing-cloud-users-left-devices/

1. Securing The Cloud When
Users Are Left To Their Own
Devices
November 2014

2. © 2014 Netskope. All Rights Reserved.
Today’s Speakers
2
› Andras Cser, VP and Principal Analyst
› Bob Gilbert, Sr. Director Product Marketing

3. Cloud-based Services Employed Regularly
“Which of the following cloud-based services have you employed on a regular basis?"
Compute (e.g., Amazon EC2, Microsoft Azure VM Role)
Storage
Relational database (e.g. SQL Azure)
Development tools/IDE (e.g. Cloud9, Cloud Foundry)
Social (e.g., Salesforce Chatter)
Messaging
Content management
Message queuing
Integration (e.g., Dell Boomi, IBM Cast Iron)
Application-level caching
Content delivery network
Mobile back end
BPM
Nonrelational database
Don't know
Sample Size = 175 software developers from companies with 1,000 or more employees
Source: Forrsights Developer Survey, Q1 2013
3%
2%
26%
23%
23%
21%
18%
16%
14%
33%
33%
31%
37%
42%
50%
49%
Other
© 2014 Forrester Research, Inc. Reproduction Prohibited 3

4. “Which of the following initiatives are likely to be your IT organization's top project
and organizational priorities over the next 12 months?”
-- Increase our use of software-as-a-service (cloud applications)
1%
15%
35%
48%
Critical or High priority
Low priority
Not on our agenda
Don't know
Base: 1,176 North American and European IT decision-makers at firms with 1,000 or more employees
Source: Forrester Software Survey, Q4 2012
© 2014 Forrester Research, Inc. Reproduction Prohibited 4

5. Cloud Pulls the CISO in Many Directions
CISO and
Security
Organization
Changes, aka
Uneven
Handshake
2. LOB
procures
cloud
services
1. Cloud
Offers
Irresistible
Benefits
5. Security
Struggles to
Reduce Cloud
Security Risks
4. Data Center
Is Loosely
Coupled
3. CISO
Can’t Say No
All the Time
© 2013 Forrester Research, Inc. Reproduction Prohibited 5

6. Cloud Security Prepositions

7. Why Cloud Security is like a two
component “explosive”, a unique blend:
A: The Cloud is not just
a new delivery platform
B: Cloud Security is
NOT just continuing
security and extending it
to the cloud
© 2013 Forrester Research, Inc. Reproduction Prohibited 7

8. We’re moving to a single mobile form factor
Projector
Screen
E-ink
© 2014 Forrester Research, Inc. Reproduction Prohibited
Smartboard
Wearable glasses
Flexible display Retina projection
Docking station
Keyboard
Mouse
Touch
3D finger tracking
Body motion
Voice commands
Gesture tracking

9. Customers cross devices to accomplish
a single goal
Source: Google - The New Multi-screen World: Understanding Cross-platform Consumer Behavior, August 2014
© 2014 Forrester Research, Inc. Reproduction Prohibited

10. Access to Apps Runs the Gamut
› You don’t control your users’ devices
› You don’t control your users’ devices
› You don’t control your users’ devices
› But you have to take inventory of apps they use
› And you have to control the apps they use
› And you have to protect the data they use
© 2013 Forrester Research, Inc. Reproduction Prohibited 10

11. Cloud Security Top Threats Move to Data
© 2013 Forrester Research, Inc. Reproduction Prohibited 11

12. Cloud Does NOT Shift the Responsibility
of Data Protection
› “When data is transferred to a
cloud, the responsibility for
protecting and securing the data
typically remains with the collector
or custodian of that data.”
Cloud Security Alliance, Guidance v3.0
© 2013 Forrester Research, Inc. Reproduction Prohibited 12

13. 13
General Challenges with Cloud Security
› Ease of Use for End Users (you can’t control end users)
• Cloud security should not require users to change behaviors or
tools
› Inconsistent Control (you don’t own everything)
• The only thing you can count on is guest VM ownership
› Elasticity (not all servers are steady-state)
• Cloudbursting, stale servers, dynamic provisioning
› Scalability (highly variable server counts)
• May have one dev server or 1,000 production web servers
› Portability (same controls work anywhere)
• Nobody wants multiple tools or IaaS provider lock-in

14. Technology Challenges with Cloud Security
› Data protection
› Workload separation and multi tenancy
› Information Rights Management
› SaaS providers don’t help much with security related
concerns
› Network Security
› Identity and Access Management (IAM) and Privileged
Identity Management (PIM)
› Business Continuity and Disaster Recovery (BCDR)
› Log Management (SIEM)
© 2013 Forrester Research, Inc. Reproduction Prohibited 14

15. Network perimeter is gone
© 2013 Forrester Research, Inc. Reproduction Prohibited 15

16. Consciously Building the Cloud Data Protection Onion
Encryption at Cloud Vendor
Behavioral Patterns
DLP on premise and in the cloud
Identity Context
Encryption on Premise
Risk Assessment
Discovery and Tagging
© 2013 Forrester Research, Inc. Reproduction Prohibited 16

17. Thank you
Andras Cser
+1 617.613.6365
acser@forrester.com

18. © 2013 Forrester Research, Inc. Reproduction Prohibited 18