Cloud Security Risk Assessment

Take Back Control Of Cloud Adoption

Shadow IT is the phrase often used for unsanctioned cloud applications which are often purchased by department heads outside of IT's control - the Cloud Security Risk Assessment helps you take back control and quickly shows what sanctioned and unsanctioned cloud services are in use and what data is leaking to the cloud.

Cloud adoption is becoming widespread and Gartner forecast 60% of compute will be in the cloud by 2018.   Only 5% of Cloud Applications are officially sanctioned leaving the remaining 95% bought into the enterprise outside of IT.
       Most Organisations estimate that they are running under 50 cloud applications. Research has shown that number to be closer to 1000.  

Securing these solutions is the problem…

By categorising cloud services into one of three different types, granular control models can be applied to ensure that data doesn’t leak from the organisation and threats are mitigated as far away from corporate assets as possible:

  • Sanctioned Services are quickly identified and the correct policy applied.
  • Unsanctioned Services are either blocked or allowed with granular data loss prevention monitors in place to ensure data doesn’t leak to inappropriate platforms.
  • Cloud Threats are quickly detected and remediated.

WHAT IS A CLOUD SECURITY RISK ASSESSMENT?

The Cloud Security Risk Assessment (CSRA) analyses log data from existing security tools and provides an Executive Summary of cloud service usage, data movements and the risk factors associated with each service.

WHAT DATA IS REQUIRED TO PRODUCE A CSRA?

The web browsing logs which are typically available from an existing web proxy or  rewall is all that is needed to enable us to produce a CSRA. In order to produce a meaningful report we recommend a minimum of two weeks activity and the logs will need to contain a minimum set of  elds. A secure dedicated tenant instance will be created in the cloud to host your data and into which your log  les should be uploaded for processing.

HOW ARE THE CSRA RESULTS PRESENTED?

InfoSecurity People will create a Presentation from the data and interesting activities and relevant metrics relating to cloud application usage will be highlighted. The presentation will give an overview of the risks associated with these cloud applications and provide guidance on how we could help lower those risks.

REMEDIATION STEPS?

Remediation doesn’t necessarily require substantial investment and InfoSecurity People can often assist with with reconfiguration of existing security solutions. However for best results, we recommend the deployment of a Cloud Access Security Broker (CASB) which provides an enforcement point for mitigating unsanctioned cloud usage and potential data loss to the cloud.