Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

  • Products

    Netskope products are built on the Netskope Security Cloud.

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more

Zero trust solutions for SSE and SASE deployments

Learn more

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
  • Customer Success

    Secure your digital transformation journey and make the most of your cloud, web, and private applications.

  • Customer Support

    Proactive support and engagement to optimize your Netskope environment and accelerate your success.

  • Training and Certification

    Netskope training will help you become a cloud security expert.

Trust Netskope to help you address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements.

Learn more

We have qualified engineers worldwide, with diverse backgrounds in cloud security, networking, virtualization, content delivery, and software development, ready to give you timely, high-quality technical assistance.

Learn more

Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn more
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Bonus Episode: The Importance of Security Service Edge (SSE)

Play the podcast

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog

Netskope at RSA 2022

Meet and speak with Netskope security specialists at RSA.

Learn more

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Blog Full Skope 5 Tips for the CISO Looking to Get a Handle on Cloud Security
Oct 20 2021

5 Tips for the CISO Looking to Get a Handle on Cloud Security

Over the last 18 months, cloud application use has skyrocketed, with the average organisation with 500-2,000 employees now using 805 different cloud applications.

This is a staggering level of new risk for CISOs to get their heads around. At the same time that cloud use has grown, so too have the efforts of malicious actors to target cloud applications which are all too often poorly secured and present a constant opportunity of unsecured data to compromise.  

The challenge can feel insurmountable, with employees bringing cloud applications into the organisation through shadow IT faster than we can lock them down one by one, but it doesn’t have to be that way. Here are five tips for CISOs looking to get a handle on cloud security:

1) Partner within the business to build in security by design

With cloud proliferating through the organisation, security teams need to partner closely with IT and ensure that security is never a last-minute consideration. Many organisations are already restructuring and combining teams, in which IT and security sit alongside each other with shared KPIs

For security to be built in ‘by design’ it cannot, by definition, be bolted on, and this is one of the reasons that cloud security requires a cloud-native platform. Most organisations realise the limitations of their appliance-based architectures the minute they try to secure data, applications, and users that sit outside of their perimeter. Security by design takes a data-centric architectural approach, acknowledging that there is no longer a perimeter where users, devices, and data can reside safely. Instead, users, devices and data are now dispersed and move freely – in and out of whichever cloud apps and services the business requires – and these apps and services need security that exists wherever they are.

This approach is often dubbed a Secure Access Service Edge (SASE) strategy; placing security in the cloud, making it integral to IT architecture, and executing in-line controls. By taking this architectural approach to security you don’t have to build and customise new security controls cloud app by cloud app. 

2) Understand your data flows

When you acknowledge that your data is no longer static, but that it moves constantly around third-party cloud services, it becomes very apparent that a CISO needs a much greater understanding of their organisation’s data flows. An organisation should know the movements of its data, have visibility of the categories of data at play, and understand the profile of the cloud application in order to decide what controls are necessary.

A data-centric view of security makes sense when you consider that regulation and risk calculations are commonly data-centric. Visibility and an understanding of your data flows is particularly critical when you are navigating areas such as the shared responsibility model, or assessing supply chain risk. Organisations must undertake continuous security assessments based around their data flows.

3) Get on top of API security

Cloud has made it more pressing than ever before that organisations assess supply chain risk and partner assurances. This links to the previous point about understanding data flows (and knowing exactly where your data resides and what your responsibilities are), but it goes further too—specifically when making the most of the integration and analytics opportunities that come with cloud. 

Cloud integrations are incredibly convenient and can add a lot of value. They tend to be built upon APIs and are very easy to set up. However, legacy security appliances don’t understand APIs. They tend to only understand the language of the web and traditional network protocols and are unable to track or police cloud services. It’s yet another reason why you have to secure the cloud from within the cloud. Having legacy appliances attempting to police the cloud is a bit like having a police force that doesn’t speak the same language as the community it is trying to protect. They are powerless to understand what is happening and therefore ineffectual.

4) Make Zero Trust your default position

With cloud architectures removing the concept of a secure perimeter around an organisation’s data and IT, Zero Trust becomes important. As a CISO it can sometimes feel like the organisation looks to us for confidence and reassurance, but actually to do our job well there is a lot to be said for assuming the stance of high alert and mistrust. Zero Trust Network Access (ZTNA) is exactly that – you do not give anyone, any device, or any cloud service access to anything without a specifically allocated series of authenticated security credentials. Data is too valuable to make assumptions of authenticity.

A ZTNA solution makes an immediate difference to the level of security inherent within a traditional network or cloud architecture and should be considered a key component as organisations further migrate into a cloud-first world. 

5) Raise awareness, and activate the workforce

Information security is something that should be in every employee’s job description. But while we, the experts, have to work so hard to stay on top of new cloud risks and threats, we cannot expect employees to successfully navigate the best efforts of malicious actors without education. 

It only takes one simple error or misconfiguration to passively expose sensitive or regulated data, and malicious actors are working hard to make their traps harder for the average employee to spot. They know how to disguise themselves by replicating familiar branding and login screens of trusted cloud services. They even use the same trusted cloud services in their attack architecture, granting them the familiarity of a friendly URL. Cloud app credentials are a top target for phishing campaigns, with 36% of campaigns in 2020 targeting cloud app credentials, and they do this in pages that are hosted by, and look convincingly like, the authentic corporate instance of the organisation’s own cloud service.

It is our responsibility to equip the workforce to keep data safe, and the traditional take-away message of ‘do not click suspicious links’ is no longer useful. Raising awareness is the first step but the goal needs to be ‘activation’; when people feel accountable and responsible for security – reaching a point where every employee is a member of the security team. 

Just as cloud caused a revolutionary rethink around IT architectures, workflows, and cost centres, so it should do likewise for security. Whether cloud enters the business through major business transformation projects, or through an app downloaded to an unmanaged device, it is not something that security teams can ignore.  A SASE strategy – with strong Zero Trust principles – is the best way to ensure cloud remains a positive force within an organisation, and does not keep you awake at night.

This article was originally published at Digital Bulletin.

author image
About the author
Neil Thacker is a veteran information security professional and a data protection and privacy expert well-versed in the European Union General Data Protection Regulation (EU GDPR).
Neil Thacker is a veteran information security professional and a data protection and privacy expert well-versed in the European Union General Data Protection Regulation (EU GDPR).