As the 25th RSA Conference was winding down last week in San Francisco, I took some time to reflect on the observations I had after perusing the show floor in addition to chatting with visitors to the Netskope booth.
CSA Summit was a great way to kick off the week at RSA
The theme of this year’s Cloud Security Alliance (CSA) Summit was “Cloudifying information security” and Netskope co-founder and chief scientist, Krishna Narayanaswamy, kicked things off with a presentation to the jam-packed room on the malware attack fan-out effect in the cloud and how the cloud can facilitate the rapid spread of malware to unsuspecting victims.
The topic of CASB was the “elephant in the room” at RSA
Last year’s RSA was my first with Netskope and from my viewpoint, the topic of Cloud Access Security Brokers (CASBs) was confined primarily to various vendors pitching offerings in this relatively new market. Fast-forward to RSA 2016 and CASB was one of the primary topics being discussed throughout RSA. From safe cloud enablement to the role that CASBs play to thwart cloud-based threats, it is clear that CASB is gaining mindshare for security folks attending RSA. Conversations have evolved from “what is CASB?” to “tell me how your CASB is different from the others?”
How is your CASB different from the others?
In addition to Netskope, there were a number of vendors showcasing their CASB solutions. For the casual RSA attendee, deciphering the differences between vendors can be an exhaustive task. At first glance, each vendor looks the same. They help you discover cloud apps, assess risk, and provide functionality such as encryption, etc. Netskope attempted to rise above the noise at RSA and we took a use-case approach to articulating how Netskope is different than other CASBs. Our booth theme was “you can’t govern what you can’t see” and we performed live demos that showcase how our customers are able to address their cloud security needs in a way that no other CASB can. We had some fun with the demos and actually had a demo wheel that was spun to determine which demo the audience would get to see. My colleague and I delivered more than 60 demos during the week
We focused on 4 use cases:
- Advanced Discovery – Not only discovering cloud apps and assessing risk, but also finding sensitive content in cloud apps. It turns out that more than 30% of business data reside in the cloud, so getting your arms around where your data are (and what type of data they are) is a key part of cloud usage discovery;
- Data Exfiltration – This demo showcased a use case that several of our customers have and that is potential risky data exfiltration scenarios where a user downloads sensitive content from a sanctioned cloud app like Box or Salesforce and turns around and uploads that content to their personal cloud app like Dropbox. Netskope is the only CASB that provides granular visibility from unsanctioned to sanctioned cloud usage and can detect, report, and even prevent this scenario from happening;
- Allow, don’t block cloud apps – This demo focused on a common use case where you want to safely enable cloud apps and not be forced to block them. The demo we featured here was a financial services company that was worried about giving their financial team access to social media because they might be in violation of FINRA compliance when it comes to publicly stating their opinion on certain companies or stocks. For this company, Netskope was the only CASB vendor that enabled them to look for keywords in social posts and block the risky activity instead of having to block social media apps altogether. You can see a recorded version of the booth demo here;
- Malware attack fan-out effect in the cloud – This was basically a live demo of the scenario that Krishna presented during his CSA Summit pitch. The combination of shared cloud folders combined with local sync clients facilitate the rapid spread of malware to unsuspecting victims. Here is a recorded version of the live demo we delivered in the Netskope booth at RSA.
Other musings at RSA 2016
My favorite booth was Tenable’s 80s arcade theme.
I had a fun conversation with the folks in the NSA booth. When they attempted to scan my badge, I responded with “but you already have my information”. All jokes aside, this was a great week at RSA.