Zurück 
Co-authored by David Willis and Gary Jenkins
As we wrote in an earlier blog, the concept of cybersecurity risk continues to be codified, qualified, and, finally, quantified. With the rise of RESTful API endpoint support and near-real time telemetry sharing, companies can seize the opportunity to automate the IT/security stack’s response to risky users (in addition to devices, data, and applications—to be covered in future blogs). Netskope Security Cloud integrations with Okta Workforce Identity and CrowdStrike Identity Protection are the next step in this direction, using risk scores to automate the delivery of continuously applied, conditional access to public and private applications, resources, and data.
Imagine a situation where a user’s endpoint becomes compromised, perhaps because of an insider threat. That user’s behavior starts to look strange to the endpoint, and looks even more abnormal in the cloud where they are engaging in totally new activities. Sharing each vendor’s view of this user enables the joint customer to confirm—yes, this user is NOT safe. Making a change on the endpoint is insufficient to fully protect the customer because the user could (potentially) come from another endpoint. Making a change in the cloud is also insufficient because the user could attack the endpoint with a form of lateral migration. Finally, the user’s activities have all been after successfully logging in, so the identity vendor may be unaware of the user’s malfeasance. But… if we can share and trigger changes based on an aggregation of each vendor’s views, now we can more holistically protect the customer.
As written in the previous blog, rather than sorting through thousands of alerts or millions of signals, vendors can leverage all the processing power each has brought to bear to share the findings and then the customer can take action as appropriate. Then every participating IT/security vendor can support creating or invoking dynamic rules to change user and/or device access or authentication requirements in response to the big picture of risk, as customized for each organization’s risk management practices.
A bit of background on risk signals before we show you how this can work. The Netskope Security Cloud looks at billions of signals to generate a view of user behavior for UEBA subscribers. The resulting user confidence index (UCI) scores range from 1 (horrific) to 1000 (very well behaved, indeed); they are continuously updated anytime a behavioral alert is surfaced from the user acting “differently” from the baseline, plus alerts on web activity, app use and instances, data activity, malware, and other policy violations. Any event impacting UCI can also be reset by administrators to return UCI to its previous score. CrowdStrike Identity Protection also looks at usual versus unusual behavior around users. It represents a huge increase in endpoint protection because now CrowdStrike can tell us if the host is the problem (with a low zero trust device assessment score) or if it is the user that is the danger (with a low risky user/identity score). CrowdStrike uses ranges of 1 (radioactive) to 100 (you or your laptop, right CISO?).
Then, let’s talk about the need to normalize and aggregate risk. Today, there is not one single risk-standard that has been used by every vendor (and there probably will never be). Frameworks like Shared Signals and Events by OpenID and its associated Continuous Authentication Evaluation Protocol give vendors means for passing the context of their risk scores, but the scores will still vary in terms of language (strings or integers), scale (is 1 risky, or 1000?), criticality (does a score of 75 mean high or medium risk), etc. Therefore, in order for the Netskope UCI score to be meaningfully compared or blended with a CrowdStrike risky user/identity score, we need a set of logic rules to make everyone speak th