The Most Critical CASB Use Cases in the Market Today: Detect Anomalies Such as Excessive Downloads, Uploads, or Sharing Within Both Sanctioned and Unsanctioned Cloud Services

As enterprises adopt cloud services and seek out a cloud access security broker (CASB), their use cases are maturing. They are moving beyond log-based discovery, and even beyond just their sanctioned cloud services, and looking to govern usage, secure data, and protect against cloud threats across all services.

Netskope customers have deployed our ALL-MODE architecture (with nearly three-quarters of them going beyond a single mode) to achieve their most critical use cases. We have noted 15 of these use cases in our recent e-book, The 15 Critical CASB Use Cases, and we’re highlighting them and more (and we want to hear from you too!) in this blog series.  

Here’s use case #13: Detect anomalies such as excessive downloads, uploads, or sharing within both sanctioned and unsanctioned cloud services.

Usage anomalies can signal things like risky or non-compliant behavior, data exfiltration, or even the presence of malware. It’s useful to see (and be alerted to) users’ behavior against a baseline of normal activity. Netskope uses both supervised and unsupervised machine learning, as well as rules, to identify and alert on anomalies.

One critical difference between Netskope and most other CASBs is that we enable our customers to see this activity across both sanctioned AND unsanctioned cloud services. In one case, this led to a manufacturing company easily identifying data exfiltration of a sensitive product design file from the organization’s corporate-sanctioned Box to a user’s unsanctioned Dropbox account, and in another, it led to an oil and gas company being alerted to command and control activity from a small, under-the-radar cloud service through frequent, small uploads. In either case, an organization that only focuses on sanctioned apps would have missed the anomaly.

To achieve the above-described use cases, the enterprise must deploy in an inline, forward proxy mode. To detect anomalies within a sanctioned app only, the enterprise can deploy in API or reverse proxy mode. Here are three critical functional requirements needed to achieve this use case:

• Be aware of context, including who did what, when, from where, on what device, and with whom, and what the activity was, e.g., “upload,” “share,” “download,” etc.
• See and control usage in not just sanctioned, but also unsanctioned cloud services
• Understand what normal activity is, and alert on anomalies from that baseline
• In the case of a forward proxy deployment, decrypt SSL traffic and decode the API

How are you detecting anomalies in sanctioned and unsanctioned cloud services? We want to hear from you.

Learn more about this and 14 additional most impactful use cases by downloading The 15 Critical CASB Use Cases.