As enterprises adopt cloud services and seek out a cloud access security broker (CASB), their use cases are maturing. They are moving beyond log-based discovery, and even beyond just their sanctioned cloud services, and looking to govern usage, secure data, and protect against cloud threats across all services.
Netskope customers have deployed our ALL-MODE architecture (with nearly three-quarters of them going beyond a single mode) to achieve their most critical use cases. We have noted 15 of these use cases in our recent e-book, The 15 Critical CASB Use Cases, and we’re highlighting them and more (and we want to hear from you too!) in this blog series.
Here’s use case #13: Detect anomalies such as excessive downloads, uploads, or sharing within both sanctioned and unsanctioned cloud services.
Usage anomalies can signal things like risky or non-compliant behavior, data exfiltration, or even the presence of malware. It’s useful to see (and be alerted to) users’ behavior against a baseline of normal activity. Netskope uses both supervised and unsupervised machine learning, as well as rules, to identify and alert on anomalies.
One critical difference between Netskope and most other CASBs is that we enable our customers to see this activity across both sanctioned AND unsanctioned cloud services. In one case, this led to a manufacturing company easily identifying data exfiltration of a sensitive product design file from the organization’s corporate-sanctioned Box to a user’s unsanctioned Dropbox account, and in another, it led to an oil and gas company being alerted to command and control activity from a small, under-the-radar cloud service through frequent, small uploads. In either case, an organization that only focuses on sanctioned apps would have missed the anomaly.
To achieve the above-described use cases, the enterprise must deploy in an inline, forward proxy mode. To detect anomalies within a sanctioned app only, the enterprise can d