SlideShare a Scribd company logo

McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report

Iftikhar Ali Iqbal, profile picture
Iftikhar Ali Iqbal

The document outlines McAfee's Mvision Cloud, a cloud access security broker (CASB) which aims to address security challenges related to unmanaged devices and cloud services. It provides a comprehensive overview of McAfee's strategy, platform capabilities, proof of concept (POC) results, and recommendations for improving cloud service governance and security. Key observations from the POCs highlight high-risk services, vulnerabilities, and necessary controls for better data loss prevention and threat protection.

Technology
Related topics:
Cloud Security Insights
1 of 58
Downloaded 25 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
McAfee MVISION Cloud Cloud Access Security Broker (CASB) Iftikhar Ali Iqbal, CISSP, CCSP, CISM https://www.linkedin.com/in/iftikhariqbal/ Valid till July 2019
2 AGENDA Target Partners & RTM 1 2 3 Company Overview & Strategy MVISION Cloud Proof Of Concept (POC) Observations 4 Proof Of Concept (POC) Recommendations
OVERVIEW Company and Portfolio
4 MCAFEE: OVERVIEW • Founded in 1987 • Headquartered in California, United States • Provides Software and Services • Focus is on Consumer and Enterprise Security • 125,000+ Corporate Customers • 120 Countries • 217+ Innovation Alliance Partners • 800+ Security Patents • Solution Offering: • Cloud Security • Device Security • Network Security • Data Protection and Encryption • Intelligent Security Operations • Service Offering: • Technical Support • Professional Services • Education
5 Portfolio Strategy An Integrated And Open Security System Threat Defense Lifecycle Together, Is Far More Powerful Than Sum Of The Parts SECURITY OPERATIONS DEVICE CLOUD MANAGEMENT THREAT INTELLIGENCE ANALYTICS AUTOMATION / ORCHESTRATION INFRASTRUCTURE MCAFEE: STRATEGY
MVISION CLOUD Cloud Access Security Broker (CASB)
7 MVISION CLOUD: CHALLENGES Unmanaged Devices SaaS IaaS/PaaS Enterprise Data Creation and Access in the Cloud Bypasses Existing Network Security Infrastructure#1 Shared Responsibility#2
“Through 2023, at least 99% of cloud security failures will be the customer’s fault.” Steve Riley, Craig Lawson. “Magic Quadrant for Cloud Access Security Brokers.” Gartner, 29 October 2018. “CASB is a required security platform for organizations using cloud services...” Craig Lawson, Neil MacDonald, Brian Lowans. “Market Guide for Cloud Access Security Brokers.” Gartner, 22 October 2015.
9 MVISION CLOUD: THREAT LANDSCAPE McAfee Discovers Knock Knock Hacker Exploiting Compromised Admin Account to hack into Office 365 McAfee Discovers Ghost Writer – S3 Buckets Configured for Write Access open up Customers to Major Vulnerabilities
10 Unmanaged Devices SaaS IaaS/PaaS MVISION Cloud No User Friction Complete Visibility and Policies Across Multiple Cloud Services Real Time Complete Coverage § Data at rest § Data uploaded/downloaded § Data created in cloud § Shared Cloud-to-cloud § Certificate pinned apps MVISION CLOUD: OVERVIEW SHADOW IT PUBLIC API, M CAFEE API PUBLIC API SIEM
11 ThirdPartyIntegration(DXL) Platform Extensibility Visibility Data Security Compliance Threat Protection Common Security Services IaaS and PaaS—Custom AppsSaaS CASB Connect—APIs Long-tail SaaS CASB Proxy—Workload Security Lift-and-shift Custom Apps MVISION CLOUD: THE PLATFORM
12 MVISION CLOUD: TRUSTED PLATFORM
13 NOTE: As of January 2018, MVISION Cloud (Skyhigh Networks) is the now part of McAfee. • Overall Leadership • Innovation Leadership • Market Leadership MVISION CLOUD: QUINTUPLE LEADERSHIP + COMMENDATION
PROOF OF CONCEPT (POC) Objectives
15 POC: REQUIREMENTS VISIBILITY Through Shadow IT discovery, provide a consolidated view of the organization’s cloud service landscape, and details about the users who access data in cloud services from any device or location. Furthermore, it should also provide a cloud service security rating database to check attributes of trustworthiness and associated risks of a Cloud Service Provider (CSP). Enforce Data Loss Prevention policies to prevent unwanted activity based on data discovery, data classification, user groups and collaboration to Sanctioned Software as a Service (SaaS). Controls such as quarantine, block, revocation, delete and view only. DATA SECURITY Demonstrate Governance of usage of cloud services across Sanctioned Software as a Service (SaaS) and Infrastructure as a Services (IaaS). Visibility, control and reporting mechanism should incorporate internal policies, best practices, security standards and regulatory compliance requirements. COMPLIANCE Prevent unmanaged devices and users from accessing cloud services by providing Access Controls. Furthermore, provide detailed Activity Monitoring with embedded user and entity behavior analytics (UEBA) for identifying anomalous behavior. These should be available for Sanctioned Software as a Service (SaaS) and Infrastructure as a Services (IaaS). THREAT PROTECTION
PROOF OF CONCEPT (POC) Shadow IT - Objectives
17 POC: SHADOW IT Discover Cloud Services Discover all SaaS, PaaS, IaaS, and custom applications in use and visually summarizes traffic patterns, access count, and usage over time. Data Center Provide a risk rating for each service based on attributes and be able to modify attribute and weights and add custom attributes to generate personalized ratings. Risk-based Score SaaS IaaS/PaaS Provide a workflow to automatically or manually classify services based on risk criteria and enforces acceptable use policies through coaching and/or blocking (out of scope). Cloud Service Governance Have a clickable drilldown to navigate from service-level upload statistics to granular user-level and event-level statistics with a complete activity feed for additional context. Activity Drilldown Detect if perimeter security allowed high risk services to operate and provide recommendations to close gaps. Cloud Enforcement Gap Analysis LMH 1 TB 970 GB 854 GB Cloud Storage IT Services Cloud StorageDevelopmentCollaboration
PROOF OF CONCEPT (POC) Shadow IT - Observations
19 POC: EXECUTIVE SUMMARY April 26 to May 16 2019 179 Services used with known vulnerability 40 High Risk Services of 2,286 Total Services 75 Services need additional controls Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
20 POC: HIGH RISK SERVICES April 26 to May 16 2019 40 High Risk Services of 2,286 Total Services 2 Partially Allowed 5.9 GB Uploaded to Cloud Storage 38 Completely Allowed Inconsistent Egress Policies High Risk Services Allowed by your Perimeter Security 0 Completely Denied bilibili Collaboration 8 WikiSend Cloud Storage 7 18 File Sharing Services Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
21 POC: VULNERABLE SERVICES April 26 to May 16 2019 179 Services used with known vulnerability 4 DROWN 0 Heartbleed 4 FREAK/Logjam 141 Cloudbleed 30 POODLE Allows remote attackers to obtain sensitive information Makes it easier for man- in-the-middle attackers to obtain cleartext data Man-in-the-middle attack that could break the security of any website Makes it easier for remote attackers to decrypt TLS ciphertext data Affecting Cloudflare's reverse proxies, which caused their edge servers to return their customer’s sensitive information. Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
22 POC: ADDITIONAL CONTROL REQUIREMENTS April 26 to May 16 2019 75 Services need additional controls Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
23 62 High Risk GDPR of 2,286 Total Services 56 Anonymous Use of 2,286 Total Services POC: HIGH RISK SERVICES BY CATEGORY April 26 to May 16 2019 6.9 GB313 57.1 K 6 Breached in 1 Year of 2,286 Total Services 8 High Risk Collaboration of 2,286 Total Services 0 High Risk IaaS of 2,286 Total Services 12 High Risk Cloud Storage of 2,286 Total Services 38.7 GB794 133.5 K 409.3 GB1,017 1.9 M 5.9 GB31 77 K 237 MB10 619 0 GB0 0 Data TransferredUsers Access Attempts
24 39 Approved McAfee CT of 2,286 Total Services POC: LOW RISK SERVICES BY CATEGORY April 26 to May 16 2019 57 Approved CSA Star of 2,286 Total Services 48 Low Risk Collaboration of 2,286 Total Services 3 Low Risk IaaS of 2,286 Total Services 12 Low Risk Cloud Storage of 2,286 Total Services 2.6 TB39 3.7 M 4.2 TB1,071 5.8 M 1.8 TB1,016 9.1 M 687.8 MB18 4.8 K 8.3 TB1,148 15.2 M Data TransferredUsers Access Attempts
25 POC: LOW RISK SERVICES COMPARISION April 26 to May 16 2019 48 Low Risk Collaboration 3 Low Risk IaaS 12 Low Risk Cloud Storage Services compared have been provided based on several validations made by the McAfee CloudTrust Program and/ or Cloud Security Alliance’s Security Trust Assurance and Risk (STAR) Program. Furthermore, McAfee MVISION Cloud provides discovery and various protection controls across these recommended services for your organization. MVISION Cloud for Box MVISION Cloud for Microsoft Office 365 MVISION Cloud for Slack MVISION Cloud for Exchange Online MVISION Cloud for Amazon Web Services (AWS)
26 POC: UNMATCHED SERVICES April 26 to May 16 2019 3,876 Unmatched Services of 6,162 Total Services 23 GB Uploads to thepiratebay.se 51.8 GB Unmatched Uploads of 2.2518 TB Total Upload Data 6.5 GB Uploads to 74.112.184.85 7.2 GB Uploads to 74.112.185.182 Unmatched Services 824 intranet.rks.com Unmatched Services 735rks-usw.accesscontrol.windows.net Unmatched Services 653 show.rks.com Unmatched Services 474 p.rfihub.com Unmatched Services 462 sync.adaptv.advertising.com URL STATUS CATEGORIZATION REPUTATION http://thepiratebay.se Categorized URL Potential Illegal Software Unverified http://74.112.185.182 Categorized URL Internet Services Minimal Risk http://74.112.184.85 Categorized URL Personal Network Storage Minimal Risk http://intranet.rks.com Categorized URL Blogs/Wiki Minimal Risk http://rks-usw.accesscontrol.windows.net Categorized URL Software/Hardware Minimal Risk http://show.rks.com Categorized URL Blogs/Wiki Minimal Risk http://sync.adaptv.advertising.com Categorized URL Internet Services Minimal Risk http://p.rfihub.com Categorized URL Content Server Minimal Risk Categorization information based on McAfee Web Gateway 7.x Customer URL Ticketing System* *For more information you can visit https://www.trustedsource.org/en/feedback/url or McAfee Threat Center (https://www.mcafee.com/enterprise/en-us/threat-center.html)
PROOF OF CONCEPT (POC) Shadow IT - Recommendations
28 Vulnerable Services • Find out who's using these services, and what information was shared with them. • Coach employees on lower-risk sanctioned or permitted alternatives. Additional Control Requirements • Although some services have a severity of medium or low risk, they would require additional control based on risky attributes. • Use the risk-based scoring of cloud services to identify them and assess them as per your risk appetite. Low Risk Services • Compare known good services that can be easily adopted by the organization for less user friction and with security controls • Validations can be made via the McAfee CloudTrust Program and/ or Cloud Security Alliance’s Security Trust Assurance and Risk (STAR) Program. • Discovery and various protection controls can be provided by MVISION Cloud for Sanctioned SaaS/IaaS. High Risk Services • Block high risk services, and coach your employees to use lower-risk sanctioned or permitted alternatives. • Ensure acceptable use governance policies are fully enforced by existing SWGs/NGFWs, and to ensure that there is no proxy leakage. Comprehensive Approach • Integrate with Active Directory to gather additional context of which cloud services are used based on users, departments, locations, etc. • Integrate with existing SWGs/NGFWs to enforce real-time governance policies by ensuring no proxy leakage. • With McAfee Web Gateway (MWG)’s, auto-classification of High Risk services by MVISION Cloud can be used to provide Closed Loop Remediation (CLR). POC: RECOMMENDATIONS
29 POC: EXECUTIVE SUMMARY (+21 Days) April 26 to Jun 6 2019 179 Services used with known vulnerability 47 High Risk Services of 2,313 Total Services 75 Services need additional controls Total Data to High Risk Services 35.5 GB Total Services 2,313 Users of High Risk Services 129 Access Attempts to High Risk Services 295.6 K +27 +28.7 GB +130.7 K+27 +7
PROOF OF CONCEPT (POC) Sanctioned SaaS - Objectives
31 POC: SANCTIONED SAAS Data Loss Prevention Discover & prevent sensitive data from being stored in Sanctioned SaaS. Prevent sharing of sensitive data with unauthorized parties.Collaboration Control Gain visibility into Sanctioned SaaS usage and accelerate post-incident forensic investigations by capturing a comprehensive audit trail of all activity (out of scope). Activity Monitoring Protect corporate data from unauthorized access by enforcing granular, context-aware access policies such as preventing download of sensitive data from Sanctioned SaaS to unmanaged devices. Access Control Automatically build models of typical user behavior and identifies behavior that may be indicative of a threat, such as Insider Threats, Compromised Accounts and Privileged User Threats. User Behavior Analytics Malware Detection Block known malware signatures, sandbox suspicious files, and identify behavior indicative of malware data exfiltration or ransomware activity (out of scope). Incident Management Response Provide a unified interface to triage, resolve incidents and response through autonomous remediation
PROOF OF CONCEPT (POC) Sanctioned SaaS - Observations
33 POC: EXECUTIVE SUMMARY May 22 to Jun 5 2019 Services 4 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 354 840 – O365 108 – G Suite of 948 Activities 351 – O365 3 – G Suite of 354 Access Violations 58 – OneDrive 12 – SharePoint 5 – Exchange 9 – Google Drive of 84 Policy Violations
34 46 LOGIN SUCCESS 43 DATA UPLOAD 643 SERVICE USAGE POC: ACTIVITY MONITORING 0 ANOMALIES 5 DATA DELETE 64 DATA ACCESS 1 DATA UPDATE 7 DATA SHARING iai@iaispace.com 189 actions Services Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 3544 May 22 to Jun 5 2019 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive 11 DATA UPDATES 42 DATA DOWNLOAD 840 – O365 108 – G Suite of 948 Activities 88 ADMINISTRATION iai@iairecord.com 98 actions 7 – O365 4 – G Suite of 11 users
35 POC: CLOUD ACCESS CONTROL 127 High Severity of 354 Access Violations 127H 0M 224L 20 Times Unmanaged Devices Used to Access Desktop17 Mobile3 11 Download Attempts on Unmanaged Devices Desktop9 Mobile2 Services Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 3544 May 22 to Jun 5 2019 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive 351 – O365 3 – G Suite of 354 Access Violations 0H 0M 3L
36 POC: DATA LOSS PREVENTION 74 High Severity of 84 Incidents 74H 10M 0L OneDrive 49 31 Invited Collaborators Of 84 Incidents Enabled Shared Link5 Email5 Modified31 Invited Collaborators31 Services Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 3544 May 22 to Jun 5 2019 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive 58 – OneDrive 12 – SharePoint 5 – Exchange 9 – Google Drive of 84 Policy Violations On-Demand Scan3 Uploaded7 Role Change of Collaborators2
37 POC: CONNECTED APPS May 22 to Jun 5 2019 7 Applications Blocked1 Allowed1 Under Audit1 Unassigned4
PROOF OF CONCEPT (POC) Sanctioned SaaS - Recommendations
39 Data Loss Prevention • Prevent unauthorized data from being collaborated on except for trusted partners with specific permission levels. • Discover and prevent regulated and high-value data from being stored in cloud services using content and context based rules. Access Control • Block downloads of data to unauthorized (unmanaged/personal) devices by performing certificate checks. • You can also block access to cloud services from unauthorized devices or view but no download policy. Activity Monitoring • Detect compromised accounts and insider/privileged user threats by leveraging machine learning which builds user behavior models. • Cross-reference activities across various cloud services in order detect anomalies + incorporate false positive feedback. • Capture an audit trail of all user activity (automatically categorized) with geolocation analytics for forensic investigation. Data Classification • Data owned by the organization and who is the data owner • How the data is being created, where is it being stored, how is it used and collaborated and with whom. • Helps understand if there are any regulatory compliance or jurisdictional requirements associated with the data. Comprehensive Approach • Integrate with Active Directory to enforce user or group-based policies based on user and custom attributes. • For Data Loss Prevention, integrate with on-premise DLP for complete coverage. • Integrate with SIEM via syslog to populate policy violations. POC: RECOMMENDATIONS
PROOF OF CONCEPT (POC) Sanctioned IaaS - Objectives
41 POC: SANCTIONED IAAS Security Configuration and Compliance Audit Audit and monitor the security configurations of all your IaaS services to detect and correct misconfigurations to reduce risk and comply with internal/external policies. Gain visibility into usage across managed and unmanaged IaaS accounts and accelerate post-incident forensic investigations by capturing a comprehensive audit trail of all activity. Activity Monitoring Prevent unauthorized regulated data from being stored in IaaS storage services.Data Loss Prevention Automatically build models of typical user behavior and identifies behavior that may be indicative of a threat, such as Insider Threats, Compromised Accounts and Privileged User Threats. User Behavior Analytics Malware Detection Block known malware signatures, sandbox suspicious files, and identify behavior indicative of malware data exfiltration or ransomware activity (out of scope). Incident Management Response Provide a unified interface to triage, resolve incidents and response through autonomous remediation
PROOF OF CONCEPT (POC) Sanctioned IaaS - Observations
43 POC: EXECUTIVE SUMMARY May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 0 – AWS 7 – Azure of 7 Policy Violations 1,353 – AWS 97 – Azure of 1,448 Activities 146 – AWS 14 – Azure of 160 Audit Violations
44 POC: ACTIVITY MONITORING May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 1,353 – AWS 97 – Azure of 1,448 Activities 0 ANOMALIES 1 DATA DELETE 5 DATA ACCESS 108 ADMINISTRATION 20 DATA UPDATES 10 USER ACCOUNT CREATION 1,302 SERVICE USAGE 4 LOGIN SUCCESS 3 – AWS 4 – Azure of 7 users iaispace-s3 1,277 actions admin 79 actions
45 POC: SECURITY CONFOGIRATION AUDIT May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 146 – AWS 14 – Azure of 160 Audit Violations 36 High Severity of 160 Audit Violations 9 Services affected of 9 Total Services 64 Non-compliant with CIS Benchmarks 32H 73M 41L 4H 8M 2L CloudTrail4 S310 IAM11 EC216 Web Services105 Subscriptions2 Storage Accounts2 Network Security Group3 Security Center7 LEVEL 233 LEVEL 128 LEVEL 13
46 POC: DATA LOSS PREVENTION May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 0 – AWS 7 – Azure of 7 Policy Violations 4 High Severity of 7 Policy Violations 0H 0M 0L 4H 3M 0L
PROOF OF CONCEPT (POC) Sanctioned IaaS - Recommendations
48 Data Loss Prevention • Discover regulated and high-value data from being stored in cloud services using content and context based rules. • Run scheduled on-demand scan to detect violations Security Configuration Audit • Run scheduled on-demand scans to detect security violations and misconfigurations of your cloud services. • Scans based on CIS benchmarks, Security Center (Azure) and McAfee best practices should be reviewed for incidents and remediation steps. Activity Monitoring • Detect compromised accounts and insider/privileged user threats by leveraging machine learning which builds user behavior models. • Cross-reference activities across various cloud services in order detect anomalies + incorporate false positive feedback. • Capture an audit trail of all user activity (automatically categorized) with geolocation analytics for forensic investigation. Data Classification • Data owned by the organization and who is the data owner • How the data is being created, where is it being stored, how is it used and collaborated and with whom. • Helps understand if there are any regulatory compliance or jurisdictional requirements associated with the data. Comprehensive Approach • Integrate with Active Directory to get additional context on users, departments, locations, etc • Integrate with SIEM via syslog to populate policy violations. POC: RECOMMENDATIONS
49 Thank You Iftikhar Ali Iqbal, CISSP, CCSP, CISM https://www.linkedin.com/in/iftikhariqbal/
PROOF OF CONCEPT (POC) Sanctioned SaaS – End User Experience
51 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive, Exchange Online USERS Everyone RULES Redirect Managed Clients (Device Certificates) EXCEPTIONS - RESPONSE Allow Service Activities POC: CLOUD ACCESS CONTROL MVISION Cloud
52 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive, Exchange Online USERS Everyone RULES Unmanaged Clients trying to Download EXCEPTIONS - RESPONSE Block Downloads POC: CLOUD ACCESS CONTROL MVISION Cloud
53 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive USERS Everyone RULES High Severity for Credit Card Data EXCEPTIONS - RESPONSE Quarantine for High Severity | Send Email to User MVISION Cloud POC: DATA LOSS PREVENTION
54 May 19 to May 22 2019 BUSINESS LOGIC SERVICES Exchange Online USERS Everyone RULES High Severity for Credit Card Data | Daily Scan EXCEPTIONS - RESPONSE Monitor for High Severity | Send Email to Admin MVISION Cloud POC: ON-DEMAND SCAN
55 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive USERS Everyone RULES High Severity for Collaborated Confidential (classification) Files EXCEPTIONS - RESPONSE Block for High Severity | Send Email to Admin POC: CONTENT COLLABORATION MVISION Cloud
PROOF OF CONCEPT (POC) Sanctioned IaaS – Admin Experience
57 POC: RECOMMENDATIONS – ACTIVITY MONITORING Monitor the activity of the users within your organization and detect risk trends for the entire organization over time. Break down individual usage over activity, time, users, and role development. Users with administrative access have the greatest access to sensitive data and user information, ensure they have only the necessary access and permissions to perform the required job.
58 POC: RECOMMENDATIONS – SECURITY AUDIT CONFIGURATION Regularly run security audit configuration scans. Review incidents and make remediations based on your requirements such as company security policy, best practices and benchmarks. After taking remediation measures run scan again to ensure that same violations are not being produced. Remediation strategy could be based on resolving High Severity incidents first, resolve all incidents affecting CIS Level benchmarks (High, Medium and Low) or as per organization’s risk appetite. MVISION Cloud provides remediation steps within the incident details.

More Related Content

PDF
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
Iftikhar Ali Iqbal
 
PDF
TechnicalTerraformLandingZones121120229238.pdf
MIlton788007
 
PDF
PaloAlto Enterprise Security Solution
Prime Infoserv
 
PPTX
Azure Migration Program Pitch Deck
Nicholas Vossburg
 
PDF
Microsoft 365 Enterprise Security with E5 Overview
David J Rosenthal
 
PDF
KFServing and Feast
Animesh Singh
 
PPTX
Microsoft Defender for Endpoint
Cheah Eng Soon
 
PDF
[Azure Governance] Lesson 4 : Azure Policy
☁ Hicham KADIRI ☁
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
Iftikhar Ali Iqbal
 
TechnicalTerraformLandingZones121120229238.pdf
MIlton788007
 
PaloAlto Enterprise Security Solution
Prime Infoserv
 
Azure Migration Program Pitch Deck
Nicholas Vossburg
 
Microsoft 365 Enterprise Security with E5 Overview
David J Rosenthal
 
KFServing and Feast
Animesh Singh
 
Microsoft Defender for Endpoint
Cheah Eng Soon
 
[Azure Governance] Lesson 4 : Azure Policy
☁ Hicham KADIRI ☁
 

What's hot (20)

PPTX
Microsoft 365 and Microsoft Cloud App Security
Albert Hoitingh
 
PDF
Azure Information Protection
Robert Crane
 
PDF
Azure Security Overview
David J Rosenthal
 
PDF
Microsoft Azure Sentinel
BGA Cyber Security
 
PPTX
Capgemini Cloud Assessment - A Pathway to Enterprise Cloud Migration
Floyd DCosta
 
PPTX
Azure Cloud Adoption Framework + Governance - Sana Khan and Jay Kumar
Timothy McAliley
 
PPTX
Azure Security and Management
Allen Brokken
 
PDF
Security Information and Event Management
UTD Computer Security Group
 
PPTX
Azure Identity and access management
Dinusha Kumarasiri
 
PPTX
Azure Application Modernization
Karina Matos
 
PPTX
Azure Sentinel.pptx
Mohit Chhabra
 
PDF
introduction to Azure Sentinel
Robert Crane
 
PPTX
Migrating DataPower to IBM's API Connect Using Custom Policies//DataPower Wee...
Natalia Kataoka
 
PDF
Microsoft Office 365 Advanced Threat Protection
David J Rosenthal
 
PPTX
Azure App Service Deep Dive
Azure Riyadh User Group
 
PDF
Microsoft Azure Active Directory
David J Rosenthal
 
PPT
AWS Presentation-1.ppt
usmanEhsan8
 
PDF
Cisco Meraki- Simplifying IT
Cisco Canada
 
PPTX
McAfee SIEM solution
hashnees
 
PPTX
Cisco Identity Services Engine (ISE)
Anwesh Dixit
 
Microsoft 365 and Microsoft Cloud App Security
Albert Hoitingh
 
Azure Information Protection
Robert Crane
 
Azure Security Overview
David J Rosenthal
 
Microsoft Azure Sentinel
BGA Cyber Security
 
Capgemini Cloud Assessment - A Pathway to Enterprise Cloud Migration
Floyd DCosta
 
Azure Cloud Adoption Framework + Governance - Sana Khan and Jay Kumar
Timothy McAliley
 
Azure Security and Management
Allen Brokken
 
Security Information and Event Management
UTD Computer Security Group
 
Azure Identity and access management
Dinusha Kumarasiri
 
Azure Application Modernization
Karina Matos
 
Azure Sentinel.pptx
Mohit Chhabra
 
introduction to Azure Sentinel
Robert Crane
 
Migrating DataPower to IBM's API Connect Using Custom Policies//DataPower Wee...
Natalia Kataoka
 
Microsoft Office 365 Advanced Threat Protection
David J Rosenthal
 
Azure App Service Deep Dive
Azure Riyadh User Group
 
Microsoft Azure Active Directory
David J Rosenthal
 
AWS Presentation-1.ppt
usmanEhsan8
 
Cisco Meraki- Simplifying IT
Cisco Canada
 
McAfee SIEM solution
hashnees
 
Cisco Identity Services Engine (ISE)
Anwesh Dixit
 
Ad

Similar to McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report (20)

PPTX
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)
Iftikhar Ali Iqbal
 
PPT
Cloud Security Alliance's GRC Stack Overview
Valdez Ladd MBA, CISSP, CISA,
 
PPTX
Multi Cloud Architecture Approach
Maganathin Veeraragaloo
 
PPTX
cloud computing security in intenet.pptx
moromoro8
 
PPTX
Cloud Security By Dr. Anton Ravindran
GSTF
 
PPTX
Cloud Access Security Brokers - CASB
Samrat Das
 
PPTX
The Journey to the Hybrid Multi Cloud
Idan Tohami
 
PPTX
Strengthening security posture for modern-age SaaS providers
Cloudflare
 
PPT
Oracle Cloud Computing Strategy
Rex Wang
 
PDF
CSA & GRC Stack
CloudSecurityAllianceAustralia
 
PDF
wp-security-dbsec-cloud-3225125
Gabor Bokor
 
PDF
SFBA Splunk Usergroup meeting September 4, 2024
Becky Burwell
 
PDF
Losing Control to the Cloud
Rochester Security Summit
 
PPTX
Internet of things about cloud computing
shaikrabbani034
 
PPTX
Welcome to the Multi-cloud world
Lew Tucker
 
PDF
Driving Innovation: A Path to Digitization, Speed and Visibility in an Applic...
Cisco Canada
 
PDF
2025-07-15 EMEA Volledig Inzicht Dutch Webinar
ThousandEyes
 
PPTX
F5 Networks - парадная дверь в облака
BAKOTECH
 
PDF
Cloud Security, Standards and Applications
Dr. Sunil Kr. Pandey
 
PDF
mcafee-cloud-acceleration-and-risks.pdf
AndreBolo1
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB)
Iftikhar Ali Iqbal
 
Cloud Security Alliance's GRC Stack Overview
Valdez Ladd MBA, CISSP, CISA,
 
Multi Cloud Architecture Approach
Maganathin Veeraragaloo
 
cloud computing security in intenet.pptx
moromoro8
 
Cloud Security By Dr. Anton Ravindran
GSTF
 
Cloud Access Security Brokers - CASB
Samrat Das
 
The Journey to the Hybrid Multi Cloud
Idan Tohami
 
Strengthening security posture for modern-age SaaS providers
Cloudflare
 
Oracle Cloud Computing Strategy
Rex Wang
 
CSA & GRC Stack
CloudSecurityAllianceAustralia
 
wp-security-dbsec-cloud-3225125
Gabor Bokor
 
SFBA Splunk Usergroup meeting September 4, 2024
Becky Burwell
 
Losing Control to the Cloud
Rochester Security Summit
 
Internet of things about cloud computing
shaikrabbani034
 
Welcome to the Multi-cloud world
Lew Tucker
 
Driving Innovation: A Path to Digitization, Speed and Visibility in an Applic...
Cisco Canada
 
2025-07-15 EMEA Volledig Inzicht Dutch Webinar
ThousandEyes
 
F5 Networks - парадная дверь в облака
BAKOTECH
 
Cloud Security, Standards and Applications
Dr. Sunil Kr. Pandey
 
mcafee-cloud-acceleration-and-risks.pdf
AndreBolo1
 
Ad

More from Iftikhar Ali Iqbal (15)

DOCX
McAfee - McAfee Application Control (MAC) - Whitelisting - Techbook
Iftikhar Ali Iqbal
 
PDF
McAfee - McAfee Application Control (MAC) - Whitelisting - Proposal
Iftikhar Ali Iqbal
 
PPTX
McAfee - McAfee Application Control (MAC) - Whitelisting
Iftikhar Ali Iqbal
 
PPTX
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
Iftikhar Ali Iqbal
 
PPTX
McAfee - Enterprise Security Manager (ESM) - SIEM
Iftikhar Ali Iqbal
 
PPTX
McAfee - Portfolio Overview
Iftikhar Ali Iqbal
 
DOCX
Symantec Data Loss Prevention - Technical Proposal (General)
Iftikhar Ali Iqbal
 
PPTX
Technology Overview - Validation & ID Protection (VIP)
Iftikhar Ali Iqbal
 
PPTX
Technology Overview - Symantec IT Management Suite (ITMS)
Iftikhar Ali Iqbal
 
PPTX
Technology Overview - Symantec Data Loss Prevention (DLP)
Iftikhar Ali Iqbal
 
PPTX
Technology Overview - Symantec Endpoint Protection (SEP)
Iftikhar Ali Iqbal
 
DOCX
Symantec Endpoint Encryption - Proof Of Concept Document
Iftikhar Ali Iqbal
 
DOCX
Symantec Messaging Gateway - Technical Proposal (General)
Iftikhar Ali Iqbal
 
PDF
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...
Iftikhar Ali Iqbal
 
PPTX
Symantec Portfolio - Sales Play
Iftikhar Ali Iqbal
 
McAfee - McAfee Application Control (MAC) - Whitelisting - Techbook
Iftikhar Ali Iqbal
 
McAfee - McAfee Application Control (MAC) - Whitelisting - Proposal
Iftikhar Ali Iqbal
 
McAfee - McAfee Application Control (MAC) - Whitelisting
Iftikhar Ali Iqbal
 
McAfee - McAfee Active Response (MAR) - Endpoint Detection & Response (EDR)
Iftikhar Ali Iqbal
 
McAfee - Enterprise Security Manager (ESM) - SIEM
Iftikhar Ali Iqbal
 
McAfee - Portfolio Overview
Iftikhar Ali Iqbal
 
Symantec Data Loss Prevention - Technical Proposal (General)
Iftikhar Ali Iqbal
 
Technology Overview - Validation & ID Protection (VIP)
Iftikhar Ali Iqbal
 
Technology Overview - Symantec IT Management Suite (ITMS)
Iftikhar Ali Iqbal
 
Technology Overview - Symantec Data Loss Prevention (DLP)
Iftikhar Ali Iqbal
 
Technology Overview - Symantec Endpoint Protection (SEP)
Iftikhar Ali Iqbal
 
Symantec Endpoint Encryption - Proof Of Concept Document
Iftikhar Ali Iqbal
 
Symantec Messaging Gateway - Technical Proposal (General)
Iftikhar Ali Iqbal
 
Symantec Endpoint Protection vs Sophos Endpoint Protection (Competitive Analy...
Iftikhar Ali Iqbal
 
Symantec Portfolio - Sales Play
Iftikhar Ali Iqbal
 

Recently uploaded (20)

PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PPTX
A Presentation on Artificial Intelligence
memembruh336
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
A Presentation on Artificial Intelligence
memembruh336
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Encapsulation theory and applications.pdf
gurumoop
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 

McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Report

  • 1. McAfee MVISION Cloud Cloud Access Security Broker (CASB) Iftikhar Ali Iqbal, CISSP, CCSP, CISM https://www.linkedin.com/in/iftikhariqbal/ Valid till July 2019
  • 2. 2 AGENDA Target Partners & RTM 1 2 3 Company Overview & Strategy MVISION Cloud Proof Of Concept (POC) Observations 4 Proof Of Concept (POC) Recommendations
  • 4. 4 MCAFEE: OVERVIEW • Founded in 1987 • Headquartered in California, United States • Provides Software and Services • Focus is on Consumer and Enterprise Security • 125,000+ Corporate Customers • 120 Countries • 217+ Innovation Alliance Partners • 800+ Security Patents • Solution Offering: • Cloud Security • Device Security • Network Security • Data Protection and Encryption • Intelligent Security Operations • Service Offering: • Technical Support • Professional Services • Education
  • 5. 5 Portfolio Strategy An Integrated And Open Security System Threat Defense Lifecycle Together, Is Far More Powerful Than Sum Of The Parts SECURITY OPERATIONS DEVICE CLOUD MANAGEMENT THREAT INTELLIGENCE ANALYTICS AUTOMATION / ORCHESTRATION INFRASTRUCTURE MCAFEE: STRATEGY
  • 6. MVISION CLOUD Cloud Access Security Broker (CASB)
  • 7. 7 MVISION CLOUD: CHALLENGES Unmanaged Devices SaaS IaaS/PaaS Enterprise Data Creation and Access in the Cloud Bypasses Existing Network Security Infrastructure#1 Shared Responsibility#2
  • 8. “Through 2023, at least 99% of cloud security failures will be the customer’s fault.” Steve Riley, Craig Lawson. “Magic Quadrant for Cloud Access Security Brokers.” Gartner, 29 October 2018. “CASB is a required security platform for organizations using cloud services...” Craig Lawson, Neil MacDonald, Brian Lowans. “Market Guide for Cloud Access Security Brokers.” Gartner, 22 October 2015.
  • 9. 9 MVISION CLOUD: THREAT LANDSCAPE McAfee Discovers Knock Knock Hacker Exploiting Compromised Admin Account to hack into Office 365 McAfee Discovers Ghost Writer – S3 Buckets Configured for Write Access open up Customers to Major Vulnerabilities
  • 10. 10 Unmanaged Devices SaaS IaaS/PaaS MVISION Cloud No User Friction Complete Visibility and Policies Across Multiple Cloud Services Real Time Complete Coverage § Data at rest § Data uploaded/downloaded § Data created in cloud § Shared Cloud-to-cloud § Certificate pinned apps MVISION CLOUD: OVERVIEW SHADOW IT PUBLIC API, M CAFEE API PUBLIC API SIEM
  • 11. 11 ThirdPartyIntegration(DXL) Platform Extensibility Visibility Data Security Compliance Threat Protection Common Security Services IaaS and PaaS—Custom AppsSaaS CASB Connect—APIs Long-tail SaaS CASB Proxy—Workload Security Lift-and-shift Custom Apps MVISION CLOUD: THE PLATFORM
  • 13. 13 NOTE: As of January 2018, MVISION Cloud (Skyhigh Networks) is the now part of McAfee. • Overall Leadership • Innovation Leadership • Market Leadership MVISION CLOUD: QUINTUPLE LEADERSHIP + COMMENDATION
  • 14. PROOF OF CONCEPT (POC) Objectives
  • 15. 15 POC: REQUIREMENTS VISIBILITY Through Shadow IT discovery, provide a consolidated view of the organization’s cloud service landscape, and details about the users who access data in cloud services from any device or location. Furthermore, it should also provide a cloud service security rating database to check attributes of trustworthiness and associated risks of a Cloud Service Provider (CSP). Enforce Data Loss Prevention policies to prevent unwanted activity based on data discovery, data classification, user groups and collaboration to Sanctioned Software as a Service (SaaS). Controls such as quarantine, block, revocation, delete and view only. DATA SECURITY Demonstrate Governance of usage of cloud services across Sanctioned Software as a Service (SaaS) and Infrastructure as a Services (IaaS). Visibility, control and reporting mechanism should incorporate internal policies, best practices, security standards and regulatory compliance requirements. COMPLIANCE Prevent unmanaged devices and users from accessing cloud services by providing Access Controls. Furthermore, provide detailed Activity Monitoring with embedded user and entity behavior analytics (UEBA) for identifying anomalous behavior. These should be available for Sanctioned Software as a Service (SaaS) and Infrastructure as a Services (IaaS). THREAT PROTECTION
  • 16. PROOF OF CONCEPT (POC) Shadow IT - Objectives
  • 17. 17 POC: SHADOW IT Discover Cloud Services Discover all SaaS, PaaS, IaaS, and custom applications in use and visually summarizes traffic patterns, access count, and usage over time. Data Center Provide a risk rating for each service based on attributes and be able to modify attribute and weights and add custom attributes to generate personalized ratings. Risk-based Score SaaS IaaS/PaaS Provide a workflow to automatically or manually classify services based on risk criteria and enforces acceptable use policies through coaching and/or blocking (out of scope). Cloud Service Governance Have a clickable drilldown to navigate from service-level upload statistics to granular user-level and event-level statistics with a complete activity feed for additional context. Activity Drilldown Detect if perimeter security allowed high risk services to operate and provide recommendations to close gaps. Cloud Enforcement Gap Analysis LMH 1 TB 970 GB 854 GB Cloud Storage IT Services Cloud StorageDevelopmentCollaboration
  • 18. PROOF OF CONCEPT (POC) Shadow IT - Observations
  • 19. 19 POC: EXECUTIVE SUMMARY April 26 to May 16 2019 179 Services used with known vulnerability 40 High Risk Services of 2,286 Total Services 75 Services need additional controls Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
  • 20. 20 POC: HIGH RISK SERVICES April 26 to May 16 2019 40 High Risk Services of 2,286 Total Services 2 Partially Allowed 5.9 GB Uploaded to Cloud Storage 38 Completely Allowed Inconsistent Egress Policies High Risk Services Allowed by your Perimeter Security 0 Completely Denied bilibili Collaboration 8 WikiSend Cloud Storage 7 18 File Sharing Services Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
  • 21. 21 POC: VULNERABLE SERVICES April 26 to May 16 2019 179 Services used with known vulnerability 4 DROWN 0 Heartbleed 4 FREAK/Logjam 141 Cloudbleed 30 POODLE Allows remote attackers to obtain sensitive information Makes it easier for man- in-the-middle attackers to obtain cleartext data Man-in-the-middle attack that could break the security of any website Makes it easier for remote attackers to decrypt TLS ciphertext data Affecting Cloudflare's reverse proxies, which caused their edge servers to return their customer’s sensitive information. Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
  • 22. 22 POC: ADDITIONAL CONTROL REQUIREMENTS April 26 to May 16 2019 75 Services need additional controls Total Data to High Risk Services 6.8 GB Total Services 2,286 Users of High Risk Services 102 Access Attempts to High Risk Services 164.9 K
  • 23. 23 62 High Risk GDPR of 2,286 Total Services 56 Anonymous Use of 2,286 Total Services POC: HIGH RISK SERVICES BY CATEGORY April 26 to May 16 2019 6.9 GB313 57.1 K 6 Breached in 1 Year of 2,286 Total Services 8 High Risk Collaboration of 2,286 Total Services 0 High Risk IaaS of 2,286 Total Services 12 High Risk Cloud Storage of 2,286 Total Services 38.7 GB794 133.5 K 409.3 GB1,017 1.9 M 5.9 GB31 77 K 237 MB10 619 0 GB0 0 Data TransferredUsers Access Attempts
  • 24. 24 39 Approved McAfee CT of 2,286 Total Services POC: LOW RISK SERVICES BY CATEGORY April 26 to May 16 2019 57 Approved CSA Star of 2,286 Total Services 48 Low Risk Collaboration of 2,286 Total Services 3 Low Risk IaaS of 2,286 Total Services 12 Low Risk Cloud Storage of 2,286 Total Services 2.6 TB39 3.7 M 4.2 TB1,071 5.8 M 1.8 TB1,016 9.1 M 687.8 MB18 4.8 K 8.3 TB1,148 15.2 M Data TransferredUsers Access Attempts
  • 25. 25 POC: LOW RISK SERVICES COMPARISION April 26 to May 16 2019 48 Low Risk Collaboration 3 Low Risk IaaS 12 Low Risk Cloud Storage Services compared have been provided based on several validations made by the McAfee CloudTrust Program and/ or Cloud Security Alliance’s Security Trust Assurance and Risk (STAR) Program. Furthermore, McAfee MVISION Cloud provides discovery and various protection controls across these recommended services for your organization. MVISION Cloud for Box MVISION Cloud for Microsoft Office 365 MVISION Cloud for Slack MVISION Cloud for Exchange Online MVISION Cloud for Amazon Web Services (AWS)
  • 26. 26 POC: UNMATCHED SERVICES April 26 to May 16 2019 3,876 Unmatched Services of 6,162 Total Services 23 GB Uploads to thepiratebay.se 51.8 GB Unmatched Uploads of 2.2518 TB Total Upload Data 6.5 GB Uploads to 74.112.184.85 7.2 GB Uploads to 74.112.185.182 Unmatched Services 824 intranet.rks.com Unmatched Services 735rks-usw.accesscontrol.windows.net Unmatched Services 653 show.rks.com Unmatched Services 474 p.rfihub.com Unmatched Services 462 sync.adaptv.advertising.com URL STATUS CATEGORIZATION REPUTATION http://thepiratebay.se Categorized URL Potential Illegal Software Unverified http://74.112.185.182 Categorized URL Internet Services Minimal Risk http://74.112.184.85 Categorized URL Personal Network Storage Minimal Risk http://intranet.rks.com Categorized URL Blogs/Wiki Minimal Risk http://rks-usw.accesscontrol.windows.net Categorized URL Software/Hardware Minimal Risk http://show.rks.com Categorized URL Blogs/Wiki Minimal Risk http://sync.adaptv.advertising.com Categorized URL Internet Services Minimal Risk http://p.rfihub.com Categorized URL Content Server Minimal Risk Categorization information based on McAfee Web Gateway 7.x Customer URL Ticketing System* *For more information you can visit https://www.trustedsource.org/en/feedback/url or McAfee Threat Center (https://www.mcafee.com/enterprise/en-us/threat-center.html)
  • 27. PROOF OF CONCEPT (POC) Shadow IT - Recommendations
  • 28. 28 Vulnerable Services • Find out who's using these services, and what information was shared with them. • Coach employees on lower-risk sanctioned or permitted alternatives. Additional Control Requirements • Although some services have a severity of medium or low risk, they would require additional control based on risky attributes. • Use the risk-based scoring of cloud services to identify them and assess them as per your risk appetite. Low Risk Services • Compare known good services that can be easily adopted by the organization for less user friction and with security controls • Validations can be made via the McAfee CloudTrust Program and/ or Cloud Security Alliance’s Security Trust Assurance and Risk (STAR) Program. • Discovery and various protection controls can be provided by MVISION Cloud for Sanctioned SaaS/IaaS. High Risk Services • Block high risk services, and coach your employees to use lower-risk sanctioned or permitted alternatives. • Ensure acceptable use governance policies are fully enforced by existing SWGs/NGFWs, and to ensure that there is no proxy leakage. Comprehensive Approach • Integrate with Active Directory to gather additional context of which cloud services are used based on users, departments, locations, etc. • Integrate with existing SWGs/NGFWs to enforce real-time governance policies by ensuring no proxy leakage. • With McAfee Web Gateway (MWG)’s, auto-classification of High Risk services by MVISION Cloud can be used to provide Closed Loop Remediation (CLR). POC: RECOMMENDATIONS
  • 29. 29 POC: EXECUTIVE SUMMARY (+21 Days) April 26 to Jun 6 2019 179 Services used with known vulnerability 47 High Risk Services of 2,313 Total Services 75 Services need additional controls Total Data to High Risk Services 35.5 GB Total Services 2,313 Users of High Risk Services 129 Access Attempts to High Risk Services 295.6 K +27 +28.7 GB +130.7 K+27 +7
  • 30. PROOF OF CONCEPT (POC) Sanctioned SaaS - Objectives
  • 31. 31 POC: SANCTIONED SAAS Data Loss Prevention Discover & prevent sensitive data from being stored in Sanctioned SaaS. Prevent sharing of sensitive data with unauthorized parties.Collaboration Control Gain visibility into Sanctioned SaaS usage and accelerate post-incident forensic investigations by capturing a comprehensive audit trail of all activity (out of scope). Activity Monitoring Protect corporate data from unauthorized access by enforcing granular, context-aware access policies such as preventing download of sensitive data from Sanctioned SaaS to unmanaged devices. Access Control Automatically build models of typical user behavior and identifies behavior that may be indicative of a threat, such as Insider Threats, Compromised Accounts and Privileged User Threats. User Behavior Analytics Malware Detection Block known malware signatures, sandbox suspicious files, and identify behavior indicative of malware data exfiltration or ransomware activity (out of scope). Incident Management Response Provide a unified interface to triage, resolve incidents and response through autonomous remediation
  • 32. PROOF OF CONCEPT (POC) Sanctioned SaaS - Observations
  • 33. 33 POC: EXECUTIVE SUMMARY May 22 to Jun 5 2019 Services 4 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 354 840 – O365 108 – G Suite of 948 Activities 351 – O365 3 – G Suite of 354 Access Violations 58 – OneDrive 12 – SharePoint 5 – Exchange 9 – Google Drive of 84 Policy Violations
  • 34. 34 46 LOGIN SUCCESS 43 DATA UPLOAD 643 SERVICE USAGE POC: ACTIVITY MONITORING 0 ANOMALIES 5 DATA DELETE 64 DATA ACCESS 1 DATA UPDATE 7 DATA SHARING iai@iaispace.com 189 actions Services Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 3544 May 22 to Jun 5 2019 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive 11 DATA UPDATES 42 DATA DOWNLOAD 840 – O365 108 – G Suite of 948 Activities 88 ADMINISTRATION iai@iairecord.com 98 actions 7 – O365 4 – G Suite of 11 users
  • 35. 35 POC: CLOUD ACCESS CONTROL 127 High Severity of 354 Access Violations 127H 0M 224L 20 Times Unmanaged Devices Used to Access Desktop17 Mobile3 11 Download Attempts on Unmanaged Devices Desktop9 Mobile2 Services Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 3544 May 22 to Jun 5 2019 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive 351 – O365 3 – G Suite of 354 Access Violations 0H 0M 3L
  • 36. 36 POC: DATA LOSS PREVENTION 74 High Severity of 84 Incidents 74H 10M 0L OneDrive 49 31 Invited Collaborators Of 84 Incidents Enabled Shared Link5 Email5 Modified31 Invited Collaborators31 Services Data Loss Prevention 84 Activity Monitoring 948 Cloud Access Control 3544 May 22 to Jun 5 2019 Microsoft Exchange Online Microsoft OneDrive Microsoft SharePoint Online Google Drive 58 – OneDrive 12 – SharePoint 5 – Exchange 9 – Google Drive of 84 Policy Violations On-Demand Scan3 Uploaded7 Role Change of Collaborators2
  • 37. 37 POC: CONNECTED APPS May 22 to Jun 5 2019 7 Applications Blocked1 Allowed1 Under Audit1 Unassigned4
  • 38. PROOF OF CONCEPT (POC) Sanctioned SaaS - Recommendations
  • 39. 39 Data Loss Prevention • Prevent unauthorized data from being collaborated on except for trusted partners with specific permission levels. • Discover and prevent regulated and high-value data from being stored in cloud services using content and context based rules. Access Control • Block downloads of data to unauthorized (unmanaged/personal) devices by performing certificate checks. • You can also block access to cloud services from unauthorized devices or view but no download policy. Activity Monitoring • Detect compromised accounts and insider/privileged user threats by leveraging machine learning which builds user behavior models. • Cross-reference activities across various cloud services in order detect anomalies + incorporate false positive feedback. • Capture an audit trail of all user activity (automatically categorized) with geolocation analytics for forensic investigation. Data Classification • Data owned by the organization and who is the data owner • How the data is being created, where is it being stored, how is it used and collaborated and with whom. • Helps understand if there are any regulatory compliance or jurisdictional requirements associated with the data. Comprehensive Approach • Integrate with Active Directory to enforce user or group-based policies based on user and custom attributes. • For Data Loss Prevention, integrate with on-premise DLP for complete coverage. • Integrate with SIEM via syslog to populate policy violations. POC: RECOMMENDATIONS
  • 40. PROOF OF CONCEPT (POC) Sanctioned IaaS - Objectives
  • 41. 41 POC: SANCTIONED IAAS Security Configuration and Compliance Audit Audit and monitor the security configurations of all your IaaS services to detect and correct misconfigurations to reduce risk and comply with internal/external policies. Gain visibility into usage across managed and unmanaged IaaS accounts and accelerate post-incident forensic investigations by capturing a comprehensive audit trail of all activity. Activity Monitoring Prevent unauthorized regulated data from being stored in IaaS storage services.Data Loss Prevention Automatically build models of typical user behavior and identifies behavior that may be indicative of a threat, such as Insider Threats, Compromised Accounts and Privileged User Threats. User Behavior Analytics Malware Detection Block known malware signatures, sandbox suspicious files, and identify behavior indicative of malware data exfiltration or ransomware activity (out of scope). Incident Management Response Provide a unified interface to triage, resolve incidents and response through autonomous remediation
  • 42. PROOF OF CONCEPT (POC) Sanctioned IaaS - Observations
  • 43. 43 POC: EXECUTIVE SUMMARY May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 0 – AWS 7 – Azure of 7 Policy Violations 1,353 – AWS 97 – Azure of 1,448 Activities 146 – AWS 14 – Azure of 160 Audit Violations
  • 44. 44 POC: ACTIVITY MONITORING May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 1,353 – AWS 97 – Azure of 1,448 Activities 0 ANOMALIES 1 DATA DELETE 5 DATA ACCESS 108 ADMINISTRATION 20 DATA UPDATES 10 USER ACCOUNT CREATION 1,302 SERVICE USAGE 4 LOGIN SUCCESS 3 – AWS 4 – Azure of 7 users iaispace-s3 1,277 actions admin 79 actions
  • 45. 45 POC: SECURITY CONFOGIRATION AUDIT May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 146 – AWS 14 – Azure of 160 Audit Violations 36 High Severity of 160 Audit Violations 9 Services affected of 9 Total Services 64 Non-compliant with CIS Benchmarks 32H 73M 41L 4H 8M 2L CloudTrail4 S310 IAM11 EC216 Web Services105 Subscriptions2 Storage Accounts2 Network Security Group3 Security Center7 LEVEL 233 LEVEL 128 LEVEL 13
  • 46. 46 POC: DATA LOSS PREVENTION May 22 to May 30 2019 Data Loss Prevention 7 Activity Monitoring 1,448 Services 2 Amazon Web Services Microsoft Azure Security Configuration Audit 160 0 – AWS 7 – Azure of 7 Policy Violations 4 High Severity of 7 Policy Violations 0H 0M 0L 4H 3M 0L
  • 47. PROOF OF CONCEPT (POC) Sanctioned IaaS - Recommendations
  • 48. 48 Data Loss Prevention • Discover regulated and high-value data from being stored in cloud services using content and context based rules. • Run scheduled on-demand scan to detect violations Security Configuration Audit • Run scheduled on-demand scans to detect security violations and misconfigurations of your cloud services. • Scans based on CIS benchmarks, Security Center (Azure) and McAfee best practices should be reviewed for incidents and remediation steps. Activity Monitoring • Detect compromised accounts and insider/privileged user threats by leveraging machine learning which builds user behavior models. • Cross-reference activities across various cloud services in order detect anomalies + incorporate false positive feedback. • Capture an audit trail of all user activity (automatically categorized) with geolocation analytics for forensic investigation. Data Classification • Data owned by the organization and who is the data owner • How the data is being created, where is it being stored, how is it used and collaborated and with whom. • Helps understand if there are any regulatory compliance or jurisdictional requirements associated with the data. Comprehensive Approach • Integrate with Active Directory to get additional context on users, departments, locations, etc • Integrate with SIEM via syslog to populate policy violations. POC: RECOMMENDATIONS
  • 49. 49 Thank You Iftikhar Ali Iqbal, CISSP, CCSP, CISM https://www.linkedin.com/in/iftikhariqbal/
  • 50. PROOF OF CONCEPT (POC) Sanctioned SaaS – End User Experience
  • 51. 51 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive, Exchange Online USERS Everyone RULES Redirect Managed Clients (Device Certificates) EXCEPTIONS - RESPONSE Allow Service Activities POC: CLOUD ACCESS CONTROL MVISION Cloud
  • 52. 52 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive, Exchange Online USERS Everyone RULES Unmanaged Clients trying to Download EXCEPTIONS - RESPONSE Block Downloads POC: CLOUD ACCESS CONTROL MVISION Cloud
  • 53. 53 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive USERS Everyone RULES High Severity for Credit Card Data EXCEPTIONS - RESPONSE Quarantine for High Severity | Send Email to User MVISION Cloud POC: DATA LOSS PREVENTION
  • 54. 54 May 19 to May 22 2019 BUSINESS LOGIC SERVICES Exchange Online USERS Everyone RULES High Severity for Credit Card Data | Daily Scan EXCEPTIONS - RESPONSE Monitor for High Severity | Send Email to Admin MVISION Cloud POC: ON-DEMAND SCAN
  • 55. 55 May 19 to May 22 2019 BUSINESS LOGIC SERVICES SharePoint Online, OneDrive USERS Everyone RULES High Severity for Collaborated Confidential (classification) Files EXCEPTIONS - RESPONSE Block for High Severity | Send Email to Admin POC: CONTENT COLLABORATION MVISION Cloud
  • 56. PROOF OF CONCEPT (POC) Sanctioned IaaS – Admin Experience
  • 57. 57 POC: RECOMMENDATIONS – ACTIVITY MONITORING Monitor the activity of the users within your organization and detect risk trends for the entire organization over time. Break down individual usage over activity, time, users, and role development. Users with administrative access have the greatest access to sensitive data and user information, ensure they have only the necessary access and permissions to perform the required job.
  • 58. 58 POC: RECOMMENDATIONS – SECURITY AUDIT CONFIGURATION Regularly run security audit configuration scans. Review incidents and make remediations based on your requirements such as company security policy, best practices and benchmarks. After taking remediation measures run scan again to ensure that same violations are not being produced. Remediation strategy could be based on resolving High Severity incidents first, resolve all incidents affecting CIS Level benchmarks (High, Medium and Low) or as per organization’s risk appetite. MVISION Cloud provides remediation steps within the incident details.