Sumo Logic ahead of the packRead article
Complete visibility for DevSecOps
Reduce downtime and move from reactive to proactive monitoring.
Today’s businesses spend more money on SaaS tools than on laptops. On average, today’s employees use a minimum of eight different SaaS tools. The security implications of this robust cloud landscape cannot be neglected and we trust you are fully aware of it already.
As an IT leader, you are responsible for keeping your company’s cloud infrastructure secure, but with the multitude of cloud apps businesses use on a daily basis, you have less and less control of that security landscape. As security solutions proliferate to respond to the diversity of needs, it’s becoming increasingly difficult to grasp all the needs and decide which solution will be most effective at eliminating all the risks your organization faces.
In this article, we take a look at two popular solutions that security professionals often resort to: Cloud Access Security Broker (CASB) and Cloud Security Information and Event Management (SIEM) solutions. In particular, we will discuss:
Gartner defines cloud access security brokers (CASBs) as “on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed. CASBs consolidate multiple types of security policy enforcement. Example security policies include authentication, single sign-on, authorization, credential mapping, device profiling, encryption, tokenization, logging, alerting, malware detection/prevention and so on.”
In essence, CASBs secure data flow between your organization and the cloud vendor, according to your organization’s security policies. They encrypt data to prevent malware and thus protect your system against cyberattacks.
The four main functionalities of CASB are (also defined by Gartner):
We investigate whether these functionalities are enough to guarantee security of your SaaS apps in the next section.
There are two different ways to deploy CASBs (each affects their performance differently; read on to find out how):
CASBs allow you to see the data on security threats that occur when cloud apps are in use. They report in real time when an account is compromised and confidential data is exposed and offer some features for threat protection and remediation.
At the same time, CASBs lack broader visibility across your entire SaaS (and IaaS!) architecture; the top priority of SaaS security. Alone, CASBs are siloed solutions that simply are not enough to keep your infrastructure secure. Without complete visibility, you will not be able to automate detection and response of threats, misconfigurations and violations.
When we talk about CASBs, we have to acknowledge that these are point tools and as such their protection range is limited. CASB is essentially a visibility and policy control point that sits between your users, your organization and the cloud. CASB solutions focus exclusively on the cloud. They offer deep analytics and a wide variety of controls for cloud services, but their coverage does not go beyond the cloud infrastructure. As such, their scope of coverage is limited to various points within the cloud.
Additionally, proxy-based CASBs actually limit the visibility of what’s in your cloud. They miss data shared by people outside your organization (be it customers or collaborators); they cannot monitor your desktop, nor API connections to third-party SaaS. But what’s most ironic is the fact that if the proxy goes down, the only people who have access to your data will be outside collaborators.
If you want to secure data in intranet applications and services, CASB is not your best choice. If your organization shares data between computers connected to LAN, they will not be covered, since they aren’t cloud-based.
Most CASB solutions are hard to install. In addition, they will only work well on devices managed by your organization. Your security professionals must have a thorough understanding of the organization’s use cases and a host of IT skills to be able to manage them properly.
It’s hard to decide which CASB solution to pick for any one organization; there are no universal criteria and oftentimes you are being warned that you need to do your own thorough research before picking the right solution. You can find more examples of what’s already been written on this topic here.
While CASBs add some features to firewalls, they should not be replaced by them. Firewalls are still crucial for providing visibility to network traffic and do a great job at blocking bugs.
Both CASB and SIEM solutions secure your cloud infrastructure, but there are clear differences in how they cover your SaaS tools.
Cloud SIEM collects data from many different sources, not just from the cloud. These include: your on-premise applications, databases, web proxies, network switches, routers, data loss prevention and more. They filter through and correlate event logs across the different systems, informing you of threats in real-time, thus allowing you to respond to them in the shortest amount of time possible.
whereas SIEM is a consolidated tool that extends the cloud to cover your entire business infrastructure. It offers early attack detection through real-time data analysis, whereas CASBs only cover certain points within the cloud and inform you about the usage of your SaaS tools. Further, proxy-based CASBs only secure SaaS cloud services, leaving IaaS and PaaS clouds vulnerable.
Employees sign up for all kinds of SaaS tools unaware of the consequences. As a security professional, you need to have full visibility into what applications just entered your environment, how they entered and how to remove them quickly.
If your organization uses, say, G Suite for example, and has other SaaS tools, it will certainly need a solution that both secures them and gives you visibility and control over them; you will need a solution that can do more than CASB.
While CASBs do add value to your existing security infrastructure, they should not be treated as your first line of defense. You can use this solution to augment your existing security infrastructure.
When it comes to securing your SaaS apps, ensuring full visibility of what is going on within your cloud should be your top priority. With Sumo Logic Cloud SIEM, you can have an integrated view across your hybrid and multi cloud infrastructure. A cloud-native tool is better for SaaS and extends beyond it, to ensure maximum protection.
For more information on how to secure your SaaS apps, refer to our earlier post on this topic.
Reduce downtime and move from reactive to proactive monitoring.
Build, run, and secure modern applications and cloud infrastructures.Start free trial
Moving to the cloud offers more than economics; it comes with unique security challenges that on-premises solutions cannot address. In minutes, Cloud Infrastructure Security for AWS from Sumo Logic brings cloud-native security analytics to AWS cloud environments. Curated workflows, out-of-the-box dashboards and AI-driven anomaly detection help security personnel easily monitor cloud security posture and cloud configurations and manage cloud risk from a centralized platform.
The principles of data protection are the same whether your data sits in a traditional on-prem data center or in a cloud environment. The way you apply those principles, however, are quite different when it comes to cloud security vs. traditional security. Moving data to the cloud introduces new attack-surfaces, threats, and challenges, so you need to approach security in a new way.