Symantec CloudSOC™

Short Summary

Organizations are rapidly adopting cloud services for faster deployment, flexibility, and cost advantages, but cloud usage often sits outside established IT access governance. While on‑premises access is usually controlled, cloud services—including personal “shadow IT” tools and mobile access from outside the network perimeter—create gaps in oversight. These gaps raise compliance and cyber-risk concerns, especially where laws and regulations require control over personal data transmission, processing, and storage, as highlighted by GDPR-driven requirements. Uncontrolled cloud usage can also enable adversaries to steal or corrupt cloud-held data or introduce malware that later infects the organization.

Because traditional governance and security tools were slow to extend full cloud controls, CASBs emerged to detect cloud usage, control access to approved services, protect against threats (including malware and data leakage), and support compliance through regulation-aligned capabilities. KuppingerCole recommends CASBs that combine discovery, policy-based control, cyber protection (potentially including encryption/tokenization despite SaaS functional tradeoffs), and compliance features that are ideally certified or evidenced in real deployments.

Symantec CloudSOC, built from Blue Coat and Elastica technology and integrated with Symantec’s broader portfolio, is positioned as a second-generation CASB delivered as a cloud service. CloudSOC Audit analyzes firewall/proxy logs (optionally anonymized via SpanVA) to identify shadow IT and assess cloud apps using 100+ security attributes plus user behavior analytics. CloudSOC Security for SaaS uses API and gateway controls (“Securlets” and “Gatelets”) to enforce granular policies, classify and protect sensitive data (ContentIQ), monitor activity (StreamIQ), and compute user-centric risk scores (ThreatScore). Integrations extend capabilities through DLP, encryption, tokenization that preserves application behavior, endpoint protection, strong authentication (VIP), and threat protection. Key challenges include complexity across multiple products and the lack of comprehensive access governance reporting across on‑premises and cloud services.

Interesting Facts

• Symantec announced the intention to acquire Blue Coat in June 2016 and completed the acquisition on August 1, 2016.
• Symantec is headquartered in Mountain View, California.
• Symantec CloudSOC is delivered as a cloud service.
• CloudSOC Audit ingests logs from firewalls and other security proxy devices to analyze shadow IT usage.
• SpanVA can anonymize and compress log data on-premises before logs are streamed for analysis.
• Cloud app risk scoring in CloudSOC Audit uses 100+ objective security attributes based on Symantec threat intelligence.
• CloudSOC Security for SaaS supports sanctioned platforms including Office 365, G-Suite, Box, Dropbox, Salesforce, AWS, and Azure.
• StreamIQ can export extracted activity data in CEF, CSV, and LEEF formats to SIEM platforms.
• Symantec tokens are randomly generated strings and require access to a look-up table to map back to clear text.
• Cloud Data Protection Gateway tokenization was assessed by Coalfire, a PCI DSS QSA and FedRAMP 3PAO, for compliance with PCI DSS tokenization standards.

Notable Quotes

• “In an ideal world, the functionality to manage access to cloud services and to control the data that they hold would be integrated with the normal access governance and cyber security tools used by organizations.”
• “The uncontrolled use of cloud services also increases cyber-risks; cyber adversaries may obtain unauthorized access to steal or corrupt data held in these services.”
• “Detect Cloud Service Usage– Identifying the cloud services being used from within an organization and providing control over their use is a key capability to manage risk.”
• “Access to the cloud services should be controlled so that business critical and regulated data can only be moved into approved cloud services.”
• “Encryption and tokenization of data can impact on the functionality of SaaS applications.”
• “This approach provides organizations with a common interface to manage the access policies for the sanctioned apps.”
• “Since the product correlates data obtained through both APIs and Gateway, this enables it to deliver more granular controls than would otherwise be possible using either in isolation.”
• “Integration between Symantec CloudSOC and Symantec DLP enables customers to leverage their existing on-premises DLP policies and workflows to extend protection to include content in cloud services.”
• “One of the problems with both encryption and tokenization of application data is that this disrupts the normal operation of the application.”
• “Organizations need a way to provide consistent access governance for both on premise and cloud based services.”