CensorNet Cloud Security Platform

The widespread availability of cloud services and the growth of mobile and personal devices have made security and compliance harder for organizations. Employees can use personal cloud tools for work without approval, and business units can procure cloud services without risk assessments, creating “shadow IT” and compliance exposure. Key concerns include where data is stored and processed, the possibility of cloud provider staff accessing customer data, lawful government access to data without customer permission (illustrated by revelations about U.S. government access to Yahoo emails), and the impact of GDPR for organizations holding personal data about people in Europe.

A governance-led approach to cloud usage is required, but it must be supported by technology that provides visibility and enforceable controls. Cloud Access Security Brokers (CASBs) are positioned to deliver these capabilities, especially around detecting cloud service usage, controlling access and data movement, protecting against cyber risks, and supporting compliance with pre-built and ideally certified controls.

CensorNet Unified Security Service (USS) is presented as a multi-functional cloud security platform combining web security, email security, cloud application control, and adaptive multi-factor authentication. Its Cloud Application Control module discovers, monitors, and enforces policies for cloud and on-premises applications via a gateway and optional agents, supporting BYOD and multiple proxy deployment options. It uses a continuously updated cloud application database, baseline risk ratings, and extensive reporting (including 42 preset charts and custom report building). Policy enforcement can be coarse or highly granular, tied to user identity, Active Directory groups, device context, and network conditions, down to specific in-app actions. USS adds layered malware and phishing defenses, HTTPS inspection, and Office 365 controls, plus monitoring and reporting aligned to common compliance needs. Noted gaps include lack of integrated cloud data-at-rest encryption and lack of content-based control over data stored in cloud services.

• Employees and associates can use personal cloud services for work without reference to their employer.
• Line-of-business managers can acquire cloud services without performing a risk assessment or considering compliance impacts.
• GDPR came into force in May 2018.
• CensorNet is headquartered in Basingstoke, UK, with offices in Austin, San Francisco, Copenhagen, and Munich.
• CensorNet Unified Security Service integrates web security, email security, CASB capabilities, and adaptive multi-factor authentication.
• Cloud Application Control is delivered as a cloud service to discover, monitor, and control cloud application usage.
• The reporting features include 42 pre-set charts across malware, cloud applications, web, and email services.
• Reports can be exported to Excel or PDF and automated reporting can email customized reports.
• URL reputation coverage spans over 140 categories of web content.
• CensorNet Unified Security Service can enforce the use of TLS for email but does not provide integrated encryption for data stored in the cloud.

• “To meet these challenges, organizations need to take a governance led approach to the use of cloud services.”
• “However, this approach needs technology support to give visibility and to enforce controls.”
• “Detect Cloud Service Usage– the use of cloud services which have not been subject to an organizational assessment of the compliance risks and data protection requirements is a common concern for many organizations.”
• “Employees should easily be able to access approved services and prevented from moving important data to non-approved services.”
• “A gateway at the network captures all traffic from domain, non-domain, guests and bring your own devices (BYOD).”
• “CensorNet’s Cloud Intelligence Team maintains a continuously updated database of cloud applications grouped into categories according to function.”
• “Policies can also be set and enforced at a granular level specifying, for example, the particular actions allowed according to location or device, as well as role.”
• “CensorNet Multi-Factor Authentication is adaptive, real-time, challenge-based and session-specific.”
• “Deep HTTPS inspection allows SSL encrypted content to be scanned for malware.”
• “However, you can only govern what you know you are using, and many organizations are unaware of the extent to which cloud services are being exploited.”