Skyhigh Cloud Security Platform

Short Summary

The rapid adoption of cloud services and the proliferation of devices used to access them have created major security and compliance challenges. Employees can use personal cloud tools for work without employer oversight, and business units may procure cloud services without formal risk assessment, pushing IT to approve services quickly and sometimes overlook key security issues. Prominent concerns include where data is stored and processed, whether a Cloud Service Provider (CSP) or its staff can access that data, how governments can legally compel access without customer permission, and the impact of GDPR (effective May 2018) on organizations handling European personal data.

A governance-led approach is presented as essential, but it must be supported by technology that provides visibility and enforceable controls. Cloud Access Security Brokers (CASBs) are positioned as the enabling toolset, expected to detect unassessed cloud usage (shadow IT), control access so regulated and critical data flows only into approved services, protect against threats and data leakage, and support compliance via built-in regulatory-aligned capabilities and evidence of real-world compliance outcomes.

Skyhigh Networks’ Cloud Security Platform is described as closely matching these CASB requirements through visibility, control, data security, compliance, and broad integration. It offers a continuously updated registry of over 20,000 cloud services with trust ratings based on 50+ risk attributes, workflows for access requests and service approval, and usage analytics to expose policy gaps. For cyber risk protection it combines proxy-based interception and API integrations, captures detailed audit trails, and applies anomaly detection with tunable machine-learning sensitivity and resolution workflows. For data security and compliance it audits cloud configurations, provides DLP and policy templates, and encrypts data (including retroactive encryption) while keeping encryption keys on-premises and within the customer’s jurisdiction. A key challenge is dependence on CSP APIs and traffic methods, which can change and disrupt integrations.

Interesting Facts

• Employees and associates can use personal cloud services to perform work without reference to their employer.
• Governments can legally require access to data being processed in cloud services without seeking permission from the cloud customer.
• GDPR came into force in May 2018.
• Skyhigh maintains a centralized, continuously updated registry of over 20,000 cloud services.
• Skyhigh’s risk assessment of cloud services is based on 50 discrete attributes.
• Skyhigh provides an integrated Data Leakage Prevention (DLP) engine.
• Skyhigh encrypts data before it is uploaded so that no clear text is stored in the cloud.
• Skyhigh can scan for sensitive content already stored in cloud services and retroactively encrypt it.
• Skyhigh integrates with key management using the Key Management Interoperability Protocol (KMIP).
• Skyhigh supports federated authentication with identity providers including Active Directory Federation Services, Okta, OneLogin, and Ping Identity.

Notable Quotes

• “To meet these challenges, organizations need to take a governance led approach to the use of cloud services.”
• “However, this approach needs technology support to give visibility and to enforce controls.”
• “However, you can only govern what you know you are using, and many organizations are unaware of the extent to which cloud services are being exploited.”
• “Employees should easily be able to access approved services and prevented from moving important data to non-approved services.”
• “Skyhigh maintains a centralized and continuously updated registry of over 20,000 cloud services along with a detailed risk assessment of each service.”
• “Skyhigh encrypts data before it is uploaded to a cloud service, ensuring no clear text is ever stored in the cloud and that the cloud provider cannot decrypt the data.”
• “During this process, data encryption keys always reside in the customer’s jurisdiction, ensuring that no third parties can decrypt the data.”
• “Skyhigh includes a built-in threat resolution workflow for security teams to resolve incidents within the Skyhigh console.”
• “This approach helps to reduce the number of false positives.”
• “This creates a risk that any change to these by the CSP could impact adversely on the functionality provided and Skyhigh has to keep up with any changes that they may make.”