Mastering cloud app control, Part 1: Locking down access

When it comes to managing cloud application usage in an organization, the challenges are anything but simple. On one side, users are constantly exposed to malicious links and risky apps. On the other, locking things down too tightly by broadly blocking access to services can cripple employee productivity.

Ideally, you'd want a balance between security and productivity. But in practice, many security teams fall back to a shotgun approach—casting a wide, unfocused net of controls to cover every possible risk.

This three-part blog series presents a three-fold strategy for securing cloud applications—each part tackling a distinct control layer: Access control, login control, and data control. Together, they make cloud apps both safe and productive—without relying on blunt-force strategies.

Part 1: Access control

Today’s digital workplace is more connected than ever, but it's also more vulnerable—filled with distractions and dangers, ranging from high-risk cloud apps to malicious sites disguised as productivity tools. Lack of proper visibility and control over employees' internet usage can lead to data leaks, compliance violations, and productivity loss. Application access control has become an essential tool for IT and security teams to reduce attack surfaces and maintain policy consistency across departments.

Scenario

SinaraTech is a fast-growing mid-sized ecommerce company. Cloud adoption is naturally at an exponential pace. Developers, marketers, HR teams—everyone is tapping into cloud apps to move faster and collaborate better. But within a month, the SOC team noticed more than 500 different cloud applications in use across departments on a daily basis—many of them unsanctioned, some even dangerous. For example:

• Developers were collaborating with strangers on GitHub and Bitbucket.

• Marketers had been using Canva and Hootsuite, syncing their personal accounts.

• Several employees had unknowingly accessed phishing and spam sites.

• A few slackers were regularly visiting social media and video streaming services at work.

What started as convenience had grown into a fragmented, risky unmanaged cloud ecosystem. Shadow IT had officially become a problem!

The SOC team had to do something.

Strategy

Access control was the first line of defense.

With over hundreds of cloud apps in use, the team needed a practical way to decide what stayed in use and what got blocked. They incorporated a CASB, which took a layered approach to curb the usage of unsanctioned and dangerous apps by:

• Blocking risky app categories: To start off, high-risk categories like gambling, adult content, unauthorized file-sharing, and scam sites were blocked outright.

• Deploying reputation and risk intelligence: A threat intelligence engine to automatically flag cloud apps with low reputation scores, such as phishing, spam, and malware sites, was deployed.

• Striking a balance between plug-and-play and tailored controls: A strong set of preconfigured policies—built to block the most common unsafe and non-work-related apps were enabled, with provisions to be fully customizable, allowing fine-tuning based on team needs, use cases, and user behavior.

Now, the developers cannot share proprietary pieces of code outside the corporate network, marketers cannot use external tools to create presentations containing confidential information, and unproductive employees cannot stream movies at work.

Results

In just two weeks, shadow IT incidents saw a sharp decline. The clarity around what apps were allowed and what posed risks made employees more accountable, while the SOC team gained clear visibility into safe web usage and handled additional access requests in a structured, efficient way.

Check out how your SOC team can replicate these results in your environment with ManageEngine DataSecurity Plus.

But the problem isn't fully solved yet.

Access control helped reduce the obvious risks—but it was just the start. Because new problems arose, the SOC team was again put on the task. We'll learn what those problems were and how they fixed them in part 2!