Symantec CloudSOC

Seite 1

CloudSOC - Sales Expert

New Challenges

Proliferation of Cloud Apps

Variety of Endpoints

Shadow Data Problem

25% of Cloud Docs are broadly shared - these can contain confidential and sensitive data

Within the enterprise perimeter:

Risk Assessment

Intrusion Detection

Malware Detection

Proxy/Firewall

Data Loss Prevention

Incident Response

Investigations

CASB is the Symantec name for CloudSOC

It offers visibility over what users are doing along with data security and threat protection.

Forrester Wave named Symantec leader with the highest score in current offerings in Cloud Security Gateway (CASB) 2016

CASB 2.0

User Authentication - SSO & Adaptive Authentication

Web Security - ProxySG & WSS for Shadow IT Control

Endpoint Security - SEP for Shadow IT Visibility

Data Loss Prevention - Symantec DLP for Cloud Content

ATP - Malware, Crimeware, Ransomware & Sandboxing for Cloud Content

Encryption - User-based selective encryption for Cloud Content

Seite 2

Who Should You Talk To?

Go as high as you can: the final decision is made or approved at the Executive Layer or CISO

Often one department is the buyer; depending on use case

Many departments can influence the buyer; leverage your relationships

After purchase; the trio who does most of the work running the solution. (eg IT Security Analyst, Network Security Architect, DLP Manager)

Conversation Starters

Are you using or planning to adopt any cloud apps?

Answer: "I don't know"

Can we help you make sure you are not?

You likely have some cloud app use in your organisation. On average, organisations discover they are using 928 cloud apps.

We've had customers certain they were not using cloud apps, who discover thousands of apps in use by their workforce.

Take a look at CloudSOC Audit and ProxySG/WSS with AppFeed, and the integration with SEP.

Answer: "Yes"

What cloud apps do you use?

Are you doing anything to make sure confidential data shared in that app doesn't get exposed?

If Office 365, Google Apps, Box, Dropbox, or Salesforce....

I'd like to offer a free Shadow Data Risk Assessment for one of these apps.

Take a look at CloudSOC Securlets & Gateway, and integration with DLP, VIP & ICE.

Seite 3

Other Important Conversation Starter

Does your customer already use any Symantec or BlueCoat products?

Answer: SWG

If ProxySG or WSS...

Would you like to discover and control use of Shadow IT in your organisation?

On average, organisations discover about 928 cloud apps in use.

I'd like to offer a free Shadow Data Risk Assessment. You can leverage your ProxySG and/or WSS with CloudSOC CASB for visibility and control over the use of cloud apps.

Introduce AppFeed and CloudSOC Audit.

Answer: DLP

Would you like to extend your DLP to govern confidential data in cloud apps?

On average organisations have 25-27% of cloud-stored files and emails that are exposed.

What apps do you use?

If use Office365, Google Apps, Box, Dropbox, or Salesforce...

I'd like to give you a free Shadow Data Risk Assessment. You can remediate exposures and extend your existing DLP to the cloud with CloudSOC CASB for data security.

Introduce CloudSOC Securlets & Gateway and DLP Cloud intergration, be sure to mention integration with VIP & ICE too.

Audit Shadow IT Cloud App Visibility

Identify & analyze risky Shadow IT

Make smart app choices

Understand cloud app usage

Uncover opportunities for cost and optimization

Continuously monitor app usage and track compliance

"Find what cloud apps my users access and how risky they are."

"Ensure corporate policy compliance by monitoring cloud app usage."

"Identify redundant subscriptions and overspend in the cloud."

Seite 4

Govern Data in Cloud

Identify & Remediate risky exposures

Leverage ContentIQ to automatically classify sensitive content

Define granular content-based and context-based policies; - users, device, location, file properties, access properties, content, activity, threat score

Enforce access controls to govern use of cloud apps; - block upload/download, quarantine, alert - encrypt files with SafeNet integration

"Don't allow PII content to be shared outside the company."

"Don't allow sensitive content uploaded to personal accounts."

"Automatically identify and track confidential content in the cloud."

Field-Level Encryption & Tokenization

CDP Solution

Use Case; Data Privacy regulations (e.g. GDPR), Data residency requirements

Key Features; Data never exposed clearly in the cloud, preserve app functionality and enterprise owns keys

"Encrypt or tokenize data fields in Salesforce, ServiceNow & Oracle."

Intelligent Threat Protection

Leverage user behaviour analytics to identify malicious behaviour

Use dynamic ThreatScore to trigger policies alerting admins or quarantining activity

Detect and Prevent malware in the cloud

Track advanced data exfiltration attacks with Sequence Detectors

"Alert the security admin if a user account exhibits suspicious behaviour."

"Identify the users who pose the most cloud risk to the organisation."

"Quarantine user accounts that appear to be hacked."

Incident Analysis and Response

Powerful Visualization and Search Tools; - free-form search, advanced query language, pivot tables, dynamic filters

Real-time analysis of "Big Data"

Export to HP/Arcsight, IBM/QRadar or CSV

"What happened, who was involved and were we compromised?"

Seite 5

When do I sell Securlet and when CASB Gateway?

API-based Securlet for sanctioned corporate cloud app accounts, easy deployment, fast remediation

Gateway is an expansion that most customers take after Securlet

Gateway for both sanctioned & unsanctioned cloud app accounts - corporate and personal in-line and real-time protection

When do I sell CloudSOC ContentIQ standalone and when with Symantec DLP

Integrated Symantec DLP is good for existing DLP customers, looking for extended coverage to the cloud or replace legacy DLP solutions.

ContentIQ is good for customers who do not already have DLP, and are not ready or resourced for a full multi-channel DLP solution

Go after standalone CASB opportunities with confidence we have a superior solution with ContentIQ, and we can pull in other Symantec technologies later

Competitiors for CASB

Skyhigh

Cannot monitor unsanctioned apps and personal accounts

Standalone start-up company struggling for financing

Netskope

Low score on Forrester Wave

Standalone start-up company - longevity unsure

Microsoft

Cannot monitor unsanctioned apps and personal accounts

Mostly focused on Office365 not security

History of offering weak security products

CloudLock

Poor Shadow IT discovery, can only discover cloud apps associated with sanctioned apps

Cannot monitor unsanctioned apps and personal accounts

SYMANTEC ONLY:

Only CASB with Symantec integrations

Superior DLP with ContentIQ

Superior UBA

Superior for incident response

Seite 6

What encryption solution integrates with CloudSOC?

Symantec Information Centric Encryption (ICE)

Symantec Managed Security Service offers a CloudSOC Connector for log collection

True

What platforms are protected by CloudSOC

SaaS and IaaS

CloudSOC offers API-based integration with the most popular cloud application platforms

True

Cloud Data Protection encryption and tokenization protects Salesforce, Oracle and ServiceNow

The unique benefit of CloudSOC and Symantec VIP is adaptive user authentication

CloudSOC Audit has the capability to monitor shadow IT use of cloud apps

CloudSOC uses CASB Gateway to inspect data and enforce policy controls inline on transactions with cloud apps

Free service for unsanctioned cloud apps by employees - Shadow IT Risk Assessment

Risk of confidential data stored in cloud - Shadow Data Risk Assessment

CloudSOC ContentIQ delivers DLP Data Governance

SWG integrates with CloudSOC Audit for control of Shadow IT

Audit SWG

securlet DLP