This article discusses how to use the Cloud Apps Dashboard to get a quick overview of the cloud apps usage and risk analysis in your network. You can then drill-down and analyze the traffic in the Application Analytics screen.
As part of Cato's Cloud Access Security Broker (CASB) solution, the Cloud Apps Dashboard lets you quickly view the cloud app activity in your network. The dashboard contains a number of widgets that provide visibility and analytics including:
-
Potentially risky apps
-
Sanctioned vs. unsanctioned apps (according to number of users or total network usage)
-
Top apps (according to number of users or total network usage)
-
Total network usage
Some widgets let you drill-down and see the data automatically filtered in the Application Analytics screen.
The Cloud Apps Dashboard is included in the CASB license. For more about purchasing the CASB license, please contact your Cato representative.
Industry standards for CASB policies distinguish between sanctioned and unsanctioned apps that are used in your organization. Some widgets in the Cloud Apps Dashboard let you research the usage for sanctioned and unsanctioned apps, and shows the relevant analytics.
Sanctioned apps are approved and generally represent an understood and acceptable level of risk. The IT staff has researched these apps, and allow employees to use the company’s network to access the services in the cloud. Salesforce.com, Office365, and Zoom are some examples of sanctioned apps. Use the Categories screen to define the cloud apps which are sanctioned by your organization (see below, Defining Sanctioned Apps in the Categories Screen).
Unsanctioned apps constitute an unknown risk, however they are not necessarily malicious or a definite security risk. The Cloud Apps Dashboard can give you more insight into the traffic of unsanctioned apps and help determine if an app meets the security requirements for your organization.
Cato assigns each app a Risk Score between 0 (no risk) to 10 (very high risk) to help you evaluate if the app meets the requirements of your security policy. Cato uses an in-house artificial intelligence engine to analyze the relevant data and metrics and generate the Risk Score, including:
-
General, Compliance, and Security data (shown in the App Catalog)
-
Sentiment analysis (machine learning technique) based on recent news articles regarding the company
-
Information about relevant software vulnerabilities and breaches
-
Internal threat intelligence and domain related information from the Cato Research Labs
The Risk Score is divided into the following risk levels:
-
Low - apps with a Risk Score between 0 - 3
-
Medium - apps with a Risk Score between 4 - 6
-
High - apps with a Risk Score between 7 - 10
The Cloud Apps Dashboard contains a number of widgets that present an overview of the app usage and risk level in your network.
For more information about using the dashboard, see Configuring Filters to Analyze Dashboard Data and Setting the Time Range Filter. The maximum date range for the dashboard is 90 days.
You can decide which apps used by your organization are categorized as Sanctioned Apps. The following sections explain how you can add sanctioned apps directly from the Cloud Apps Dashboard, or in the Categories screen.
The pop-up menus in the Top Apps widget let you easily add an app to the Sanctioned Apps category without using the Categories screen.
The Categories screen contains a section that lets you define the sanctioned apps for the account. After you define the sanctioned apps, you can go to the Cloud Apps Dashboard and view the analytics for the sanctioned vs. unsanctioned apps. You can choose to add Cato's predefined apps, or custom applications that you previously configured, see Working with Custom Apps.
To define a Sanctioned App in the Categories screen:
-
From the navigation panel, click Resources > Categories.
-
Click Sanctioned Apps.
The Add Sanctioned Apps panel opens.
-
In the Members drop-down menu, select Application or Custom Application.
-
Select or enter the app your are adding as a sanctioned app.
-
Click Apply.
This section explains the widgets that are available in the Cloud Apps Dashboard. The data in the dashboard is based on the configured time range.
These are the widgets:
-
High Risk Apps - Shows the number of new high risk apps used in the network.
-
Discovered Apps - Total number of apps used.
-
Total Users - Total number of users and hosts that accessed a cloud app.
-
Network Usage - Total volume of data transferred for all cloud apps in your network.
-
Top Apps - Select the criteria to show the top apps according to the chosen priority:
-
Unsanctioned only, Sanctioned only, or All apps
-
Risk Score, network Usage, or Users
Click the Users for an app, to drill-down and show user analytics data for this app in the Application Analytics screen. Click an app to show the information for that app in the Cloud Apps Catalog.
Hover the mouse over the row for the app and then open the app options menu and select one of the following actions:
-
Go to Apps Catalog - Opens the Apps Catalog screen pre-filtered for the app
-
View App Analytics - Opens the Application Analytics screen pre-filtered for the app, and lets you drill-down and analyze the app usage
-
Add to sanctioned apps - See Adding a Sanctioned App from the Cloud Apps Dashboard above
-
-
Apps Risk Breakdown - Discovered Apps classified according to their high, medium, or low Risk Score.
Click on a Risk Score in the widget to drill-down and show the Application Analytics screen filtered for those apps.
-
Sanctioned vs. Unsanctioned Apps - Discovered Apps classified according to:
-
Usage - Network Usage classified according to sanctioned and unsanctioned apps.
-
Users - Total users classified according to sanctioned and unsanctioned apps.
Click on Unsanctioned or Sanctioned apps in the widget to drill-down and show the Application Analytics screen filtered for those apps.
-
-
Top Categories - Shows the top System categories that contained the apps with the most Network Usage.
-
Unsanctioned Apps - Total number of unsanctioned apps that were accessed:
-
According to the app Risk Score (you can select more than one Risk Score).
-
Traffic direction - upstream, downstream, or both.
-
-
Apps Headquarters - Geographical map that shows country where the HQ for the app is physically located.
Click a physical location in the widget to drill-down and show the Application Analytics screen filtered for those apps.
0 comments
Article is closed for comments.