InfoSec Musings: July 2016

In April of last year, I wrote a technical comparison of the various players in the CASB (Cloud Access Security Broker) space, and had such incredible response and discussion, that I felt I had to provide an update this year. Should be easy, right? WRONG!

(Read the above article if you are new to CASB and want an understanding of the space)

The CASB market has seen a lot of turmoil over the past year, in the form of mergers and acquisitions. Early on we all thought Cisco was going to acquire Elastica as they had become quite cozy, but in a screeching left turn, BlueCoat came from the sidelines, and snapped Elastica up. The surprise here is that earlier in June of 2015, BlueCoat had just acquired CASB player Perspecsys. Fast forward to June of this year, when BlueCoat announced their intent to IPO, then only days later agrees to be acquired by Symantec for $4.65B. Whew...

In a similar roller coaster, Adallom cozies up with HP in April 2015, only to get bought by Microsoft in September. Then just last week, Cisco, not to be left out of the CASB market announced their intent to acquire Cloudlock for $293Million.

Also in recent news, Skyhigh Networks obtained a patent to use reverse proxies for cloud access security broker services, and Netskope obtains a patent for routing client traffic securely to Cloud Services. I'm not sure how this is going to change how the others model their business.

So to recap...

Last year, in the CASB space, we had:
Adallom, BitGlass, Ciphercloud, Cloudlock, Elastica, Imperva, Netskope, Perspecsys, and SkyHigh

This year, the landscape looks to be:
Bitglass, Symantec/BlueCoat, Cisco/Cloudlock, Ciphercloud, Imperva, Microsoft/Adallom, Netskope, and SkyHigh.

I closed last year's report with the statement:

"Although the CASB market space is still in it's infancy, the main players have done a good job defining - and meeting - most of the requirements of an off-premise security service. I'm interested to see what happens to this space over the next three years. My money is on convergence of CASB, SSO, and Mobile Security providers."

I still hold to this: Cloud SSO is what gives CASB the ability to understand context, and Mobile Security (Device Security, Application Security, Data Security) is required to manage endpoints outside of the corporate perimeter. Yet I'm not seeing those acquisitions as yet.

I think it's going to be an interesting challenge to to update last year's report. Stay tuned.

NOTE:

I am currently in the process of evaluating the technical controls published by the current players in this space and will be re-publishing this report in the near future.

If you are a current CASB provider that I have missed here, and want to be included in the upcoming report, please comment below or email me at unix_guru at hotmail dot com, and I will contact you for validation.

InfoSec Musings

Search This Blog

Tuesday, 12 July 2016

Turmoil in the CASB market - 2016 the year of Big Business Acceptance