Transcription
For Security & Risk ProfessionalsThe Forrester Wave : Cloud Security Gateways,Q4 2016The Eight Providers That Matter Most And How They Stack Upby Andras CserNovember 15, 2016Why Read This ReportKey TakeawaysIn our 23-criteria evaluation of cloud securitygateway (CSG) providers, we identified the eightmost significant ones — Bitglass, Blue Coat/Symantec, CipherCloud, CloudLock/Cisco,Imperva, Microsoft, Netskope, and SkyhighNetworks — and researched, analyzed, andscored them. This report shows how eachprovider measures up and helps security and risk(S&R) professionals make the right choice.Blue Coat/Symantec And Skyhigh NetworksLead The PackForrester’s research uncovered a market in whichBlue Coat/Symantec and Skyhigh Networks leadthe pack. CloudLock/Cisco and CipherCloud offercompetitive options. Imperva, Bitglass, Netskope,and Microsoft lag behind.S&R Pros Want Activity Monitoring And DataProtectionThe CSG market is growing because moreS&R professionals see CSG as an effective andsimple way to address their top cloud securitychallenges, and they increasingly trust CSGproviders to act as strategic partners, advisingthem on top cloud security decisions.Encryption And Partner Ecosystems Are KeyDifferentiatorsAs on-premises network security tools becomeoutdated and less effective, improved behavioraland cloud malware detection and data lossprevention will dictate which providers willlead the pack. Vendors that can provide dataencryption, a large implementation, and a partnerecosystem position themselves to successfullydeliver cloud security to their customers.forrester.com
For Security & Risk ProfessionalsThe Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack Upby Andras Cserwith Stephanie Balaouras, Salvatore Schiano, and Peggy DostieNovember 15, 2016Table Of Contents2 CSGs Provide Integrated Data ProtectionAnd Activity MonitoringCSGs Intercept Traffic And Monitor CloudPlatform APIs4 CSG Evaluation OverviewEvaluated Vendors And Inclusion Criteria7 Vendor ProfilesNotes & ResourcesForrester conducted lab-based evaluations inAugust 2016 and interviewed 32 vendor anduser companies, including: Bitglass, Blue Coat/Symantec, CipherCloud, CloudLock/Cisco,Imperva, Microsoft, Netskope, and SkyhighNetworks.Related Research DocumentsGlobal Cloud Security Market Sizing AndForecast, 2015 To 2020LeadersStrong PerformersContendersChallengers12 Supplemental MaterialMarket Overview: Cloud Data ProtectionSolutionsAn S&R Pro’s Guide To Security To, In, And FromThe CloudVendor Landscape: Cloud Access SecurityIntelligence (CASI) SolutionsForrester Research, Inc., 60 Acorn Park Drive, Cambridge, MA 02140 USA 1 617-613-6000 Fax: 1 617-613-5000 forrester.com 2016 Forrester Research, Inc. Opinions reflect judgment at the time and are subject to change. Forrester ,Technographics , Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of ForresterResearch, Inc. All other trademarks are the property of their respective companies. Unauthorized copying ordistributing is a violation of copyright law. Citations@forrester.com or 1 866-367-7378
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack UpCSGs Provide Integrated Data Protection And Activity MonitoringAs companies move their workloads and data to the cloud, the question is no longer “Should we moveour data to the cloud?” but rather “What security precautions should we take to move our data to thecloud?”1 Forrester’s clients tell us that, at a minimum, they need to:›› Detect and intercept unusual or fraudulent activities associated with data in the cloud. Anormal pattern of behavior for sales reps at your firm might include accessing 10 to 15 customerrecords in Salesforce per day. If a sales representative accessed or downloaded several thousandrecords in a day, this is a sign of suspicious and likely fraudulent activity. It’s critical that S&R prosreceive alerts on this type of behavioral anomaly. After detecting such anomalous activity, S&R prosmay decide to intercept the user session and lock out the user to prevent a breach or exfiltration ofsensitive data. CSG solutions offer detection of anomalous activity.›› Detect, neutralize, and eliminate malware in cloud platforms. Box, Dropbox, and OneDriveare great cloud storage and productivity platforms. However, users can easily upload, store, anddownload files containing malware to cloud storage platforms. If left undetected, this malware canquickly spread throughout the enterprise. Traditional endpoint protection software can’t detectmalware sitting in or moving between cloud platforms. This malware will often allow hackers tocompromise the credentials of privileged admins who have unfettered access to Google Apps,OneDrive, etc., thus providing an easy way to siphon off sensitive corporate data. CSG solutionsoften provide the ability to detect, quarantine, and neutralize malware and malicious cloudapplications.›› Detect and monitor unsanctioned cloud applications and platforms usage. In largecorporations, although the company provides a sanctioned storage platform (for example,Google Drive), employees often use unsanctioned cloud applications (typically cloud storage andproductivity platforms such as Box, Dropbox, and OneDrive) to store and even share corporatedata. Unsanctioned use of cloud applications may lead to data loss, higher costs (as users may askto be reimbursed for unsanctioned application subscription costs), and a weakened governanceof cloud data. CSG solutions can detect traffic and file uploads to these unsanctioned platforms,giving S&R leaders and the CIO visibility into unsanctioned cloud apps.›› Protect against leaks of confidential information. Forrester’s interviewees tells us that employeesunwittingly leak valuable company data, such as spreadsheets with employee personally identifiableinformation (PII) or design diagrams containing intellectual property (IP), to cloud email and storageplatforms. This increases the chances of a data breach and jeopardizes future company plans andcompliance with such regulations as PCI, SOX, and HIPAA. Traditional data leak prevention (DLP)solutions deployed on-premises can’t extend coverage to data moving between cloud applicationsand platforms. CSG solutions with DLP specialize in this kind of coverage. 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-73782
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack Up›› Encrypt structured and unstructured data in cloud platforms. Cybercriminals can’t monetizeencrypted data by selling it on black markets, so there is little incentive to steal it. Centralized,selective, and configurable encryption of structured data fields in a cloud CRM solution or ofunstructured data in cloud platforms, both via the web and in native mobile applications, protectsdata. Many S&R pros tell Forrester that while their cloud platform provides built-in data encryption,they prefer to use a third-party CSG vendor for storage and management of encryption keys andsearch, filter, and sort indices of the data.›› Aid investigation of suspicious users and incidents. When a CSG solution detects unusual orsuspicious user activity or a data leak or malware incident, S&R professionals need an integratedresponse and investigation platform that allows for not just investigation (who did exactly what,when, and where) but also for visually reporting and trending of incidents in business-user-friendlydashboards. These tools can highlight massive unsanctioned use of cloud applications, help withtrends analysis, and improve the company’s security posture as it moves its data to the cloud.CSGs Intercept Traffic And Monitor Cloud Platform APIsCSG solutions: 1) intercept and monitor network traffic as it moves between the corporate network andcloud platforms and 2) monitor the APIs of cloud platforms (IaaS, PaaS, SaaS) to show how data entersand leaves these platforms (see Figure 1). Specifically, CSGs:›› Intercept user traffic from a mobile or desktop browser or native app to the cloud. CSGvendors’ solutions intercept this traffic by modifying the web proxy automatic configuration fileon the user’s device, installing a desktop plug-in, or working with a mobile device managementsolution. This ensures that traffic from the mobile device or desktop can only reach the cloudplatform through the CSG proxy and that it is not possible for the user to bypass the CSG proxywhen they access the cloud platform. Many CSG vendors also offer integration with secure webgateways or on-premises firewalls.2 CSG vendors partner with IDaaS solutions such as Microsoft,Okta, and OneLogin to use IDaaS solutions to steer traffic to the CSG gateway.3›› Look for unusual activity, malware, and DLP violations, and encrypt data. As the user’s trafficfrom their mobile device or desktop moves through the CSG proxy to the cloud platform, the CSGproxy examines the traffic and looks for: 1) unusual activity or actions; 2) malware patterns; 3) datapatterns that violate DLP rules; and 4) use of unsanctioned or nonsanctioned cloud platforms. TheCSG proxy talks to the CSG policy server, which in turn trends the data, reports the activity, andoffers investigation functionality to S&R pros. Optionally, the CSG proxy can also encrypt data intransit and encrypt it in storage but ensure that it remains searchable in the cloud platform. Onretrieval of data, the CSG proxy decrypts the data in transit.›› Monitor APIs and assess activities directly connected to the cloud platform. During initialsetup, an admin uses the firm’s administrative credentials in the cloud platform to establish abehind-the-scenes connection from the CSG API monitor to the cloud platform. From this point 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-73783
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack Upforward, using the cloud platform’s API, the CSG API monitor directly sees all data and useractivities. It intercepts not only data and user activities between the user’s desktop or mobiledevice and the cloud platform, but also activities between cloud platforms.FIGURE 1 High-Level Architecture Of CSG SolutionsInternet/cloudCloud platformsMobiledevicesIDaaS portalCloud CSGproxyCloud CSG APImonitorCloud CSG policy andreporting serverDesktopsVPNOn-premisesCSG proxyCorporate networkOn-premises applicationsDesktopsIndicesMobiledevicesCSG Evaluation OverviewTo assess the state of the CSG market and see how the vendors stack up against each other, Forresterevaluated the strengths and weaknesses of top CSG vendors. After examining past research, userneed assessments, and vendor and expert interviews, we developed a comprehensive set of evaluationcriteria. We evaluated vendors against 23 criteria, which we grouped into three high-level buckets: 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-73784
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack Up›› Current offering. In this bucket, we evaluated: 1) sanctioned and unsanctioned applicationmonitoring; 2) support for IaaS platforms, desktop agents; 3) automatic user activity monitoring andprofiling; 4) cloud malware detection; 5) data leak prevention; 6) data protection and encryption forboth structured and unstructured data; 7) integration, reporting, and scalability; 8) overall solutioncomplexity; and 9) overall intuitiveness and consistency of user interfaces.›› Strategy. In this bucket, we assessed the vendor’s: 1) future development and marketing plans;2) differentiation of data protection strategy; 3) relative customer satisfaction compared with othervendors in this Forrester Wave; 4) North American, Central and South American, EMEA, and AsiaPacific implementation and reseller partner ecosystems; and 5) proportionate solution developmentand sales strengths.4›› Market presence. In this bucket, we graded the vendor’s: 1) SaaS CSG revenues; 2) on-premisesCSG revenues; and 3) total direct and indirect customer install base sizes.Evaluated Vendors And Inclusion CriteriaForrester included eight vendors in the assessment: Bitglass, Blue Coat/Symantec, CipherCloud,CloudLock/Cisco, Imperva, Microsoft, Netskope, and Skyhigh Networks. Each of these vendors has(see Figure 2):5›› A thought-leading CSG portfolio of products and services. We included vendors thatdemonstrated CSG thought leadership and CSG solution strategy execution by regularly updatingand improving their productized CSG product portfolio.›› Total CSG revenues of at least 8 million with at least 15% growth. We included vendors thathave at least 8 million in revenues, including CSG solutions with at least 15% year-over-yeargrowth.›› At least 80 paying CSG customer organizations in production. We included vendors that havean install base of at least 80 paying CSG customer organizations in production.›› An unaided mindshare with Forrester’s customers. The vendors we evaluated are frequentlymentioned in Forrester client inquiries, vendor selection RFPs, shortlists, consulting projects, andcase studies. 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-73785
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack UpFIGURE 2 Evaluated Vendors: Product And Vendor Information And Selection CriteriaVendorProduct evaluatedBitglassBitglassBlue Coat/SymantecBlue Coat Elastica CloudSOC 2.71Blue Coat Cloud Data Protection 4.9.1CipherCloudCipherCloud Trust Platform:Cloud Discovery v4.0Cloud Security BrokerCloud Security Gateway v4.5CloudLock/CiscoCloudLock Security FabricImpervaImperva Skyfence Cloud GatewayMicrosoftMicrosoft Cloud App SecurityNetskopeNetskope Active Platform:Active Cloud DLPActive IntrospectionActive EncryptionActive Threat ProtectionNetskope Discovery v42Skyhigh NetworksSkyhigh Cloud Access Security Broker v3.0Evaluated vendors and inclusion criteriaA thought-leading CSG portfolio of products and services. We included vendors that demonstrated CSGthought leadership and CSG solution strategy execution by regularly updating and improving theirproductized CSG product portfolio.Total CSG revenues of at least 8 million with at least 15% growth. We included vendors that have atleast 8 million in revenues, including CSG solutions with at least 15% year-over-year growth.At least 80 paying CSG customer organizations in production. We included vendors that have an installbase of at least 80 paying CSG customer organizations in production.An unaided mindshare with Forrester’s customers. The vendors we evaluated are frequently mentioned inForrester client inquiries, vendor selection RFPs, shortlists, consulting projects, and case studies. 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-73786
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack UpVendor ProfilesThis evaluation of the CSG market is intended to be a starting point only. We encourage clients toview detailed product evaluations and adapt criteria weightings to fit their individual needs through theForrester Wave Excel-based vendor comparison tool (see Figure 3).FIGURE 3 Forrester Wave : Cloud Security Gateways, Q4 trongSkyhigh NetworksBlue skopeGo to Forrester.comto download theForrester Wave tool formore detailed productevaluations, featurecomparisons, andcustomizable rankings.CloudLock/CiscoImpervaMicrosoftMarket presenceWeakWeakStrategyStrong 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-73787
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack UpForw resei tegh LockIm/CpeisrvcoaMicrosoftNetskSk opy eN higet hworksFIGURE 3 Forrester Wave : Cloud Security Gateways, Q4 ’16 (Cont.)Current offering50%2.55 3.85 3.152.80 2.00 1.75 2.60 3.75Sanctioned and unsanctionedapplication (shadow IT) detection5%5.00 5.00 3.003.00 4.00 4.00 4.00 5.00IaaS platform, desktop agent,on-premises applicationsupport, and activity list5%4.00 4.00 3.002.00 4.00 3.00 4.00 3.00User activity monitoring,profiling, and threat protection10%2.00 5.00 1.001.00 4.00 3.00 4.00 4.00Cloud malware detection10%1.00 4.00 3.003.00 1.00 2.00 5.00 3.00Data leak prevention10%2.00 2.00 4.003.00 3.00 1.00 3.00 3.00Data protection: Salesforce,Office 365, encryption, sorting,filtering encrypted data20%2.00 4.00 4.001.00 0.00 0.00 0.00 5.00Data protection: mobile devicesupport, cryptography selection,tokenization, and hardware securitymodules15%3.00 4.00 4.003.00 0.00 0.00 2.00 2.00Integration, reporting, and scalability10%2.00 4.00 4.005.00 4.00 3.00 3.00 5.005%5.00 2.00 1.004.00 2.00 4.00 4.00 1.0010%3.00 4.00 2.005.00 3.00 3.00 2.00 5.00Overall solution complexityOverall interface intuitiveness andconsistency; organization of screensAll scores are based on a scale of 0 (weak) to 5 (strong). 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-73788
For Security & Risk ProfessionalsNovember 15, 2016The Forrester Wave : Cloud Security Gateways, Q4 2016The Eight Providers That Matter Most And How They Stack UpForw resei tegh LockIm/CpeisrvcoaMicrosoftNetskSk opy eN higet hworksFIGURE 3 Forrester Wave : Cloud Security Gateways, Q4 ’16 (Cont.)Strategy50%2.40 3.75 2.854.00 3.20 1.15 2.55 3.55Future development and market plansfor CSG and technology15%5.00 5.00 3.003.00 3.00 4.00 3.00 3.00Differentiation of the vendor’s dataprotection vision15%2.00 5.00 4.003.00 1.00 1.00 1.00 5.00Customer satisfaction15%2.00 3.00 1.005.00 4.00 1.00 3.00 4.00North American implementation andstrength of reseller partner ecosystem10%0.00 3.00 3.005.00 5.00 0.00 4.00 2.005%0.00 3.00 0.005.00 4.00 0.00 0.00 0.00EMEA implementation and strength ofreseller partner ecosystem10%0.00 3.00 5.005.00 4.00 0.00 3.00 3.00APAC implementation and strength ofreseller partner ecosystem5%0.00 5.00 3.003.00 5.00 0.00 0.00 4.00Proportionate solution developmentstrength15%5.00 2.00 4.003.00 1.00 1.00 4.00 5.00Proportionate solution sales strength10%3.00 5.00 1.005.00 5.00 1.00 2.00 3.00Market presence0%2.50 3.25 2.253.50 1.50 1.75 3.50 4.00SaaS CSG revenue25%2.00 4.00 0.004.00 1.00 3.00 5.00 5.00On-premises software CSGsubscription and perpetual licenseand maintenance revenue25%2.00 4.00 5.000.00 1.00 0.00 3.00 3.00Direct customer install base25%4.00 0.00 3.005.00 1.00 3.00 2.00 5.00Indirect customer install base25%2.00 5.00 1.005.00 3.00 1.00 4.00 3.00Central and South Americanimplementation and strength ofreseller partner ecosystemAll scores are based on a scale of 0 (weak) to 5 (strong). 2016 Forrester Research, Inc. Unauthorized copying or distributing is a violation of copyright law.Citations@forrester.com or 1 866-367-
For SECUrIT & rISK ProFESSIoNALS the Forrester Wave : Cloud Security Gateways, Q4 2016 November 15, 2016 2016 Forrester research, Inc. U
