Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Getting Started

Last updated
Save as PDF

Limited Availability: To access User Unification, contact Skyhigh Support.

Every user across the SSE platform can be configured with an identity for each Skyhigh product to ensure security, proper access control, and accountability. For example, a CASB user can be configured with an email ID as an identity, and a SWG user can be configured with a SAM account name. Because Skyhigh products can be configured with different identities, the single-user identity across the SSE platform may differ. If a single user uses two different Skyhigh products, the user's information is stored under two distinct identities. Additionally, each user's data is gathered from various sources, each providing different sets of attributes. As a result, a Security Operations Center (SOC) administrator cannot perform a comprehensive user threat investigation or calculate multiple risk scores for a single user. This issue also prevents the administrator from accurately identifying threats and anomalies by limiting the system's ability to determine whether the same user is accessing Shadow or Sanctioned services.

To unify user identities across the SSE platform and to facilitate Unified Threat Investigation, Unified User Risk Score, and Accurate Threat Protection for each organization's user, Skyhigh has introduced User Unification.

Unify User Identities

This capability uniquely identifies the user across the SSE platform, allowing correlation between configured user identities accessing Shadow or Sanctioned services. Unifying the user identities addresses the following challenges:

Unified Threat Investigation
Unified User Risk Score
Unified Threat Protection

Benefits

NOTE: The current release does not support Unified Threat Protection.

Unified Threat Investigation. Investigate potential threats by cross-referencing activities between Shadow and Sanctioned data.
- Increase accuracy when investigating activities or incidents across the SSE platform by using single-user identification.
  
  For example, if exfiltration occurs, such as when a user downloads a file from Box and uploads it to Sendspace using a consistent Global User Identifier (GUID), a SOC admin can identify the activities across Shadow and Sanctioned applications and take appropriate action to mitigate the risk.
Unified User Risk Score. Use information from all SSE components to calculate each user’s risk level and then apply security rules based on that risk across all SSE products.
- Increase the accuracy of the User Risk Score by adding inputs from Shadow and Sanctioned services.
- Make the User Risk Score relevant to all SSE users, not just CASB.
- Identify and track users with multiple identities and calculate individual risk scores. As a result, we can calculate a rich user risk score for a single user across the SSE platform and complete the enforcement.
  
  For example, if a user is not risky on the CASB side and performs risky activities on the DLP side, it would be reflected in the Unified User Risk Score.
Unified Threat Protection. Drive Anomaly and Threat generation using activities from across SSE.
- Calculate anomalies and threats using activities and incidents across all SSE products and generate more accurate anomalies and threats.
- Highlight more accurate threats and prevent data exfiltration from Sanctioned to Shadow services.
  
  For example, suppose a user logs in to a sanctioned SaaS from the U.S.A., and within a few minutes logs in to a Shadow app from China with a different user identity. In that case, Skyhigh can surface a compromised account threat, and the SOC admin will be able to connect the dots between the user.

Points to Remember

User Tokenization is NOT Supported in New Directory Services

The new Directory Services for unified user identities do not support user tokenization for third-party shadow IT logs. This update applies to all organizations transitioning to the new Directory Service, whether migrating manually or through the auto-migration process.

Why Tokenization is NOT Supported in New Directory Services?
To enable advanced security capabilities such as Unified Threat Investigation, Unified User Risk Score, and Unified Threat Protection, Skyhigh Security requires a consistent user identity across both sanctioned and unsanctioned cloud services. Because tokenization prevents the platform from correlating user activities across the Skyhigh SSE platform, Directory Services excludes tokenization to ensure the Unify User Identities feature functions correctly.
Impact on Current Configurations
- If your organization currently utilizes user tokenization, the Skyhigh stops tokenizing those user identities after you migrate to the new Directory Service.
- If your organization does not use user tokenization today, this change does not affect your environment, and you do not need to take further action.
- If your organization only upgrades to the latest Cloud Connector without migrating to the new Directory Service, user tokenization remains available.

How to Unify User Identities?

Configure Manually. To unify user identities, you must configure the Cloud Connector on your product. To configure the Cloud Connector, see Configure Cloud Connector to Unify User Identities.

Migrate Automatically. To accelerate your transition from the legacy Cloud Connector model, Skyhigh Security automatically migrates your Directory Services configuration to support User Unification. For details, see Auto-Migrate Legacy Custom Attributes to Directory Service.