What is a Cloud Access Security Broker?
A Cloud Access Security Broker (CASB) acts as an intermediary between cloud providers, cloud-based applications, and cloud consumers to enforce an organization’s security policies and usage. A CASB protects the movement of data by limiting access and sharing privileges, while using encryption to secure data contents.
Why do I need a CASB?
Although cloud applications can accelerate and optimize your organization’s workflow and productivity, relying on them can present security risks. Threat actors increasingly use cloud platforms as attack vectors, and as opportunities to disrupt your operations or access and steal your intellectual property. To protect users and their data—and to safeguard business operations—you need to be able to track user behavior, protect sensitive data, and monitor third-party connected apps.
Are cloud applications safe to use? Can a CASB make them safer?
As long as you understand the risks associated with using cloud applications, you should be able to devise a strategy that helps keep them secure. A CASB should be part of that strategy because it’s specifically designed to secure interactions with cloud apps.
Is a CASB all I need for cloud security?
Similar to endpoint security and data center security, cloud security requires a comprehensive, holistic approach. A CASB is a critical component, but you need additional solutions such as DNS layer security, secure web gateways, email security, public cloud monitoring solutions, next-generation firewall-integrated cloud solutions, and remote browser isolation.
Three CASB security use cases
Data loss prevention (DLP)
Protecting an organization’s data is usually the highest priority. A CASB performs inline and out-of-band inspection of outbound web traffic to block sensitive data from being publicly exposed or shared in the cloud with unwanted external audiences. Use it to align with your data security policies and to help meet regulatory compliance requirements.
App discovery and control
The lack of a coordinated cloud enablement strategy–one that encompasses all cloud apps used by stakeholders throughout your organization—can increase your risk profile. A CASB gives IT and security teams full visibility into cloud app activity, giving them control over which apps can be securely adopted and safely used.
Cloud malware detection
Cloud apps and services can act as the backbone for your businesses financial data and intellectual property, but a malware can be catastrophic for operations. CASB protects by scanning all files in supported cloud apps and services for malware. and then notifies admins for remediation.
CASB overview (1:00)
Key considerations when choosing a CASB
User security
Visibility: For organizations trying to safeguard users, the first obstacle is visibility. In large organizations, users will access applications across multiple cloud environments. A CASB solution must provide visibility into all user activity across all of the SaaS applications they access.
Threat protection: User visibility is critical, but visibility alone isn’t enough to achieve extensive threat protection for users. With multicloud activity expanding the attack perimeter, IT professionals can’t keep up with multiplying threat alerts. Large-scale analytics and machine learning allow a CASB solution to automate threat alerts and responses to achieve more robust, agile user security.
Data security
Control: The first step in helping ensure data security is asserting control. You should restrict access wherever information is not critical to an employee’s job function. While you may want to trust your employees, broadly granted access can greatly increase the attack surface. And once attackers are in your network, they will attempt to move laterally to access secure data. When in doubt, limit access points to significant data.
Visibility: Similar to user security, visibility is a crucial step to promoting data security. More and more, organizations are sharing sensitive data across multiple cloud environments. Controlling access to that data can be effective, but networks are home to a constant flow of newly forming connections. This means you need visibility into what data is going where—along with the ability to block users from inappropriately sharing sensitive information.
App security
Discover: Most organizations would be dismayed if they saw the number of applications their entire network is using. Applications can be very beneficial, but it’s important to know which ones are accessing organizational data at any given time. A CASB solution should provide discovery and visibility of third-party connected apps. It should also enable you to disconnect from risky or inappropriate apps.
Classify: Once an application is discovered, a CASB should classify it. Some applications, such as Google Apps, may unknowingly give users access to sensitive data. While it may seem harmless, a malicious or exploited application can cause serious damage. To allow employees to work efficiently but safely, a CASB needs to quickly identify the application, whether it is safe, and which data it can access. Then the CASB must classify the app.
Enable or disable: Once discovered and classified, the application should be enabled or disabled. In most cases, the app has been downloaded or accessed to improve an employee’s productivity. If the application has been classified as safe and beneficial and the permissions are appropriate, no action is necessary. But if the application is classified as a threat, it should be disabled immediately.
Key Takeaways
A Cloud Access Security Broker acts as an intermediary to help make cloud-based applications safe for users and organizations alike. If your organization is using any cloud-based applications, you should consider using a CASB solution to help with data loss prevention, application visibility and control, and cloud malware detection. These vital capabilities, enabled by a CASB, will be essential to securing sensitive user data and intellectual property.
