Organizations with a heavy cloud presence spanning multiple cloud service providers could implement a Cloud Access Security Broker (CASB) to centrally monitor cloud traffic and enforce security policies.

Control Type: Technical

Control Function: Preventive & Detective

A new cybersecurity tool that has emerged to address the security needs of decentralized, cloud-based environments in the Cloud Access Security Broker (CASB). A CASB serves as a single, central security enforcement point that sites between an organization’s cloud service providers and its end users. Today, many organizations are utilizing a hybrid cloud environment, with many different cloud services from different providers being used simultaneously. This can become very difficult to properly manage, which is what CASB hopes to address.

CASBs can be either on-premises or in the cloud itself. The platform is administered by the organization’s IT/cybersecurity staff, whether they are in-house or through an MSSP. All the organization’s cloud services are hooked into the CASB platform so that the admins can view and analyze the traffic. This is just like the classic perimeter-based network approach of monitoring all ingress and egress network traffic via a firewall. Instead of collecting network traffic, the CASB collects cloud traffic. Just like firewalls, CASBs can then create event logs, incident alerts, and even automatically implement runbooks to address real-time security incidents.

 There are several modes by which the cloud traffic can be hooked into the CASB:

  1. Forward Proxy Based CASB: the CASB sites between the user and the Internet and views/routes the user traffic to cloud applications in real-time, applying required inspections and policies as the traffic leaves.
  2. Reverse Proxy Based CASB: the CASB sites between the user and the cloud application itself. The CASB catches authentication requests, enforcing policies such as SSO and MFA, before routing the user traffic to the cloud services themselves.
  3. API Based CASB: the CASB hooks directly into the target cloud apps via the application’s API. This allows the CASB to perform activities on the actual data resting within the cloud application, such as malware scanning, permission audits, and compliance scanning.
  4. Multimode CASB: the CASB is implemented in a hybrid approach that combines the proxy-based inspection of cloud app traffic with the deep data inspection capabilities of the API based approach.  This is the preferred choice for organizations that are dominated by the cloud and need deep visibility into the traffic accessing the cloud, as well as the operations being performed within it.

CASB solutions are typically quite flexible, offering a variety of tools and features that admins can use to fine tune the platform’s operations to its needs. Regardless of the specific design, all CASBs typically address four security functions for the organization:

  1. Visibility: identify all cloud applications in use and help the organization detect Shadow IT and Shadow AI usage.
  2. Data Security: monitor the organization’s data in the cloud and protect it via tools like DLP.
  3. Threat Protection: detect and quarantine malware, alert on compromised accounts, and use baseline user profiles to detect suspicious activity.
  4. Compliance: crafts benchmarks and policies to help the organization comply with standards and regulations like HIPAA, GDPR, and PCI DSS.

Not every organization needs a CASB. In fact, if an organization has a very limited cloud presence or only uses a single cloud service (Entra ID, Google Workspace), then the cost likely outweighs the benefits, as these large cloud platforms are typically equipped with their own sizable security suites. However, a CASB is highly recommended for all organizations that perform most of their operations in the cloud and use multiple cloud services in the process. As the 2020s progress, we are seeing serious difficulties with reigning in employee use of external applications like GenAI, cloud storage, and private chatrooms. Employees may believe that they are accessing these services outside the security borders of their organization, and in many cases they are. This is extremely risky since all these platforms are primed for internal data leakage that often occurs without the organization’s knowledge. Implementing and fine tuning a CASB is a great fit for remedying such issues.