The adoption of software-as-a-service (SaaS) applications and infrastructure-as-a-service (IaaS) has brought immense business benefits, but also introduced new security risks. Traditional security tools often fall short in protecting cloud environments. This is where cloud access security brokers (CASBs) come in.
In this article, we provide an overview of CASBs along with their key capabilities for securing cloud applications and infrastructure. We also offer guide on evaluating CASBs to choose the right solution for your organization.
The Need for CASBs
Let’s first understand why CASBs have emerged as an essential cloud security tool:
- Native cloud security is limited – Public clouds focus on availability and uptime over stringent security. Controls must be layered on top.
- Existing tools lack cloud context – Traditional security products like firewalls were not designed for cloud environments.
- Visibility is reduced – The shared responsibility model limits cloud provider visibility into your data and security events.
- Users adopt shadow IT – Business units directly adopt cloud apps without IT review, bypassing security policies.
- Complex environments create blindspots – Sprawled multi-cloud or hybrid environments have security gaps between interconnected systems.
- Traditional controls don’t translate – Existing network controls like firewalls don’t work seamlessly in dynamic cloud environments across regions, VPCs and virtual networks.
CASBs help fill these security gaps and enhance protection for cloud-based resources.
Key CASB Capabilities
CASBs consolidate a wide set of security features purpose-built for the cloud:
Data and Threat Protection
- Data loss prevention – Scan and redact sensitive data stored in cloud apps like customer records in Salesforce. Prevent unwanted data exfiltration.
- ** malware and anomaly detection** – Analyze user activity and file uploads for signs of compromise like suspicious IP connections, abnormal behavior, and malicious files.
- User and entity behavior analytics – Apply machine learning to build baseline profiles for typical user and app activity to better detect anomalies.
- Cloud sandbox detonation – Isolate and test unknown files and attachments in a sandbox to uncover malicious actions like exploits, command execution, and fileless attacks.
Access Control and Identity Management
- Conditional access policies – Enforce context-aware access controls that restrict risky logins based on conditions like location, device, IP address and more.
- Single sign-on (SSO) – Provide central authentication to cloud apps via standards like SAML and OAuth to avoid managing multiple passwords.
- Multi-factor authentication (MFA) – Add an extra layer of identity verification such as one-time codes sent over SMS or smart cards. Prevents stolen credentials.
- Just-in-time (JIT) access – Only grant temporary access to resources when needed instead of permanent access. Automatically revoke permissions after sessions expire.
Visibility and Governance
- User activity monitoring – Gain visibility by recording user actions within cloud apps and services. Identify suspicious access to data.
- App discovery – Detect shadow IT by discovering cloud apps that are actively used across the organization so they can be evaluated and secured.
- App catalog – Track authorized cloud app usage and define consistent security policies for approved apps.
- Configuration auditing – Check cloud app settings and infrastructure configurations for security best practices and compliance requirements.
Data Protection and Compliance
- Encryption – Apply encryption controls consistently across cloud apps and infrastructure to data in transit and at rest.
- Tokenization – Replace sensitive data fields like credit card numbers with non-sensitive tokens to remove exposure while preserving format.
- Data retention rules – Enforce time-based data retention for compliance. Automatically delete temporary files and other data after expiration.
- Data loss prevention – Prevent exfiltration of sensitive documents and fields during uploads to cloud apps or endpoint actions.
Deployment Options
CASBs support multiple deployment modes to integrate with your environment:
API-Based
API-based CASBs integrate with cloud provider APIs. This mode is easy to deploy but only provides partial visibility limited by cloud provider APIs.
Proxy-Based
Proxy-based CASBs intercept and inspect traffic between users and cloud apps via a proxy. This provides fuller visibility but requires routing network traffic through the CASB.
Agent-Based
Agent-based CASBs install lightweight agents on endpoints like laptops that locally intercept access to cloud apps. Agents expand visibility to endpoint activity beyond network traffic.
The most complete coverage is provided by combining proxy and agent-based modes. API-based options supplement visibility.
Key Selection Criteria
Important criteria to evaluate when selecting a CASB include:
- Breadth of app and data support – The ability to secure popular IaaS, PaaS and SaaS environments including AWS, Office 365, G Suite, Salesforce, Slack, etc.
- Deployment flexibility – Supports proxy, agent-based, and API modes to fit your technical environment and visibility needs.
- Data residency options – Provides flexibility regarding where collected data can be stored, especially for international privacy regulations.
- Threshold anomaly detection – Uses adaptive machine learning versus static rules to uncover threats. Can train on your data.
- Automation integration – Integrates with workflows, IT ticketing, SIEMs, and security orchestration to enable automated response and remediation.
- Context-aware access policies – Enables nuanced and risk-based access controls based on contextual factors.
- User experience impact – Proxy and agent modes can add latency or overhead. Minimizing impact is ideal.
Getting Started with CASBs
Follow these best practices when adopting CASBs:
- Start with visibility gaps – Prioritize visibility into high risk apps, users, and data exposures. Address gaps first.
- Enforce data centric policies – Start with policies focused on securing sensitive data like PII or financial records rather than just perimeter controls.
- Automate remediation tasks – Use APIs and integrations to enable automatic response and workflows for common alerts and incidents.
- Involve app owners – Get buy-in from business application owners since CASB controls can impact end users. Have them help define policies.
- Tune cautiously – Begin with conservative policy thresholds and tune over time to avoid excessive false positives.
- Retain responsibility – CASBs provide added controls but organizations maintain responsibility for cloud security and compliance.
Conclusion
CASBs fill a vital role in cloud security by consolidating visibility, data security, threat prevention, identity management and compliance across cloud environments. As part of a defense-in-depth strategy, CASBs provide protection and oversight not offered by cloud providers alone. Carefully evaluating options and needs is key to get maximum value from CASB adoption.
