Cloud Access Security Broker (CASB)

In one of the companies that I used to work for, one of the managers left, and after they left we discovered that she had set up these different cloud applications with her personal email address, and we no longer had access to these accounts. That was problematic, because we actually had business level data sitting on these accounts. This is what's called shadow applications, or shadow IT, and we need to make sure that we don't have that within our organization. But how would we do that? CASB is one of those things that we can set up to help us manage this.

What CASB means

CASB stands for cloud access security broker. Let's break this apart — what does it actually mean?

Well, it's the cloud, so we've got these services that are up in the cloud, lots of different services that we could be subscribed to. And it's access to them, so we need to gain access to these different cloud resources that we have. Then there is this security broker. What is a security broker? A security broker would be a third party that brokers this access into these resources. So that's what this is all about: it's purchasing an extra service from a security broker so that way we can control access into cloud resources.

There are said to be four pillars of cloud access security broker. One is visibility, one is threat protection, one is data security, and one is compliance. These are the main things that this cloud access security broker, or CASB, provides for us.

The problems it solves

There are several problems that this solves for, but the main ones are around the shadow application and data loss. We're going to use the scenario with Dropbox, that a user is using Dropbox.

In scenario one, this is going to be an example of shadow IT, where someone has started using Dropbox without IT's knowledge. We call this a shadow application. So this user now is using a shadow application, and the problem is they're uploading information into here that's business sensitive information, and IT doesn't know what kind of controls are around it. Or if this person leaves, now no one has access to it, and this is problematic.

In scenario number two, Dropbox is allowed and this user is using Dropbox, and in fact it's provided by IT. IT has provided Dropbox to this user, but there's certain information they don't want on Dropbox, and this user downloads some customer information and then uploads it to Dropbox. This is problematic.

The key components that CASB offers are authentication, authorization, credential mapping, device profiling, encryption, logging, and alerting, all around these different applications and the data that's being stored on them.

Two implementation methods

There are two different methods of implementation. You can have out of band, which uses APIs, or inline, which uses proxies.

Let's first of all look at inline, using a proxy. Essentially what the user does is connect into the CASB server rather than connecting into one of these applications directly, so they're going through the CASB. In doing this, by going through it, then all of this traffic, everything, can be analyzed. They can see what applications are being used, they can see what's going into those applications, so there's a lot of visibility into what's happening.

Now let's look at out of band, which uses APIs. Essentially what happens is the user is connecting directly into these services, but what happens on the back end is that the security broker here is using API guys to plug into each one of these services. So AWS or Office 365 or whatever service it is has these APIs, and it allows a security broker to connect in. On the back end it connects in and can monitor what's happening on these different services. As the user is using these different services, if they were to upload a document to Dropbox that they shouldn't, then this API catches that and flags it with the security broker, and then some sort of action can take place with this. So this is a way to control what is happening on these different cloud services.

If it's inline, that means all of the data is going across the CASB before it ever hits these cloud services, so it's more secure. But since it's being sent through these security brokers, there's potential delays with that; there's an extra step. Versus if it's out of band, then it will get better performance because it doesn't have this middle step involved with it, but it's less secure because data can go directly to the cloud before the API catches it and then communicates that with the CASB.

The four pillars

Let's get back to those four pillars of CASB. What does this do?

All this allows us to gain visibility, to discover and monitor cloud services and applications. So we can discover and monitor applications and see if there's some sort of shadow applications that are being used.

Another thing is threat protection. As there is information going into here, we can analyze it and see if there's any threats. An example of this might be malware that's installed on maybe a file or something that gets uploaded.

We also have a level of data security, so we can do data loss prevention with this. We're seeing what data goes into the cloud and analyzing it to see if there's some sensitive information that shouldn't be on those resources. A good example of this might be making sure personally identifiable information, or PII, doesn't get uploaded to Dropbox. We'll analyze that and make sure that doesn't happen.

Then we also have compliance. It can help us with compliance to things like GDPR or HIPAA, or really any of the compliance, any of the laws, any of the regulations.