How Cloud Access Security Brokers Strengthen Enterprise Security

In 2018 an engineer at a US Navy contractor, shortly before he left the job, copied more than 5,000 files to his Dropbox account and emailed some of the documents to himself. The files held sensitive details of the company's finances and intellectual property relating to product designs.

Subhalakshmi Ganapathy, product evangelist for IT security at ManageEngine, uses the case to show why leaks of this kind matter more now that workforces are hybrid. The spread of cloud applications among staff has made work more productive, easier and more scalable. It has also increased the risk of shadow IT, data exfiltration and insider threats.

Put plainly, an organisation may have no idea which of the many SaaS applications its employees use are holding its data. Given that risk, Ganapathy argues, organisations should extend their security with cloud protection, and a cloud access security broker (CASB) is designed for exactly that.

What a CASB is and what it does

The analyst firm Gartner coined the term "cloud access security broker" in 2012. A CASB sits between an organisation's users and the cloud services they reach. That position lets it authenticate and authorise users when they try to use cloud resources, and it also lets the organisation see what data moves into and out of the cloud.

Ganapathy highlights four main capabilities:

• Visibility. The cloud helps teams collaborate, yet employees still turn to unauthorised and unknown cloud apps, called shadow applications, to get results faster or better, and this is a serious headache for IT. A CASB shows security teams how cloud apps are used, which apps are opened from unmanaged devices, which users are accessing and changing data in the cloud and more, giving an all-round view for cloud security monitoring.
• Compliance. By securing data both in transit and at rest, and by watching for data leaking out of the cloud, a CASB helps organisations meet standards including the GDPR, CCPA, HIPAA and LGPD and protects them against exfiltration.
• Data security. Protecting data is one of a CASB's main purposes. It tracks access to cloud data and flags unauthorised access to sensitive information, while features such as data leakage prevention and access control reduce the chance of leaks.
• Threat protection. A CASB guards against threats from inside and outside the organisation. It learns how users normally behave, builds a baseline, and warns the security team to act whenever activity departs from it.

Why the SIEM needs CASB capabilities

Many security operations centres today depend heavily on a security information and event management (SIEM) system. Ganapathy advises that within the next two years the SIEM should either integrate smoothly with an external CASB or include CASB functions of its own. She gives five reasons.

Heavy use of cloud applications

Research suggests the average employee uses 10 SaaS apps each day and the average organisation uses 254. They range from third-party analytics tools that take in customer data sets to consumer editions of approved enterprise software such as Microsoft 365 or Google Workspace, and some of them run on employees' personal mobile devices. Most organisations also operate across several clouds with a mix of PaaS and IaaS models. A SIEM with CASB capability shows which applications are in use and how, so the organisation knows how much risk each one carries.

Linking events across the network

Attacks have grown more sophisticated, with examples including living-off-the-land attacks, cloud malware that first gets in through an on-premises server, cloud ransomware and disruptionware, and insider attacks. Organisations need to spot patterns, connect events in different parts of the network that look unrelated, and treat them as one security incident.

Stopping data leaks

Cloud apps bring a real risk of leaks, deliberate or accidental. Ganapathy's example is a marketing employee using an app called Font Candy to design eye-catching typography. If the app has not been approved and the employee has stored private contact details and classified information in it, that data could leak. Controlling unauthorised uploads of sensitive data is essential in such cases, and a CASB lets the organisation enforce cloud security policies and controls that stop data being sent over the internet.

Seeing shadow IT

Most organisations keep a list of approved cloud apps that staff may use, each approved after being judged secure and useful for productivity, and each owned or controlled by the organisation. Shadow applications sit outside IT's ownership and control and may contain weaknesses that attackers can exploit. A CASB reveals usage statistics for these apps and identifies the people who use them most.

Better identity and access management

Gartner research director Erik Wahlstrom has said that organisations "shouldn't replace their IAM programs with CASBs, but rather intersect the two" to strengthen governance and access control over cloud applications. A CASB improves identity and access management (IAM) through adaptive authentication and risk analysis based on each user. Bringing this into the SIEM lets organisations view risky user behaviour in one console and respond using playbooks and workflows.

Ganapathy regards the CASB as a core part of an organisation's defences against shadow applications and data exfiltration to the cloud. A good one, she says, fits smoothly with a SIEM and delivers network visibility, data security, compliance management and threat protection.