What is a Cloud Access Security Broker (CASB)?

Coined by Gartner in 2012, CASBs or Cloud Access Security Brokers “…are on-bounds, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the deject-based resources are accessed. CASB solutions consolidate multiple types of security policy enforcement. Instance security policies include authentication, single sign-on, authorization, credential mapping, device profiling, encryption, tokenization, logging, alerting, malware detection/prevention and then on.”

A deject admission security broker (CASB) works by securing information flowing to and from in-house It architectures and cloud vendor environments using an organisation’s security policies. CASBs protect enterprise systems confronting cyberattacks through malware prevention and provide information security through encryption, making data streams unreadable to outside parties.

CASBs were created with one matter in mind: protecting proprietary data stored in external, third-political party media. CASBs deliver capabilities not mostly available in traditional controls such as secure web gateways (SWGs) and enterprise firewalls. CASBs provide policy and governance concurrently across multiple cloud services and provide granular visibility into and control over user activities.

Visibility

Cloud apps unknown to It event in data assets that are uncontrolled and outside the governance, risk, and compliance processes of the enterprise. Enterprises crave visibility into cloud app account usage, including who uses which cloud apps, their departments, locations, and devices used.

Data Security

Data loss prevention (DLP) tools are designed to stop enterprise data leaks due to unauthorized sharing but the deject makes sharing data with the wrong people easier than ever before. If an arrangement uses deject file storage, a traditional DLP product will non know what data is shared externally and who is sharing it.

Threat Protection

It can be difficult to guard against the malicious intent or negligence of authorized users. To notice suspicious insider behavior, organizations demand a comprehensive view of their normal usage patterns. Forth the same lines, onetime employees pose meaning risk, as they may have been disabled from the organizational directory, but can still admission cloud apps that contain business-critical information. PWC institute that security incidents owing to former employees rose from 27% in 2013 to 30% in 2014.

Compliance

As data moves to the cloud, organizations will desire to ensure they are compliant with regional regulations that ensure data privacy and security. A CASB can aid ensure compliance with regulations like SOX and HIPAA too as help criterion your security configurations against regulatory requirements similar PCI DSS, NIST, CJIS, MAS and ISO 27001.

BYOD, Shadow Information technology, and Increased Cloud Usage

Phenomena such as BYOD (bring your own device) policies, the growing popularity of SaaS and deject apps, and the ascension of Shadow IT make restricting cloud app access to a divers set of endpoints a hard task. Managed and unmanaged devices oft require different policies to protect corporate information effectively. CASBs aid enforce granular access polices too as identify and categorize cloud apps in your arrangement.

App Discovery—Obtain a global view of all cloud apps

• Discover all cloud apps accessed past employees
• Inventory cloud apps and assess adventure posture – for each app and at an organizational level
•  Amass firewall and proxy logs across the enterprise
•  Generate a global view of cloud app usage, including metrics for traffic volume, hours of apply, and number of accounts
•  Create a baseline view so you can see how many apps have been added over a givenperiod of time
•  Drill down into each cloud app to perform detailed adventure analyses

Take chances Governance—Assess chance contextually and prepare mitigation policies

•  Place high-take a chance activities for your business
• Determine who has standard and privileged access to an app
• Place dormant (i.e., accounts non accessed for several days), orphaned (due east.g., ex-employees), and external (e.one thousand., partners) accounts to create advisable access policies
• Benchmark current app security configurations against regulations or best practice guidelines to pinpoint security and compliance gaps
•  Assess and define admission policies based on the location of users and/or a cloud service provider’s data centers (i.e., location-based access control)
• Assign tasks to resolve user and application issues
•  Leverage a congenital-in organizational workflow to assign and complete risk mitigation tasks via Forcepoint CASB or through integration with third-party ticketing systems

Audit & Protection—Automatically enforce policies & protect against credential misuse & malicious insiders’ acts

• Monitor and catalog who is accessing deject apps from managed and unmanaged endpoints
• Track and monitor privileged user access and configuration changes
• Monitor deject app usage across multiple context-aware categories, including user, location, device, action, data object and department usage
• Ensure real-time detection of dissonant and suspicious behavior
• Implement assault remediation, including strong user verification, cake application actions (e.m., block downloads of shared documents) and business relationship admission
• Enforce location-based access control (aka “geo-fencing”) policies
• Enforce endpoint access controls for managed and unmanaged devices, whether originating from a browser or a native mobile app
• Monitor and command uploads, downloads, and sharing of sensitive information for over 100 file types
• Inspect files and content in real-time to ensure that PII, PCI, HIPAA and other sensitive information stays protected