In this whiteboard session, we are going to provide an introduction to a new term being used by Gartner: CASB, or Cloud Access Security Broker in follow up to Gartner’s report Emerging Technology Analysis: Cloud Access Security Brokers.
What Is a Cloud Access Security Broker?
Fundamentally, a CASB is a visibility and policy control point that sits between users and cloud applications. Gartner believes there are three ways to deploy a CASB: 1) through a proxy-like, on-premises gateway, 2) via a host-based agent model, or 3) with an API-based, cloud-native SaaS solution.
Read the latest report from the CloudLock CyberLab to see the invaluable insights CASB capabilities can provide.
Why are CASBs important?
There are three primary reasons why cloud access security brokers are a hot topic. First, based on Gartner’s 2014 report, nearly all respondents shared that they anticipate over half of their enterprise app spend will be spent on public cloud applications by 2018. In short, cloud applications are here to stay.
Secondly, while public cloud application vendors are security-conscious, they tend to focus on securing the infrastructure layer, which they demonstrate through audits and certifications like ISO 27001 or SOC 2 Type 2. This leaves the organization responsible for mitigating risk induced through user behavior.
Finally, public cloud applications are increasingly being thought of as business enablers. Gartner revealed that over 25% of today’s IT spend is coming from outside the IT department, meaning that line-of-business owners are self-selecting technology, particularly cloud applications, to enable themselves and their teams to be more productive. In order to do this securely, risk mitigation strategies must be considered.
Gartner’s Four Pillars of CASB
Visibility. What apps – both authorized and unauthorized – are being used by your employees? How often and when are they using these apps? Such visibility grants organizations the much-desired insight into the Shadow IT side of the equation.
Compliance. Cloud access security brokers offer an opportunity to understand if your organization is complying with regulations, such as HIPAA, PCI, FISMA, and so on, through data governance.
Threat Prevention. In order to effectively offer threat prevention, CASBs look at internal users and malicious outsiders to evaluate the potential risk of behaviors. For instance, are users – trusted or otherwise – accessing information they should not have access to?
Data Security, referring to not only encryption and tokenization, but also data loss prevention. What data is being accessed? What data is being shared? Is it being shared in a way that is harmful to the organization? Is my intellectual property being safeguarded?
The CloudLock Perspective
It’s terrific that Gartner is helping educate forward-thinking organizations who are adopting, or considering adopting, cloud applications. CloudLock subscribes to a people-centric approach to security. We believe it is essential to implement security in such a way that it does not impact end users. In short, we think it is important to allow employees to use cloud services much in the way they would at home. In doing so, cloud security can become a true business enabler and open up new possibilities for everyone.
Do You Even Need a CASB Solution?
Yes. And, for more on what one can do for your organization, check out the latest report from the CloudLock CyberLab. Inside, you’ll find exciting cybersecurity data, case studies, and tips on how to make the most of your cybersecurity efforts by honing in on suspicious activities that truly indicate cyberthreats.