📖 What is Cloud Access Security Broker (CASB)?
A Cloud Access Security Broker (CASB) is a software tool or service that sits between cloud service consumers and cloud service providers. It enforces security, compliance, and governance policies for cloud-based services, providing visibility into "shadow IT" and controlling data movement.
"Pay attention to the "Shadow IT" aspect; CASBs are the primary tool for discovering unauthorized cloud app usage."
📚 Certification: CompTIA Advanced Security Practitioner+ (CAS-004)
🔑 What are the Key Concepts of Cloud Access Security Broker (CASB)?
- ▸ Shadow IT Discovery: CASBs analyze network logs to identify unauthorized cloud applications used by employees, allowing security teams to sanction or block them.
- ▸ Data Loss Prevention (DLP): They enforce granular policies to prevent sensitive data, such as PII or PHI, from being uploaded to or shared from cloud services.
- ▸ Deployment Models: CASBs operate via API-based integrations for data-at-rest or proxy-based deployments (forward/reverse) for real-time traffic inspection and control.
- ▸ Compliance and Governance: They provide centralized auditing and reporting to ensure cloud usage adheres to regulatory frameworks like GDPR, HIPAA, or PCI DSS.
- ▸ Threat Protection: CASBs detect anomalous user behavior, such as impossible travel or bulk downloads, to identify compromised accounts or potential insider threats.
🎯 How does Cloud Access Security Broker (CASB) appear on the CAS-004 Exam?
You may be asked to identify the best solution for a company that discovers employees are using unauthorized third-party storage sites to share corporate data, requiring a tool for visibility and control.
A scenario might describe a need to apply consistent data encryption and access control policies across multiple SaaS platforms from a single management console to ensure regulatory compliance.
Expect questions where you must choose between an API-based CASB for scanning existing cloud data and a proxy-based CASB for real-time blocking of unauthorized uploads.
❓ Frequently Asked Questions
How does a CASB differ from a Secure Web Gateway (SWG)?
While an SWG filters general web traffic and blocks malicious URLs, a CASB is specifically designed for cloud services, providing deep API integration and granular control over specific SaaS application functions.
When should I choose an API-based deployment over a proxy-based one?
Choose API-based for scanning data-at-rest and auditing historical activity without impacting user performance. Use proxy-based when you need real-time, inline enforcement and the ability to block actions as they happen.