📖 What is Cloud Access Security Broker (CASB)?
A Cloud Access Security Broker (CASB) is a software tool or service that sits between cloud service consumers and cloud service providers. It enforces security, compliance, and governance policies for cloud-based resources, providing visibility into 'shadow IT' and data movement.
"Focus on the 'visibility' aspect. CASBs are essential for detecting unauthorized cloud application usage and ensuring data encryption across multi-cloud environments."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Cloud Access Security Broker (CASB)?
- ▸ Shadow IT Discovery: CASBs identify unauthorized cloud applications used by employees, enabling security teams to assess risk and bring these services under official corporate governance.
- ▸ Data Loss Prevention (DLP): They monitor data in transit and at rest within cloud apps to prevent sensitive information from being leaked or shared publicly.
- ▸ Deployment Modes: CASBs can operate via API for deep scanning of data at rest or as a proxy for real-time traffic control and policy enforcement.
- ▸ Compliance and Governance: They ensure cloud usage adheres to regulatory standards like GDPR or HIPAA by enforcing encryption and access control policies across multi-cloud environments.
- ▸ Threat Protection: CASBs detect anomalous user behavior, such as impossible travel or bulk data downloads, to identify compromised accounts or insider threats in the cloud.
🎯 How does Cloud Access Security Broker (CASB) appear on the CS0-003 Exam?
A scenario might describe a company discovering that employees are using unauthorized third-party storage apps to move corporate data. You will be asked to identify a CASB as the tool for detecting this shadow IT.
You may be asked to select the best solution for enforcing real-time data encryption and preventing PII from being uploaded to a SaaS platform, requiring a proxy-based CASB implementation.
Expect questions where you must distinguish between an API-based CASB for auditing data at rest and a proxy-based CASB for active traffic interception, specifically when deciding between retroactive scanning and real-time blocking.
❓ Frequently Asked Questions
How does a CASB differ from a Secure Web Gateway (SWG)?
While an SWG focuses on filtering web traffic and blocking malicious URLs, a CASB provides deeper visibility into cloud-specific API calls and data movements within SaaS, PaaS, and IaaS environments.
When should I choose API-based deployment over Proxy-based deployment?
Choose API-based for deep scanning of data at rest and auditing without impacting user performance. Use Proxy-based when you need real-time control, such as blocking specific actions or encrypting data in transit.