Cloud Access Security Broker (CASB)

Overview

Meaning and scope

A Cloud Access Security Broker (CASB) is a security control layer that provides visibility and policy enforcement between users, workloads, and cloud services across sanctioned and unsanctioned usage. It differs from Cloud Security Posture Management, which primarily assesses cloud resource configuration and control posture rather than individual access and data activity.

Mechanism and operation

The control exists to discover and reduce security exposure across cloud services, configurations, identities, data, access paths, and externally reachable resources. The workflow collects data through cloud APIs, logs, network observation, repositories, and service integrations, then normalizes resources and assigns ownership. In this context, capabilities may include discovery, access control, data protection, malware detection, session monitoring, and policy enforcement, but deployment must account for encryption, APIs, performance, privacy, and coverage gaps. It should connect the term to Data Loss Prevention (DLP) where that relationship changes access, transaction treatment, investigation, communication, or recovery. Records should retain resource identifiers, account and region, configuration, identities, data classification, exposure path, detector version, first and last seen dates, owner, exception, remediation, and verification.

Practical payment example

An organization routes access to approved SaaS applications through a CASB policy. Security monitors risky file sharing and account behavior while separately protecting private keys and signing operations.

Operational checks

The business should map which cloud applications and identities a CASB can actually observe, the type of data it inspects and whether policies are preventive or merely alerting. Test unmanaged-device access, administrator privilege and sensitive-file exfiltration scenarios. CASB controls do not replace application authentication, cloud configuration hardening or key-management design. For payment workflows, make sure policy enforcement does not silently block legitimate finance exports without a documented exception route. The relationship with Adaptive Authentication should be documented where it affects residual risk or control ownership.

Distinctions and limits

Findings should be prioritized by sensitivity, privilege, reachability, exploitability, business criticality, and compensating controls rather than severity labels alone. Useful measures include environment coverage, unknown assets, public exposure, excessive privilege, sensitive-data findings, remediation time, drift, recurring misconfiguration, exception age, and verified risk reduction.

Related reading

Related definitions: Cloud Security Posture Management (CSPM), Data Loss Prevention (DLP).