Cloud Access Security Broker (CASB)

Provides comprehensive cloud service discovery by analyzing firewall logs, proxy data, and endpoint agents to detect all cloud services in use, whether sanctioned or unsanctioned. This capability builds a risk-based cloud registry by assessing each service's security posture, compliance certifications, and business readiness. Key functions include:

• Automated user behavior analytics to identify anomalous access patterns
• Integration with Secure Web Gateways (SWG) for real-time traffic inspection
• Classification of services by data sensitivity and regulatory scope

Enforces granular data protection policies across managed and unmanaged devices accessing cloud services. CASBs apply exact data match (EDM) and indexed document matching (IDM) to detect structured and unstructured sensitive data before it leaves the enterprise perimeter. Core mechanisms include:

• Real-time inspection of uploads and downloads via API integration
• Encryption and tokenization of sensitive fields before cloud storage
• Dynamic data masking to redact PII based on user role and location

Leverages User and Entity Behavior Analytics (UEBA) to establish behavioral baselines and detect compromised accounts, insider threats, and anomalous privilege escalation. The CASB enforces Adaptive Access Control by evaluating contextual signals—device posture, geolocation, and time of access—before granting entry. Capabilities include:

• Integration with Identity Providers (IdPs) for step-up multi-factor authentication
• Detection of cross-cloud brute-force attacks and impossible travel scenarios
• Automated policy orchestration to revoke sessions during active threats

Automates the enforcement of data residency and data sovereignty mandates by restricting storage and processing to specific geographic regions. The CASB maps data objects to jurisdictional boundaries and applies Transfer Impact Assessments (TIA) logic to cross-border flows. Operational features include:

• Pre-built policy packs for GDPR, HIPAA, and Schrems II compliance
• Immutable audit logs capturing all user and administrator data access events
• Automated remediation workflows for misconfigured cloud storage buckets

Acts as a centralized control plane for Customer-Managed Encryption Keys (CMEK) and Hold Your Own Key (HYOK) strategies across multi-cloud environments. The CASB ensures that cloud providers never possess plaintext key material by brokering cryptographic operations within a Trusted Execution Environment (TEE). Critical functions include:

• On-the-fly encryption of structured fields before database insertion
• Integration with hardware security modules (HSMs) for FIPS 140-2 compliance
• Policy-driven key rotation and cryptoperiod enforcement

Supports dual deployment modes: inline proxy for real-time blocking of policy violations and API-based out-of-band scanning for retrospective inspection of data at rest. The API mode connects directly to cloud service providers to scan files, emails, and collaboration objects without routing traffic through a proxy. This architecture enables:

• Deep inspection of encrypted traffic via SSL/TLS decryption
• Retroactive quarantine of sensitive data shared via public links
• Continuous posture assessment of cloud tenant configurations

The physical or geographic location where an organization's data is stored, governed by the laws of that specific jurisdiction. A CASB enforces residency by restricting storage buckets to specific Azure regions or AWS Local Zones.

• Key Distinction: Residency is about where data sits; sovereignty is about who controls it.
• Enforcement: CASB policies block uploads to non-compliant regions.

A strategy and set of tools designed to detect and block the unauthorized transfer of sensitive information outside a corporate boundary. CASBs integrate DLP engines to inspect data in motion to the cloud.

• Mechanism: Uses exact data matching (EDM) and fingerprinting to identify PII or IP.
• Action: Can block, quarantine, or encrypt data before it leaves the managed device.

A hardware-based security technique that isolates data within a protected CPU enclave during processing, shielding it from the host operating system and cloud provider. CASBs can route sensitive workloads to Trusted Execution Environments (TEEs).

• Use Case: Processing financial data in the cloud without exposing it to the cloud admin.
• Benefit: Protects data in use, closing the last gap in the encryption lifecycle.

An access control paradigm that grants user permissions based on a combination of attributes, such as department, location, and clearance level. Modern CASBs leverage ABAC for dynamic, context-aware policy enforcement.

• Attributes: User role, device posture, geolocation, and time of day.
• Dynamic Masking: A CASB can mask fields in a SaaS app based on the user's current attributes.

The legal framework following the 2020 EU court ruling invalidating the Privacy Shield, requiring enhanced safeguards for transatlantic data transfers. A CASB helps enforce Transfer Impact Assessments (TIAs) by blocking access from non-adequate jurisdictions.

• Technical Control: Enforces Standard Contractual Clauses (SCCs) via access policies.
• Risk Mitigation: Prevents data egress to countries lacking essential equivalence in privacy law.

A chronological record of system events that cannot be altered or deleted, providing tamper-proof evidence for compliance investigations. A CASB generates these logs for every cloud access event.

• Data Captured: User identity, accessed resource, action taken, and geolocation.
• Compliance: Essential for proving chain of custody to a Data Protection Authority (DPA).