Home / Knowledge hub / CASB
Knowledge hub
CASB
A control point between your staff and the cloud apps they use.
What it means
A cloud access security broker, or CASB, sits between your people and the cloud services they use, such as file sharing, email and chat. It can be a proxy in the path, a connection to each service's own interface, or both.
From that position it can show you which cloud apps staff use, apply your rules about what data may go where, and flag unusual behaviour such as a large download by someone leaving the company. Think of it as a checkpoint for staff, not for your product.
Why it matters
Staff sign up for tools without asking, and company data ends up in places IT has never heard of. A CASB gives you a view of that spread, often called shadow IT, and a way to apply controls such as blocking uploads of sensitive files to personal accounts. It also supports data loss prevention and compliance evidence.
It helps most where regulators or customers ask how you control company data in third-party services. It is a workforce control, aimed at how your own people use cloud apps, not at the security of software you build. Customers sometimes ask for it by name.
How it shows up
You meet it as a product sold by security vendors or bundled into a larger service. Typical uses are discovering which apps are in use, setting sharing rules, scanning stored files for sensitive data and watching for risky sign-ins. It often works alongside single sign-on and identity management.
Know its limits. A proxy covers only the traffic that passes through it, and unmanaged devices may bypass it. It will not find a broken access check in your own web app or API. That calls for testing the application itself, which is a different job.
Questions people ask
CASB, answered
Is a CASB the same as a firewall or a WAF?
No. A firewall controls network traffic and a WAF filters requests to your web app. A CASB manages how your staff use outside cloud services and what data goes into them.
They protect different things.
Do we need a CASB if we are a small company?
Not always. A small team can get far with strong sign-in, sharing rules inside the tools it already uses, and a short list of approved apps. A CASB earns its place as the number of tools and the data sensitivity grow.
Start with the basics.
What is shadow IT?
It is software that staff use for work without the company approving it or even knowing. A CASB can discover it by looking at network traffic or sign-in records.
Discovery is often the first benefit.
Does a CASB protect our own SaaS product?
No. It protects the use of cloud apps by your staff. The product you build and sell needs application testing and secure development.
Mixing these up leaves a gap.
Can a CASB stop data theft?
It can reduce it, by blocking or flagging risky uploads and downloads. A determined insider with access can still find a path it does not cover.
Treat it as one layer.
Related
Terms that sit next to this one
Data loss prevention
Tools and rules that stop sensitive data leaving where it should stay.
Single sign-on
One company identity for many applications, granted and removed in one place.
Identity and access management (IAM)
The tools and rules that manage who your people and services are and what they reach.
Shared responsibility model
The split between what your cloud provider secures and what you must secure yourself.
Vendor risk management
Judging and monitoring the security of the suppliers your business relies on.
Who tests the app you build?
A CASB watches how staff use cloud services. We test the software you build, and show the request, response and proof for every finding. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.