Cloud Access Security Broker (CASB)

The first generation of CASBs focused on discovering resources. They gave visibility into all of the cloud resources that enterprise users accessed, which helped prevent shadow IT. Shadow IT is the use of cloud applications that the organization's IT management has not authorized, such as unapproved software-as-a-service (SaaS) applications for file sharing, social media, collaboration, and web conferencing.

The current generation of CASBs enforces security and governance policies for cloud applications, which lets organizations extend their on-premises policies to the cloud. Their services include protecting enterprise data stored on cloud providers' servers and the data flowing in and out of them, which is a data loss prevention (DLP) capability. They also track threats such as account hijacking, and some use user and entity behavior analytics (UEBA) to detect anomalies in users' cloud access behavior.

CASBs also detect misconfigurations in an organization's infrastructure-as-a-service (IaaS) deployments and cloud servers. Their alerts direct the organization to follow guidelines such as the Center for Internet Security (CIS) benchmarks for public cloud services. CASB services are among the minimal security services in most commercial secure access service edge (SASE) offerings.