[ Glossary ]

Cloud Access Security Broker (CASB)

A cloud access security broker (CASB) is a security checkpoint that sits between users and cloud service providers, enforcing an organization's policies for data protection, access control, and threat prevention as employees use software-as-a-service (SaaS), platform-as-a-service (PaaS), and infrastructure-as-a-service (IaaS) applications. CASBs give security teams visibility into cloud app usage they might not otherwise see.

What Is a Cloud Access Security Broker (CASB)?

Key takeaways

A CASB enforces security policy at the point where users connect to cloud applications, whether they're sanctioned by IT or not.
CASBs typically cover four pillars: visibility, data security, threat protection, and compliance.
They can be deployed as a forward proxy, a reverse proxy, an application programming interface (API)-based connection, or a combination of these methods.
A CASB protects user-to-cloud-app access; it does not govern the network-level firewall and cloud security group policy that controls traffic between systems.

Why a CASB Matters

Employees adopt cloud applications faster than security teams can track them. Someone signs up for a file-sharing tool, a project management app, or an AI service with a company email address, and suddenly sensitive data is flowing through a platform IT never approved. This pattern, often called shadow IT, creates blind spots that traditional network security tools weren't built to catch because the traffic looks like ordinary web browsing.

A CASB closes that gap by sitting in the path between users and cloud services. It identifies which cloud applications are in use, assesses the risk level of each one, and applies consistent policy regardless of whether someone connects from a corporate laptop, a personal phone, or a branch office. For organizations managing a growing list of SaaS subscriptions, that visibility is often the first real inventory of cloud app usage they've had.

How a CASB Works

Most CASBs operate using one or a combination of two architectures:

Proxy-based deployment. Traffic between users and cloud services routes through the CASB, either as a forward proxy (directing outbound traffic from users to the cloud) or a reverse proxy (managing inbound requests to a cloud service). This approach allows inline inspection and real-time policy enforcement but requires rerouting network traffic.
API-based deployment. The CASB connects directly to a cloud provider's API to inspect data at rest and monitor configuration and user activity after the fact. This method doesn't require traffic rerouting but can introduce a delay between an event and detection.

Once deployed, the CASB continuously evaluates activity against policy: flagging risky file shares, blocking uploads of regulated data to unsanctioned apps, requiring additional authentication for high-risk logins, and alerting security teams to anomalous behavior.

Key Components and Best Practices

A mature CASB deployment generally addresses four areas:

Visibility. Discover every cloud application in use, including unsanctioned ones, and assign each a risk score based on factors like data handling practices and compliance certifications.
Data security. Apply data loss prevention (DLP) controls, encryption, and tokenization to keep sensitive information from leaving approved boundaries.
Threat protection. Detect compromised accounts, malware, and risky user behavior across cloud sessions, then automate a response.
Compliance support. Help demonstrate that cloud app usage aligns with internal policy and relevant regulatory requirements through logging and reporting.

Organizations get the most value from a CASB when they integrate it with existing identity providers, keep the sanctioned app list current, and set policies that balance security with the way people actually work. A CASB that blocks too aggressively invites workarounds that reintroduce the exact shadow IT risk it was meant to solve.

Common Challenges

CASBs solve a real problem, but they come with trade-offs. Proxy-based deployments can add latency and require careful configuration to avoid breaking legitimate app functionality. API-based deployments depend on what each cloud provider's API exposes, which varies widely and can leave gaps for newer or less common SaaS tools. Coverage also tends to focus on user-facing cloud applications, not the broader hybrid network, so a CASB alone won't show how on-premises firewalls, cloud security groups, and segmentation policies are enforcing access underneath those applications.

How CASB Connects to Network Security Policy Management

A CASB and network security policy management (NSPM) solve different, complementary problems. A CASB governs how users interact with cloud applications: what data moves through them, who can access them, and whether that activity follows policy. NSPM governs the underlying network access path: the firewall rules, cloud security groups, and segmentation controls that determine what connections are permitted across on-premises, cloud, and hybrid environments in the first place.

FireMon, the founder of NSPM, doesn't replace a CASB and isn't a cloud app security tool. Instead, FireMon provides governance over the network security policy layer that CASBs, firewalls, and cloud-native controls all operate within, normalizing policy across on-premises firewalls and cloud platforms like AWS, Microsoft Azure, and Google Cloud into one governed model. For security teams, that means a CASB can tell you what's happening at the application layer, while FireMon shows whether the network access enabling that traffic is consistent, validated, and compliant across the hybrid enterprise.

Frequently Asked Questions

A firewall controls network traffic based on rules like IP addresses, ports, and protocols, typically at the perimeter or between network segments. A CASB focuses specifically on the interaction between users and cloud applications, inspecting application-level activity like file uploads, logins, and data sharing that a traditional firewall often can't see.

No. A cloud access security policy is the set of rules an organization defines for how employees may use cloud services. A CASB is the technology that enforces and monitors compliance with that policy in real time.

Yes, in most cases. SSO manages authentication, confirming a user's identity before granting access, but it doesn't typically inspect what happens after login, such as data being downloaded, shared externally, or moved between cloud apps. A CASB adds that layer of ongoing activity monitoring and policy enforcement.

A CASB reduces specific risks, like sensitive data leaving through an unsanctioned app or a compromised account accessing cloud resources, but it's one layer in a broader security strategy. It works best alongside identity management, endpoint security, and network security policy controls rather than as a standalone defense.

CASBs are generally used to secure access to SaaS, PaaS, and IaaS applications, covering everything from email and file storage to custom business applications. Coverage depth varies by vendor and by how each cloud provider's APIs support inspection and control.