What is a CASB?
A cloud access security broker (CASB) is a security service that sits between an organization's users and the cloud applications they use. It shows which cloud services are in use and how risky each one is, watches what users do in them, and enforces policy on that activity. Gartner describes a CASB's job in four pillars: visibility, compliance, data security and threat protection.
CASBs exist because SaaS moved company data outside the network perimeter. A file shared publicly from a cloud storage tenant, or uploaded to a personal account from a home laptop, never crosses the corporate firewall, so the firewall cannot see or stop it.
How a CASB works: discovery, API mode and inline mode
- Log-based discovery: the CASB reads firewall, proxy or DNS logs and identifies every cloud service in use, with a risk rating for each. A first report often lists hundreds of applications IT never approved, which is shadow IT made visible.
- API mode: the CASB connects to sanctioned services such as Microsoft 365, Google Workspace, Salesforce or Box through each provider's API. It scans data already stored there, finds files shared publicly or with personal email addresses, flags risky settings and suspicious sign-ins, and can remove a sharing link or quarantine a file. It sees data that never crossed the corporate network, but it acts after the fact.
- Inline (proxy) mode: the CASB sits in the traffic path, through an agent or forward proxy on the user's side or a reverse proxy in front of an application, and acts in real time. It can tell the company's own tenant of a service from a personal account on the same service, so it can allow an upload to one and block it to the other.
Inline inspection of encrypted traffic depends on TLS inspection. Many organizations now get CASB functions as part of a secure web gateway or a security service edge (SSE) platform rather than as a separate product.
Example: blocking uploads to personal storage
A discovery report shows employees using more than 300 cloud apps. One finding stands out: customer spreadsheets are being uploaded to personal accounts on the same file-sharing service the company licenses. Blocking the service outright would break legitimate work, so the team writes an inline policy that reads, in plain terms:
app = cloud-storage AND instance is not the corporate tenant AND action = upload AND DLP match = customer PII -> block and notify user
Uploads to the corporate tenant still work. In API mode, the same CASB scans the corporate tenant nightly and removes anyone-with-the-link sharing from files labeled Confidential.
CASB vs. SWG, DLP and CSPM
- Secure web gateway (SWG): filters all web browsing by category and threat. A CASB focuses on cloud applications and what happens inside them. Modern platforms combine the two.
- Data loss prevention (DLP): content inspection that can run on endpoints, email, the network and inside a CASB. The CASB is one place DLP policy is enforced for cloud apps.
- Cloud security posture management (CSPM): checks the configuration of an organization's own cloud infrastructure accounts, such as public storage buckets and open security groups. A CASB watches users' activity in SaaS applications.
- Firewall: controls addresses, ports and applications, but generally cannot tell a corporate cloud account from a personal one on the same service.
CASB on the CompTIA Security+ exam
CASBs appear under SY0-801 objective 3.2, which covers making architecture decisions that protect the infrastructure, as a component of security service edge. They come up again wherever the exam discusses shadow IT and discovering unapproved cloud services. Scenario wording such as "unsanctioned cloud applications", "shadow IT", "visibility into SaaS use", "files shared publicly from the company's tenant" or "uploads to personal cloud accounts" points to a CASB. Distractors include a vulnerability scanner, which looks for flaws in systems rather than tracking which cloud services people use; firewall as a service, which enforces network rules but not instance-level data controls; SD-WAN; and CSPM, which checks cloud infrastructure settings rather than user activity in SaaS.