CASB

CASB makes SaaS security available for managed applications and managed devices for approved cloud and SaaS apps. This helps control SaaS risk as it funnels ...

The CASB playbook failed, and along the way became alienated to the very problem it was intended to solve—mitigate the risk of cloud services threatening the organization. MostSaaS apps are accessed by users outside of CASB control, creating a whole new challenge to operate two SaaS lifecycles—inside of CASB for traditional apps, roughly 40 percent, and manual outside of CASB for the other 60 percent. A SaaS Security Control Plane (SSCP) is an essential element of modern security architectures—identifying risks and threats within the SaaS estate and orchestrating security throughout the SaaS lifecycle. After a decade of CASB deployments, iterations, enhancements, and acquisitions, we still find 6-out-of-10 security leaders do not trust CASB to secure SaaS apps. These two ends of the process are precisely the moments in the secure SaaS lifecycle when CASB fails to deliver. CASB built an extravagant seat for the wrong parade—the real action is happening elsewhere, but it’s too late,CASB is locked in for life, inert to secure most user-SaaS relationships in the real-world SaaS attack surface. If CASB ignores 60 percent or more of SaaS apps accessed directly, outside of CASB controls, then it is clear that CASB priorities are meaningless and barely relevant to my real-world SaaS attack surface. In the imaginary world depicted by CASB vendors, no one accesses SaaS apps outside of network infrastructure (cloud or on-prem) and every device is under lock-and-key. This design flaw gives CASB the bias to seek and destroy, taking what limited SaaS it sees as something to curtail, block, stop, or restrict with more of that infrastructure CASB depends on. CASB discovery fails because of its design that does not account for the way SaaS is consumed in today’s enterprise. Not for lack of trying, but the game changed when the internet became the new network and identities became the new enforcement point—and the CASB playbook has no answer for it. This helps control SaaS risk as it funnels users through infrastructure (hardware and software) gateways that give the CASB an opportunity to enforce security policy, authorization, and authentication.