5 Things CISOs Need to Consider Before Buying a CASB

For many businesses, IT partner providers will recommend a CASB that fits in with their current IT and security infrastructure. For others, there's the need to consider a best-fit service and vendor approach for the organization. IT leaders and decision-makers should consider these key issues before adopting a CASB service.

1. Find a CASB vendor that suits your needs

With any IT solution, there's a range of vendors on the market, with traditional IT security vendors like McAfee looking to round out their product offering to remain relevant to startups like Proofpoint that focus mainly on a single product. Microsoft's Cloud App Security comes as part of Microsoft 365, while the likes of ZScaler offer highly integrated CASB with other security features.

Most vendors target SMBs up to enterprises with tiered product offerings, while some focus solely on large enterprise clients.

To find the ideal CASB provider, describe your current and planned IT footprint in terms of services and users, and select the CASB service that best aligns with those needs, and provides the support and insight that benefits your company's level of IT security knowledge.

2. Evaluate the different types of CASB products

There are two main types of CASB products on the market: proxy and API-based products that use different technology infrastructure to deliver their service.

Proxy-based CASBs

For proxy services, they place an agent - the proxy - between the company's data and the cloud applications used by workers. The proxy monitors traffic and ensures security beyond the firewall to the cloud.

API-based CASBs

API-based CASBs deliver their service directly to the cloud services through an API link to each business application, commonly supporting Google Docs, Microsoft Office 365, Amazon AWS, Azure, Salesforce and other services. API-based solutions tend to operate faster than agent-based solutions, and can easily be added to other platforms as the business needs them.

Most CASBs are offered as SaaS, while major providers offer an on-premises option to ensure that the CASB resides within the firewall for additional security.

3. Does the CASB offer endpoint security?

Beyond the primary CASB functions, most end-user organizations are also on the lookout for additional endpoint security to protect data on user devices, including corporate and personal laptops, tablets and smartphones.

This helps simplify IT management, combining services and dashboards, and reduces complexity. Some vendors offer integrated endpoint security, while others recommend a third-party service, which may add to the overall complexity of a solution.

4. Consider licensing options and costs

As with all cloud-based solutions, vendors tend to offer more features in the premium or enterprise version of their offering. Establish the per-user, per-annum costs for your intended CASB option, but consider business growth and the need to adopt higher-tier features as the company expands, and creates a wider data footprint.

If you have any specific security needs or bespoke applications in use, you'll need to consider a vendor that's willing to make customizations, which may add to the cost, but can provide a value-added service.

5. Consider value-added options

Additional features typically provided with CASBs as options include a range of tools to improve a company's overall security posture.

• Secure web gateways (SWG) as part of security and policy enforcement
• Data loss prevention (DLP) to detect and prevent breaches and monitor attempts to destroy sensitive data
• Cloud security posture management (CSPM) automates risk identification and mitigation

Avoid feature duplication with other products and ensure these tools can integrate with all cloud services, whether they're SaaS, IaaS and PaaS.

In a business landscape that'll only see greater cloud adoption, securing data remains a key priority for all companies. CASB will play a vital role in ensuring data protection and avoiding data loss, providing visibility to IT and the leadership.

As these CASB products mature, they'll extend and evolve to address emerging data and IT threats, becoming an integral part of any IT defense strategy.

Once you identify the features you're looking for in a cloud access security broker, IT leaders must ask these critical questions when partnering a CASB vendor.

Further reading:

• Top CASB Use Cases
• The Cloud Security Maturity Index: How Secure is Your Cloud?
• How the Hybrid Cloud is a Game Changer for Security
• Defend Your Data: Why Cloud Workload Protection Should be Your Top Priority