A large enterprise is migrating its legacy applications to a public cloud. The security team is concerned about data exfiltration and unauthorized access to sensitive corporate data stored in various cloud services (e.g., object storage, databases, SaaS applications). They need a solution that can enforce security policies, detect anomalous behavior, and prevent data leakage across all cloud services, regardless of the user's location or device. Which security control addresses these comprehensive requirements?
- AVirtual Private Network (VPN)
- BCloud Access Security Broker (CASB)
- CNext-Generation Firewall (NGFW)
- DIntrusion Prevention System (IPS)
Show answer & explanationAnswer & explanation
Correct answer: B. Cloud Access Security Broker (CASB)
A Cloud Access Security Broker (CASB) acts as a control point between cloud users and cloud services. It provides visibility, compliance, data security, and threat protection across various cloud applications, enforcing policies for data at rest and in transit, detecting anomalous behavior, and preventing data exfiltration, regardless of user location or device. This comprehensive coverage aligns with the scenario's requirements.
Why the other options are wrong
- A. VPNs provide secure connectivity, but not the policy enforcement, anomalous behavior detection, or data leakage prevention across multiple cloud services.
- C. NGFWs primarily inspect network traffic at the perimeter, not within cloud services or for SaaS applications.
- D. IPS primarily focuses on detecting and preventing network-based intrusions, not comprehensive data security across cloud services.
Cloud Access Security Broker (CASB)
A CASB is a security policy enforcement point placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed.
- Provides visibility into cloud usage.
- Ensures compliance with data protection regulations.
- Prevents data loss (DLP capabilities).
- Protects against malware and threats.
- Enforces access control policies across multiple cloud services.
Memory trick: CASB is the 'C'entral 'A'gent for 'S'ecuring 'B'oth access and data in the cloud.