What is CASB - Oracle CASB Cloud Service

What is CASB:

Cloud Access Security Brokers is a term coined by Gartner to describe cloud solutions centered around these four main pillars: visibility, compliance, data security, and threat protection. As per Gartner Cloud access security brokers (CASBs) are on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed. CASBs consolidate multiple types of security policy enforcement. Example security policies include authentication, single sign-on, authorization, credential mapping, device profiling, encryption, tokenization, logging, alerting, malware detection/prevention and so on. 

To Summarize CASB is a service which is used to secure and monitor Cloud and On-Prem applications and to respond with remediation in case of Threats or suspicious events are detected. Key is the analysis of events generated in the application and intelligence on those events to map it to a threat.Remediation of CASB's can be of various degrees starting from generating a ticket to step up authentication for user and blocking the access eventually.

Broadly CASB's can be classified in two categories: API based CASB and Proxy based CASB.

API based CASB's use API provided by applications to monitor and secure applications while Proxy based CASB's use a agent on the network to monitor the user access. Pros and cons of these CASB's are a topic of another discussion.

Oracle CASB Cloud Service:

Oracle CASB cloud service is a API based CASB service. Oracle CASB can monitor Iaas, Pass and SaaS applications which is unique in nature as most of the CASB vendors are focused around SaaS applications. The model on which Oracle CASB works is based on four pillars : Discover, Secure, Monitor, Respond.

Oracle CASB connects to applications using API and detects the events in the applications like login activities, user access, security controls. Discovery in Oracle CASB is of two types: 'Shadow IT discovery' which is from the top view what applications user are accessing and Deep Dive discovery which is from the event and audit logs of application about what users are accessing within. Oracle CASB can also monitor and push standard compliance control to the applications.

Once events are gathered from the applications they are processed in the analytics engine of Oracle CASB and run through the policy engine, threat engine and machine learning. Based on the analytics user behavioral profiling is done and events are categorized as Policy alerts, threats and controls. User activities are also verified against IP reputation lists and location feeds. Below is the view of the Dashboard:

After the events are analysed, re-mediate actions are taken based on the severity of the event. Oracle CASB can be integrated with an Incident management tool in the organization and a incident can be raised for the suspicious activities. Oracle CASB also has a built in light weight ticketing tool where Incidents can be assigned and owners will be notified by the email about the assignment and status. Oracle CASB can also be integrated with SIEM (security information and event management) tools to gather the activities in other enterprise applications. Data provided by SIEM solutions are then analysed in CASB.