Instructor: Cloud access security broker. 2 2
What is a cloud access security broker, 3 3
also known as a CASB? 4 4
Well, this is an enterprise management software 5 5
designed to mediate access to cloud services 6 6
by users across all types of devices. 7 7
Essentially, it's going to be a middleman 8 8
that helps you with your authentication 9 9
and ensure that people are using the services 10 10
they're supposed to use. 11 11
Now, there are many different vendors 12 12
who sell this type of product. 13 13
They include people like Symantec 14 14
which uses the Blue Coat proxy, 15 15
which I've personally used in a lot of my organizations. 16 16
There's Skyhigh Networks, which is made by McAfee. 17 17
There's Forcepoint. 18 18
There's Microsoft's Cloud App Security 19 19
which is their version, 20 20
and Cisco has their version called CloudLock. 21 21
All of these are different cloud access security brokers 22 22
and the key term here is security. 23 23
By being a broker, 24 24
they're going to make sure that your device 25 25
is connecting to the right device using the right security. 26 26
Now, what are some benefits 27 27
of using these cloud access security brokers? 28 28
Well, they can enable single sign-on authentication 29 29
and enforce access controls and authorizations 30 30
across your entire enterprise network, 31 31
all the way from your enterprise network 32 32
up to the cloud provider. 33 33
They also can help you scan for malware and rogue devices, 34 34
and be able to find any of these devices 35 35
that might be on your network. 36 36
They also can help monitor and audit 37 37
user and resource activity 38 38
to know exactly what your users are doing on your network 39 39
at any time. 40 40
And finally, they can help you mitigate data exfiltration 41 41
by performing functions 42 42
like a data loss prevention system would. 43 43
Now, when you talk about a cloud access service broker, 44 44
I want you to remember they provide visibility 45 45
into how your clients and other network nodes 46 46
are using your cloud services. 47 47
When you start moving everything out to the cloud, 48 48
you have to think about, 49 49
"How are my users using those things? 50 50
How much time are they spending? 51 51
Are they using it the right way? 52 52
Are they taking data and putting it where it shouldn't be?" 53 53
And to do that, we have three different things. 54 54
We can set it up as either a forward proxy, 55 55
a reverse proxy, 56 56
or using API access. 57 57
Now, when we talk about a forward proxy 58 58
in terms of a cloud access security broker, 59 59
we're essentially going to set up a security appliance or host 60 60
that's positioned at the client network edge, 61 61
and then it's going to forward the user traffic 62 62
to the cloud network 63 63
if the contents of that traffic comply with policy. 64 64
For example, in my home network, 65 65
I have my kids set up to use a forward proxy. 66 66
Now, this means that I went to their browser 67 67
and I configured it, 68 68
so they had to go and connect to my proxy server 69 69
before they went out to the internet. 70 70
This way, I could see what they were doing, 71 71
how much time they were spending on sites, 72 72
and if I needed to block certain things. 73 73
Now, as my kids got older, 74 74
my son got smarter and he realized what a proxy server was, 75 75
and so, he wanted to prevent the use of this forward proxy. 76 76
So, what did he do? 77 77
Well, he evaded the proxy 78 78
and connected directly to the sites he wanted to, 79 79
and the way he did that was by bypassing the proxy. 80 80
And so, this is something you have to be concerned with 81 81
when you're dealing with a forward proxy. 82 82
Now, if I wanted to prevent that, 83 83
I might go to the second method, which is a reverse proxy. 84 84
Now, a reverse proxy is an appliance that's positioned 85 85
at the cloud network edge 86 86
and directs the traffic to the cloud services 87 87
if the contents of that traffic comply with the policy. 88 88
So, instead of having to go through the proxy 89 89
to leave the network, 90 90
you can leave the network, 91 91
but you can't get into the cloud network 92 92
until you hit the proxy. 93 93
That's the idea of the reverse proxy. 94 94
Now, the big problem with this is it only works 95 95
if the cloud application you're trying to connect to 96 96
supports proxies. 97 97
If they don't have proxy support, 98 98
you can't do a reverse proxy. 99 99
And so, this brings us to our third method 100 100
which is an application programming interface or API. 101 101
This is a method that uses the broker's connections 102 102
between the cloud service and the cloud consumer 103 103
to make changes. 104 104
Now, essentially when we're using 105 105
the application programming interface, 106 106
we're sending data between the cloud service 107 107
and the cloud consumer, 108 108
and what we're doing here 109 109
is we're being able to send information about those users. 110 110
So, if I had a user account that's now been disabled, 111 111
or authorization's been revoked from the local network 112 112
because they were doing bad things, 113 113
I can send that using the cloud broker over the API 114 114
to the cloud service and say, 115 115
"Hey, don't let Jason in. 116 116
We just fired that guy and his account's been disabled," 117 117
and so, they can now know not to give him access. 118 118
Now, the problem with this, the big warning here, 119 119
is that it's dependent 120 120
on the API supporting the functions your policies demand. 121 121
So, as you start thinking about your policies 122 122
and you start saying, "Well, I want people 123 123
to be denied or allowed access to everything," 124 124
that's probably going to be supported. 125 125
But if you start having very detailed requirements, 126 126
those things may not be supported 127 127
depending on the service that you're using. 128 128
And if they don't support those policies, 129 129
the API doesn't have 'em, 130 130
and you're not going to be able to use this method.