Microsoft Cloud App Security overview
In this tutorial, we wil learn and understand the Microsoft Cloud App Security.
Microsoft Cloud App Security is a Cloud Access Security Broker (CASB) that supports various deployment modes including log collection, API connectors, and reverse proxy. Moreover, it provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your Microsoft and third-party cloud services.
What is a CASB?
Cloud App Security Broker steps in to address the balance, adding safeguards to your organization’s use of cloud services by enforcing your enterprise security policies. However, it acts as a gatekeeper to broker access in real time between your enterprise users and the cloud resources they use.
CASBs do this by:
- Firstly, discovering and providing visibility into Shadow IT and app use
- Secondly, monitoring user activities for anomalous behaviors, controlling access to your resources
- Thirdly, providing the ability to classify and prevent sensitive information leaks
- Then, protecting against malicious actors
- Lastly, assessing the compliance of cloud services.
Why do I need a CASB?
You need a CASB to better understand your overall cloud posture across SaaS apps and cloud services. Additionally, an organization is responsible for managing and securing its cloud platform including IAM, VMs and their compute resources, data and storage, network resources, and more. Therefore, if you are an organization that uses, you most likely need a CASB to address the additional, unique challenges of regulating and securing your environment.
Further, as an organization, you need to protect your users and confidential data from the different methods employed by malicious actors. In general, CASBs should help you do this by providing a wide array of capabilities that protect your environment across the following pillars:
- Firstly, Visibility: detect all cloud services; assign each a risk ranking; identify all users and third-party apps able to log in
- Secondly, Data security: identify and control sensitive information (DLP); respond to classification labels on content
- Thirdly, Threat protection: offer adaptive access control (AAC); provide user and entity behavior analysis (UEBA); mitigate malware
- Lastly, Compliance: supply reports and dashboards to demonstrate cloud governance; assist efforts to conform to data residency and regulatory compliance requirements
Architecture
Cloud App Security integrates visibility with your cloud by:
- Firstly, using Cloud Discovery to map and identify your cloud environment and the cloud apps your organization is using.
- Secondly, sanctioning and unsanctioning apps in your cloud.
- Thirdly, using easy-to-deploy app connectors that take advantage of provider APIs, for visibility and governance of apps that you connect to.
- Then, using Conditional Access App Control protection to get real-time visibility. And, for controlling over access and activities within your cloud apps.
- Lastly, helping you have continuous control by setting, and then continually fine-tuning, policies.
Reference: Microsoft Documentation