-1

I think I've understood what CASB are and the differences between proxy/API-based architectures. What is still unclear to me is how exactly API-based CASB function.

I know most products use APIs to traverse the cloud documents storage to download and inspect the documents. Or maybe even use APIs to download auditing logs from the service. But for example Office 365 offers DLP features such as Exchange Mail Flow Rules or Office 365 DLP rules. Do any API-based CASB also automatically configure and use these DLP functions?

Adam Smejkal
  • 3
  • 1

1 Answers1

0

Well, as I understand it, CASB's work in two ways - Proxy and API.

In Proxy mode, all access to your Cloud goes through the CASB and hence before you are able to execute an operation, the CASB can evaluate the operation for compliance BEFORE it is executed. This also applies to DLP functions - it can, for example, PREVENT a proscribed action (like downloading a Confidential Document to an unsecure location) from taking place. It can also immediately quarantine infected or unscanned documents to the Cloud.

In API Mode, the CASB accesses activity logs and uses them to evaluate actions that have ALREADY happened (that's why they're in the logs). Add to the fact that the Logs can be delayed by an hour in some cases (depending on the frequency of the pull down of the logs), this means that in API mode any DLP action can only be administrative or reactive (at best). If I download a Confidential document to my personal laptop in violation of a DLP rule, all it can do is flag the action and escalate to someone for followup. However, the document has left the building and is in the wild.

Now, if you asked (I paraphrase) if McAfee's CASB working in API mode would leverage Office3 365's built in DLP capabilities? My understanding is "*NO, it doesn't. It will use some components of Office 365 to enable its own DLP capabilities, but it won't actively invoke the DLP tools of Office 365 directly."

As DLP matures, this may well change. But currently there is no standardized DLP mechanism to leverage.

Divya Sundaram
  • 36
  • 2