A Big Miss: Just 21% of Organizations Use Cloud Access Security Brokers

Eighty-three percent of organizations say they need to improve their cloud security. At the same time, half of respondents don’t have the staff or expertise to do the job. And, to top it off, few of these organizations use cloud access security brokers, or use them to their fullest potential for overall cloud security.

That combination sets the stage for managed security service providers to step in, especially during COVID-19. Many employees continue to work from home, accessing cloud resources from consumer-grade devices and connectivity. This further pressures any cloud security measures organizations have in place. And even though IT teams know about those pitfalls, few have implemented cloud access security brokers.

Those findings come from the Cloud Security Alliance in a new report commissioned by CASB vendor Proofpoint.

Cloud access security brokers ensure policy enforcement. They sit between the cloud user and the cloud provider to monitor and enforce security as people access resources in the cloud. A CASB can reside on premises or in the cloud.

CASB Disparity

Yet, despite the benefits, only 21% of organizations use cloud access security brokers, according to “Survey Report: Evolution of the CASB.” Fifteen percent continue to evaluate vendors. Thirteen percent remain in the implementation stage and another 13% are giving at least one CASB a pilot test. The majority of organizations the CSA polled, though, still are conducting initial research on CASBs (27%).

That’s the case even though CASBs help combat problems, including shadow IT. These under-the-radar, employee-driven technology deployments threaten cloud security because they rarely adhere to policy. That opens the door for data leaks and bad actors. In fact, last year, Skyhigh Networks found that of the 1,935 different cloud services in use within the average enterprise, the IT department did not know about most of them. CASBs offer important protections, perhaps especially with MSSPs steering process.

Proofpoint’s Itir Clarke

“Organizations worldwide are looking to MSSPs to help them evaluate CASB vendors and solutions, and integrate CASB into their daily security operations — especially now that more and more organizations are remote,” Itir Clarke, senior product marketing manager at Proofpoint, told Channel Futures. “MSSPs are vital partners as organizations work to understand cloud security risks, define their CASB use cases and create a cloud security road map.”

That road map, Clarke added, ensures that organizations prioritize the cloud apps and data repositories to secure first. It also helps determine which cloud users are at risk and how to protect them.

CASBs prove vital to the road map. The thing is, CASBs have gone underused, said Hillary Baron, lead author and research analysts at the Cloud Security Alliance. Three areas where this stands out the most?: compliance, data security and threat protection.

Cloud Security Alliance’s Hillary Baron

“It’s clear that training and knowledge of how to use the products need to be made a priority if CASBs are to become effective as a service or solution,” Baron said.

Why a CASB?

Of the organizations that do use CASBs, the top five reasons they do so are to:

• Monitor use behavior (55%)
• Detect unauthorized access (53%)
• Classify data (48%)
• Spot compliance gaps (42%)
• Pinpoint data location (41%)

Even so, IT teams are missing chances to use CASB functionality for complete cloud security, the Cloud Security Alliance notes. Namely, security professionals are not taking advantage of CASBs’ “device categorization” capabilities, the report said.

“This could be due in part to a great focus on the user behavior,” the authors wrote. Still, “with the growth of user devices and the IoT, device categorization could see more use in the future.”

It seems fair to predict that MSSPs will be instrumental to that effort.

There’s another big possibility MSSPs should consider: Too many IT teams struggle to use CASBs for multicloud visibility across IaaS and PaaS consumption. One reason could go back to inadequate staffing or expertise. Another, the Cloud Security Alliance said, could tie to excess focus on SaaS resources.

“Organizations may be seeking to identify sprawling data in various unsanctioned SaaS services,” the authors wrote.

The ultimate takeaway, of course, is that organizations need MSSP guidance and skill.

The Cloud Security Alliance surveyed 216 IT and security professionals across the Americas, APAC and EMEA over two months to evaluate the use of CASBs for cloud security.