CASB is used as a cloud access security broker (CASB) that provides a comprehensive set of capabilities to help you manage and control the use of cloud apps across your organization, including visibility into inappropriate cloud app usage.
CASBs work by ensuring that network traffic between on-premises devices and the cloud provider complies with an organization's security policies. The value of cloud access security brokers stems from their ability to give insight into cloud application use across cloud platforms and identify unsanctioned use. This is especially important in regulated industries. CASBs use autodiscovery to identify cloud applications in use and identify high-risk applications, high-risk users, and other key risk factors. Cloud access security brokers may enforce several different security access controls, including encryption and device profiling. They may also provide other services, such as credential mapping, when single sign-on is not available.
Prerequisites
CASB relies on the telemetry stream provided by DarkLayer Guard Endpoint (DNS-E) to detect and classify cloud and AI applications across your network. For CASB to accurately monitor allowed shadow IT activity (such as ChatGPT, Claude, or Copilot usage), Full Logging must be enabled under Endpoint Settings -> Group Policy -> DNS Security -> DarkLayer Guard. Without Full Logging enabled, DLG-E operates in threat-only mode, and neutral traffic required for CASB discovery will not be transmitted to the dashboard.
Setup
HEIMDAL's CASB cloud access security broker provides a comprehensive set of capabilities to help you manage and control the use of cloud apps across your organization, including visibility into inappropriate cloud app usage. CASB can be accessed from the HEIMDAL Dashboard, under Products -> DNS Security-> Network or Endpoint.
The CASB view displays a list of the applications discovered by the DarkLayer Guard engine in your environment and the following details: Application Name, Vendor, Installed Endpoints, and Risk Level. You can track and monitor the usage of an application by clicking the Installed Endpoints hyperlink and seeing the hostnames and the number of DNS queries performed by the users on the displayed endpoint(s).
Also see: CASB and OpenAI ChatGPT