Over a million developers have joined DZone.

2018: The CASB Year Ahead

DZone's Guide to

2018: The CASB Year Ahead

With eleven months left in 2018, there's still plenty of things that can happen in cloud security. Read on to get one experts predictions.

· Security Zone ·
Free Resource

Discover how to provide active runtime protection for your web applications from known and unknown vulnerabilities including Remote Code Execution Attacks.

As cloud apps and CASBs have matured, predicting 2018 industry events is much easier than in the past. You don’t need to be a psychic to know that there will be at least one CASB vendor acquired by a big security company. Of course, there will be nuances and details that are hard to pin down, but for the most part, the road ahead is getting clearer. Acquisitions, product changes, and our day to day work provide hints at what’s coming next.


Large CASB vendors and smaller solutions that don’t quite fit the CASB label are converging on the marketplace. As small and midsize businesses adopt cloud-based email and file sharing solutions at the highest rates, cloud security solutions are hoping to piggyback on the trend. Solution providers see the writing on the wall: API-based cloud security solutions that directly integrate into cloud apps provide the user experience that businesses want: deploying a cloud security platform should be easy and the user experience should be seamless.

For large CASB providers, a cloud security solution made just for small and midsize businesses would mean building a new platform from the ground up. Existing CASB providers have the resources to move quickly and develop a full feature set, but for those who are looking to enter into this space, the barriers to entry are increasing. Many of the CASB vendors that are entering the cloud security space are starting from scratch, attempting to catch up to those vendors who already invested in API-based cloud security, or as I call it, CASB 2.0.

In an effort to bootstrap business, small “CASB-like” vendors are creating new cloud app security solutions feature by feature. Instead of offering the full suite of CASB features, like data visibility and control in the cloud, they offer a single function, like content filtering on email. If vendors like these don’t expand their feature sets quickly enough, a cloud app provider might upgrade their own platform, making these one-off features obsolete overnight.

New Partnerships and Acquisitions

Mail Transfer Agents (MTAs), like Proofpoint and Mimecast, provide a specialized gateway built for legacy on-premise and/or hosted email servers. But many organizations now use cloud email and cloud apps, like Google Gmail and Drive or Office 365 Mail and OneDrive. The legacy MTA approach doesn’t work in those scenarios because it does not provide visibility and control beyond the gateway.

In contrast, the API-based CASBs can inspect cloud email services for inbound threats and risks, scan internal email and mailboxes, as well as offer analysis and remediation of the corresponding file sharing apps. Therefore, using a combination of an API-based CASB with an MTA can provide complete coverage for your email and cloud apps. If MTAs tout email security but leave gaps between cloud email and services, then they have a responsibility to their customers to do something about it. Therefore we might start seeing CASBs forging new partnerships or become targets for acquisition as MTAs seek to close their cloud security gaps.

Enlightened Users

One of the most refreshing developments is a growing awareness that cloud apps don’t defend your organization against insider and regulatory threats. Every major hack or breach in an industry sends smoke signals to the rest who haven’t suffered the same fate yet. In the past, tech pros ran from one fire to the next, but this year, we expect them to take cloud security risks seriously enough to purchase solutions that prevent the worst case scenarios.

Recent examples:

Charlotte Housing Authority hit with W-2 tax breach

Emory Healthcare reports data breach involving 24K patients, a former physician, and a OneDrive account

Google Docs Phishing Scam a Game Changer

Find out how Waratek’s award-winning application security platform can improve the security of your new and legacy applications and platforms with no false positives, code changes or slowing your application.

cloud security ,cybersecurity ,cloud access security broker ,security

Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}