Explain like I'm five · Security

What is a CASB?

Cloud Access Security Broker, told as a story about the gatekeeper on the road to the sheds outside.

Photo ShedMail ShedMeeting Shedthe castlesheds outsideoutside the walls, the castle guards can't see

These days things are kept in sheds outside.Photos in the photo shed, mail in the mail shed. Outside the walls, the castle guards can't see them.

?castle guard: no ideaSECRETthe free shed is just easierFree Shednobody knows whose it is

Sheds nobody knows about appear."The free shed is just easier." The castle has no idea where the red-stamped papers went.

the brokerPhoto ShedMail ShedMeeting Shedwho goes to which shed, carrying what

A CASB is the gatekeeper between the castle and the sheds.It stands in the middle of the road and sees who goes to which shed, carrying what.

The shed listwhich sheds are in use
Approved shedsonly known sheds pass
Bag checkany secret papers inside
Rules in the shedthe castle's rules, out there too
Free Shedunknown sheds are blockedPhoto Shedshed rulesno sharing outsideSECRETknown sheds get the castle's rules

Unknown sheds are blocked; known sheds get rules."No secret papers in the shed." "Don't leave the shed door open to the whole town."

home?Photo Sheda deal with the ownerlook inside directlystraight from home to the shed, the broker never sees it

Skip the gatehouse road, and it sees nothing.Straight from home to the shed? So the broker also makes a deal with the shed's owner (an API) to look inside directly.

In one breath

A CASB = the gatekeeper between the castle and the sheds outside. It sees who carries what where, blocks unknown sheds, and puts the castle's rules on known ones.

Cloud Access Security Broker, a name Gartner coined in 2012. Today it usually ships inside an SSE/SASE bundle — Netskope, Zscaler, Microsoft Defender for Cloud Apps.

When grown-ups say it

SaaS / cloud app
A shed outside. Google Drive, Slack, Dropbox — storehouses outside the walls.
Shadow IT
The shed nobody knows about. The free shed employees quietly use because it's easier.
Sanctioned app
The approved shed list. Sheds the castle knows and has rules for. The rest are blocked or watched.
Inline / proxy mode
The gatekeeper on the road. Every trip passes the gatehouse, so it can stop things in the moment.
API mode
The deal with the shed owner. Sees inside the shed without the road — but only after things are already in.
Cloud DLP
Bag check on the way to the shed. The red-stamped paper check, applied on the shed road.
Sharing misconfiguration
The shed door left open to the whole town. "Anyone with the link." The mistake the broker catches most.
SSE · SASE
The gatekeeper bundle. The modern name for selling the shed broker, the hallway watcher and the castle that always asks as one bundle.
Next story
The Checkpoint to Town →
Want another term as a picture book? Request →