CipherCloud CASB+

Organizations increasingly adopt cloud services for faster deployment, flexibility, and cost advantages, but cloud usage often sits outside established IT access governance. Unlike on-premises systems, cloud services—including personal cloud tools used by employees and partners—may bypass organizational oversight, especially when accessed from mobile devices beyond the corporate perimeter. This lack of integration creates governance challenges for legal and regulatory compliance (notably GDPR requirements for controlling personal data transmission, processing, and storage) and expands cyber-risk, including unauthorized access, data theft or corruption, and malware implantation that can later infect the enterprise.

Because traditional security and governance tools were slow to mature for cloud needs, Cloud Access Security Brokers (CASBs) emerged to fill the gap, and several have been acquired by major security vendors. Recommended CASB capabilities include discovering cloud service usage, controlling access and data movement into approved services using directory-based and service-native controls, protecting regulated/sensitive data via classification plus policy-based controls (encryption, tokenization, pseudonymization) without breaking service functionality, detecting and preventing cyber threats (malware, unauthorized access, leakage), and supporting compliance with “out-of-the-box,” regulation-aligned features backed by certification or proven deployments.

CipherCloud’s CASB+ platform (founded 2010; headquartered in San Jose with global offices) is positioned as a second-generation CASB combining discovery, inline/API controls, DLP, malware detection, UEBA, mobile protection, and an encryption/tokenization gateway. It integrates with Active Directory, SSO, and IDaaS providers, applies real-time anomaly policies (e.g., impossible travel, unmanaged devices), scans new and historical cloud data, and preserves SaaS functionality through patented indexing/search on encrypted data. Key challenges include reliance on undocumented SaaS traffic structures that may change, and tokenization’s requirement for a secured on-premises database. CASB+ still lacks broader access governance functions such as segregation of duties and access attestation.

• Cloud services adoption is driven by speed to deployment, flexibility, and price benefits.
• Employees and associates can use personal cloud services for work without employer involvement.
• Mobile devices may access cloud services from outside the organizational perimeter.
• GDPR requires control over the transmission, processing, and storage of personal data.
• CASBs emerged because traditional access governance and security tools were slow to develop cloud-specific capabilities.
• Some CASB vendors have been acquired by major security software vendors and integrated into their toolsets.
• CipherCloud was founded in 2010 and has its US headquarters in San Jose, California, with offices worldwide.
• CipherCloud CASB+ can be deployed on-premises, as a hosted service, or in a hybrid model.
• CipherCloud uses AES 256-bit encryption and its cryptographic module has achieved FIPS 140-2 validation.
• CipherCloud CASB+ does not provide segregation of duties or attestation of access rights capabilities.

• “In an ideal world, the functionality to manage access to cloud services and to control the data that they hold would be integrated with the normal access governance and cyber security tools used by organizations.”
• “Detect Cloud Service Usage– Identifying the cloud services being used from within an organization and providing control over their use is a key capability to manage risk.”
• “Protect Data held in Cloud Services: regulated and sensitive data held in cloud services should be protected against unauthorized access and disclosure.”
• “Support Compliance - many organizations depend upon their data being processed and protected in a way that is compliant with laws and regulations.”
• “CipherCloud CASB+ detects user access to cloud services in real time, identifies anomalous accesses and creates alerts that can be used to block unauthorized access.”
• “CipherCloud CASB+ includes an inbuilt DLP (Data Loss Prevention) engine.”
• “The CipherCloud CASB+ platform scans all in-bound and out-bound cloud content for malicious code and cleans or quarantines infected content on the fly, without adding any noticeable latency.”
• “It supplements the logs provided by cloud application providers by tracking all ‘read’ and ‘write’ actions.”
• “The customer retains sole ownership of the encryption keys and token database within the enterprise.”
• “In the longer-term consideration is needed as to where this kind of functionality should best be provided.”