Cisco Umbrella CASB: Cloud Visibility, Data Protection and Zero Trust Investigation
Cloud applications have changed where users work, where data is stored and where security decisions must be made. A modern Cloud Access Security Broker (CASB) approach is therefore not simply about blocking applications. It is about discovering cloud activity, understanding identity and data context, applying proportionate controls, and investigating what actually happened.
Identify sanctioned and unsanctioned SaaS activity and build visibility into the real cloud environment.
Combine identity, application, device, data and requested activity before making a policy decision.
Correlate cloud, identity, DNS, web and security evidence to distinguish signals from confirmed incidents.
Cisco Umbrella CASB Architecture Explorer
Explore how cloud application discovery, identity context, data protection and security policy fit together. Select any component to examine its engineering role.
Select an architecture component
Explore the CASB Security Model
Follow the investigation from cloud discovery through policy, protection and evidence-driven response.
Cloud Application Visibility
Discover the real SaaS environment, identify shadow IT and establish application risk before enforcement.
Identity, Application & Data Context
Combine identity, device, application and data signals to turn cloud activity into policy decisions.
CASB Enforcement & Protection
Understand where Inline CASB, API CASB, DLP and RBI fit within the cloud protection architecture.
Cloud Security Investigation
Correlate identity, SaaS, data and network evidence to reach a defensible security conclusion.
Cloud Application Visibility: Discovering the Real SaaS Environment
Before a security team can protect cloud applications, it needs to understand what applications are actually being used. SaaS adoption rarely follows the approved application catalogue. Employees may introduce new services, connect third-party applications through OAuth, or move business data between platforms without the security team having complete visibility.
What CASB visibility needs to establish
- Which cloud applications are being accessed?
- Which applications are sanctioned and which are unknown?
- Which users, devices and identities are involved?
- What type of activity is taking place?
- What data could be exposed or transferred?
- How much risk does the application introduce?
Cloud Application Visibility: Discovering the Real SaaS Environment
Cloud application security starts with visibility. Organisations may have an approved catalogue of SaaS services, but real-world usage is usually much broader. Users can introduce applications, connect third-party services through OAuth, and move business information between cloud platforms without those activities appearing in a traditional application inventory.
What the security team needs to discover
CASB visibility should establish which applications are being used, who is using them, what devices are involved, what activity is taking place and whether sensitive information may be entering or leaving the organisation.
An unknown application is not automatically a security incident. It is a visibility signal that requires context. The security team needs to understand the application, its users, its data and its business purpose before deciding whether enforcement is appropriate.
SaaS Discovery Explorer
Explore a simplified cloud environment and determine which applications require attention based on usage, approval status and risk.
Identity, Application and Data Context: Turning Cloud Activity Into Policy
Application identity alone is not enough to make a useful security decision. The same SaaS application may be appropriate for one user, device or dataset and unacceptable for another. CASB policy therefore combines multiple dimensions of context before determining what should happen to a cloud request.
The strongest CASB decisions are contextual decisions: identity + device + application + data + activity. This allows security teams to apply controls proportionately instead of treating every cloud interaction as equally risky.
Identity, Application and Data Context: Turning Cloud Activity Into Policy
Once cloud activity has been discovered, the next challenge is deciding what that activity means. A CASB policy should not simply ask whether a user is accessing a particular SaaS application. It should evaluate the identity, device, application, data and requested action together.
The same SaaS application can represent very different levels of risk depending on who is using it, what device they are using and what information they are attempting to move.
Identity, application risk, data classification and activity context provide the evidence required to move from simple visibility toward a defensible security policy.
CASB SaaS Access & Data Protection Engine
Change the identity, application, data sensitivity and requested action. Run the scenario to see how a sample CASB policy evaluates the available context and selects a response.
1. Configure the scenario
2. Policy evaluation
Awaiting scenario
Choose the scenario inputs, then run the policy engine to generate a decision and its explanation.
- The engine evaluates the selected user, application, data and activity.
- The available enforcement path limits the actions that can be taken.
CASB Policy Decision Engine
Evaluate cloud activity using identity, device posture, application risk, data sensitivity and requested action — rather than treating every SaaS request as equal.
CASB Enforcement: DLP, SASE and Remote Browser Isolation
Visibility and policy decisions only become useful when they can drive an appropriate control. Modern cloud security can combine inline inspection, API-based controls, Data Loss Prevention (DLP), SASE enforcement and Remote Browser Isolation (RBI). The engineering challenge is choosing the right control for the evidence and the risk.
CASB Enforcement: DLP, SASE and Remote Browser Isolation
Visibility and policy decisions become operational security controls when they can trigger an appropriate enforcement mechanism. Modern cloud security architectures can combine inline CASB controls, API-based inspection, Data Loss Prevention and Remote Browser Isolation, often as part of a broader SASE architecture.
Inspect and control cloud activity while traffic or sessions are actively being used.
Analyse data and activity already stored within connected SaaS platforms.
Identify sensitive information and apply controls to inappropriate data movement.
Separate risky web content from the endpoint to reduce direct exposure.
Enforcement should be proportional to evidence and risk. A mature cloud security architecture does not automatically block every anomaly; it selects the control that best matches the identity, application, data and activity involved.
Shadow IT & Data Exposure Investigator
Act as the security analyst. Review a simulated SaaS security incident, examine the evidence and select a response supported by what the evidence actually establishes.
1. Select an incident
2. Review the evidence
DNS and web gateway telemetry show connections to a service not present in the approved application catalogue.
Discovery signalSeveral requests are associated with the same source identity, where identity mapping is available.
Activity patternNo SaaS audit record or API evidence has yet confirmed that sensitive files were uploaded.
Evidence gap3. Analyst findings
Investigation not submitted
Select an incident, review its evidence and choose the response that best fits the facts. You will receive feedback explaining the evidence and limitations.
Identify the user, application, activity, relevant time window and available data sources.
Compare network records with SaaS audit events, identity logs and API evidence where available.
Choose a supported control, preserve evidence and verify that remediation worked.
Where Should the Control Live?
CASB is not a single enforcement point. Select a protection mechanism and inspect where it operates across the user request, cloud activity, stored data and endpoint exposure.
Inline CASB
Inline CASB provides visibility and policy enforcement while the user is actively accessing a cloud application.
Cloud Security Investigation: From Alert to Defensible Response
A cloud security alert is not automatically a confirmed incident. Effective investigation requires analysts to correlate the original signal with identity, SaaS activity, DNS and web telemetry, endpoint context and application evidence. The objective is to establish what happened, determine the confidence of the finding and select a defensible response.
An unknown SaaS application becomes more significant when combined with sensitive data movement, unusual identity activity or unexpected OAuth permissions.
A suspected exposure should be investigated through the actual data classification, recipient, activity and available audit evidence rather than the alert alone.
Cloud Security Investigation: From Alert to Defensible Response
Security analytics becomes valuable when individual alerts can be connected to a broader evidence chain. A suspicious SaaS application, unusual OAuth permission or possible data exposure should therefore be investigated across identity, application, DNS, web, endpoint and audit evidence before an operational decision is made.
Start with the alert, anomaly or suspicious cloud activity that triggered the investigation.
Connect identity, SaaS, DNS, endpoint, data and audit information.
Determine what the evidence proves, what it suggests and what remains unknown.
Contain, monitor, remediate or escalate according to confidence and business impact.
An unknown SaaS application becomes more significant when combined with unusual authentication, sensitive data movement, risky OAuth permissions or other supporting evidence.
The objective is not simply to react to an alert. It is to establish a sufficiently supported finding and select a response that matches the available evidence.
Shadow IT Investigation Lab
Move from an alert to a defensible conclusion. Select an incident, collect the available evidence, correlate the signals and decide whether the activity represents a genuine security concern.
Unapproved SaaS Application
A previously unknown cloud application has appeared in enterprise traffic. Determine whether this is simply unsanctioned software or a genuine security concern.