CASB System Active User Identification and Load Balancing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud Access Security Broker (CASB) systems face challenges in efficiently scanning and securing data across multiple SaaS applications due to increased loads, latency, and the 'shadow IT' problem, where user credentials are compromised, leading to security vulnerabilities and data loss risks.
Innovation Solution
The implementation of a distributed CASB system that utilizes Webhook integration for real-time data modification detection, geolocation-based routing for efficient scanning, and an 'assembly line' approach with parallel processing to handle large volumes of data, ensuring near-real-time scanning and compliance with local regulations, while avoiding permanent data storage and confidential credential storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a CASB system scans all files in cloud applications, then security monitoring and data loss prevention are improved, but system latency increases and user experience deteriorates
Solution Approach 1:
The system pre-computes and caches file metadata, hashes, and security classifications before they are needed for scanning. When a user accesses a file, the CASB system has already prepared the security context, allowing immediate security checks without blocking user operations. This preliminary preparation eliminates the latency that would otherwise occur during real-time scanning.
Solution Approach 2:
The CASB system creates and maintains a parallel copy of file metadata and security attributes separate from the actual file data. This copy structure allows the system to perform security scans on the metadata copy without accessing or blocking the original files, thereby maintaining user experience while providing comprehensive security monitoring.
2Reliability
If a CASB system scans all files in cloud applications, then security coverage is improved, but system productivity decreases due to tremendous loads
Solution Approach 1:
The CASB system divides the file scanning workload into multiple independent segments based on file types, user groups, or organizational units. Each segment can be processed in parallel by separate scanning threads or distributed across multiple CASB instances, transforming a single bottleneck into a scalable distributed system that maintains high throughput while providing comprehensive security coverage.
Solution Approach 2:
The system implements risk-based scanning that applies full security checks only to files matching specific risk criteria (e.g., sensitive file types, unusual access patterns, high-value data), while applying lighter or sampled scanning to low-risk files. This partial action approach maintains comprehensive security coverage for critical assets while preserving overall system productivity.
3Loss of information
If the CASB system stores scanned data permanently, then incident reporting and auditing are improved, but data storage costs and security risks increase
Solution Approach 1:
The CASB system extracts and stores only essential security-relevant metadata (file hashes, security classifications, access patterns, incident flags) while discarding redundant file content and temporary scanning data. This extraction approach provides sufficient information for incident reporting and auditing without the burden of storing complete file copies, thereby reducing storage requirements and associated security risks.
Solution Approach 2:
The system implements a tiered data retention policy where scanned file data is temporarily retained during active monitoring periods for immediate incident response, then automatically discarded after a defined retention period. Critical security indicators and incident records are recovered and preserved in an aggregated format for long-term auditing, balancing incident reporting needs with storage efficiency.
Data Source
Figure 1A
Figure 1B
Figure 2~3
AI summary
Systems and methods include causing (851) a scan of a plurality of users (102) associated with a tenant in a Software-as-a-Service (SaaS) application (800) where the scan includes any of identifying malware in content in the SaaS application and identifying confidential data in the content in the SaaS application (800); during (852) the scan which is covering historical data in the SaaS application (800), receiving notifications of the content being actively modified by any of the plurality of users; and including (853) the content being actively modified in the scan with the historical data.