CASB Webhook Routing for Active User Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud Access Security Broker (CASB) systems face challenges in efficiently scanning and securing data in cloud-based Software-as-a-Service (SaaS) applications due to the 'shadow ID' problem, where user credentials are compromised, and traditional CASB systems experience latency and inability to scan all files properly, leading to poor user experience and data security vulnerabilities.
Innovation Solution
An efficient CASB system that performs distributed file crawling, integrates Webhook notifications for real-time data change detection, and utilizes geolocation to route scans to the closest scanner, supporting massive scale and compliance with local regulations, while operating with various cloud applications through APIs and an 'assembly line' approach for parallel processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional CASB systems scan all files in cloud applications, then data security is improved, but system latency increases and user experience deteriorates
Solution Approach 1:
The system performs preliminary actions by establishing webhook subscriptions in advance with cloud applications. When files are created or modified, the webhook automatically triggers and pushes notifications to the CASB system before users can potentially access or share the files. This preliminary notification mechanism eliminates the need for continuous scanning while maintaining real-time security monitoring.
Solution Approach 2:
The cloud applications themselves perform the work of notifying the CASB system about file changes through webhook integrations. The CASB system does not need to actively query or scan files; instead, the cloud applications self-serve by automatically pushing change notifications when files are created, modified, or shared. This shifts the monitoring burden from the CASB system to the cloud application infrastructure.
2Reliability
If CASB systems scan billions of files in cloud applications, then comprehensive security coverage is improved, but processing capacity is overwhelmed and productivity decreases
Solution Approach 1:
The system extracts only the essential security information from cloud applications through webhook notifications. Instead of retrieving and scanning entire files, the CASB system receives compact notifications containing only metadata about file changes (creation, modification, sharing events). This extraction approach provides comprehensive security coverage across billions of files while maintaining processing capacity by avoiding bulk data retrieval.
Solution Approach 2:
The system performs partial scanning by focusing only on files that have been created or modified, as indicated by webhook notifications. Rather than scanning all files in the cloud application, the CASB system selectively processes only the subset of files that have changed. This partial action approach maintains comprehensive security coverage for dynamic files while preserving processing capacity.
3Reliability
If CASB systems monitor all user activity in real-time, then data loss prevention is improved, but system complexity increases and ease of operation decreases
Solution Approach 1:
The CASB system acts as an intermediary between cloud applications and security policies. Webhook integrations serve as intermediaries that automatically transmit file change notifications from cloud applications to the CASB system. Policy enforcement rules act as intermediaries that automatically evaluate notifications and execute appropriate actions (allow, block, quarantine). This layered intermediary architecture simplifies the overall system by automating the monitoring and enforcement workflows.
Solution Approach 2:
The system implements feedback loops where webhook notifications provide real-time information about file changes, and policy enforcement rules automatically respond with appropriate actions. The CASB system receives feedback from cloud applications about user activities and provides feedback by enforcing security policies. This automated feedback mechanism enables real-time data loss prevention without requiring complex manual monitoring systems.
Data Source
AI summary
Systems and methods include causing a scan by Cloud Access Security Broker (CASB) system of a plurality of users associated with a tenant in a Software-as-a-Service (SaaS) application where the scan includes any of identifying malware in content in the SaaS application and identifying confidential data in the content in the SaaS application; during the scan which is covering historical data in the SaaS application, receiving notifications of the content being actively modified by any of the plurality of users; and including the content being actively modified in the scan with the historical data. The systems and methods can further include maintaining geolocation of the any of the plurality of users; and causing the content being actively modified in the scan to be processed by the CASB system based on the geolocation.