What is a cloud access security broker and what does it do?

A cloud access security broker, or CASB, is a security tool that sits between an organization's users and cloud service providers, enforcing security policies for cloud application usage. CASBs provide four key capabilities: visibility into which cloud services are being used including shadow IT discovery, compliance by verifying that cloud usage meets regulatory requirements, data security through encryption, tokenization, and data loss prevention for cloud-stored data, and threat protection by detecting anomalous user behavior and malware in cloud services.