Retour 
According to Gartner, cloud access security brokers (CASBs) deliver capabilities around four pillars of functionality; visibility, compliance, data security, and threat protection. Within the data security pillar, Gartner identifies DLP as being natively included in a CASB. This makes sense given the fact that a CASB acts as a control point between users, the cloud services they are accessing, and the sensitive data they are consuming and sharing. This is especially important as more than 33% of business data now resides in the cloud and it needs to be protected.
While the DLP capabilities from many CASBs look similar at the surface, many vendors miss key features that limit their ability to adequately cover all cloud traffic in your environment, inspect all content your users interact with, and protect sensitive data accurately without a lot of false positives. To help you evaluate the DLP capabilities of CASB vendors, here are the 10 essential DLP features that you should look for.
#1 Inspect cloud traffic from on premises, mobile, and remote users
The first requirement is centered around the traffic you are inspecting and specifically covering where your users are located. A first order requirement is to ensure you have proper coverage and can inspect cloud traffic involving users that are on-premises, mobile, or remote. This is where many CASBs come up short as many focus only on on-premises cloud traffic. With more than 50% of cloud usage occurring outside of your network, you need to make sure you extend your DLP coverage to mobile and remote users too.
#2 Inspect cloud traffic emanating from a browser, mobile app, desktop app, and sync client
In addition to enabling your DLP to cover users that are on premises, mobile, and remote, you want to make sure that the CASB inspects traffic emanating from web browsers, mobile apps, desktop apps, and sync clients. Most CASBs will cover you for web browser traffic, but are essentially blind when it comes to sensitive data coming from mobile apps on iOS and Android or desktop apps on PCs and Macs.
#3 Inspect content in and en route to and from sanctioned cloud services
Now that you have identified a CASB that can cover where your users are and how they are using the cloud, the next requirement is to ensure that the CASB’s DLP can inspect content in sanctioned cloud services and enroute to and from sanctioned cloud services. From Office 365 to Google G-Suite, you want to ensure that you get your arms around the data resident in these cloud services and prevent leakage of sensitive data in real time. This is a requirement that most CASBs should be able to address, but it is important to verify what sanctioned cloud services are supported as support will vary across CASB vendors.
#4 Inspect unsanctioned cloud traffic
The ability to apply DLP to sanctioned cloud services is important, but you can argue that being able to also apply DLP to unsanctioned cloud services is even more important. After all, 95% of all cloud usage is shadow IT and you want to ensure sensitive data is not exfiltrated from sanctioned to unsanctioned cloud services. Many CASBs come up short here. While they can discover Shadow IT, they can’t inspect or enforce DLP policies on 95% of the cloud t