1 Introduction

Cloud Computing (CC) has emerged as the need of every enterprise in recent times and is turning into an integral part of all other technologies such as IoT, Big data, and Quantum computing [1]. Technology Review followed the coinage of the term “Cloud Computing” (CC) back two-decade earlier, to November 14′ 1996, and an office park outside Houston by “George Favaloro” and “Sean O’Sullivan” [2]. Indeed even though numerous individuals accept that CC may be a quite newborn marvel, it has its roots within the thoughts expected in the 1960s. J.C.R. Licklider of ARPANET is generally described as the primary one to present the thought of an “intergalactic computer network” in 1969, a machine that can be accessed from any place within the world. But even before him, in 1961, John McCarthy floated the thought of computation being given as open benefit just like any other benefit, a concept he named as “utility computing” [3], and in numerous ways, typically completely what CC is these days. Over the 1960s and’70 s, expansive banks of computers included so-called “time-sharing” services to nearby and inaccessible partners. In the 1980s and early 90 s, expansive scattered data centers were installed by huge enterprises. There was not an earth-shattering breakthrough until the Web got to be very common and effortlessly available. In the year 1999, Saalesforce.com was the primary company that was supplying the working application through the web to the clients. In the year 2002, Amazon Web Services (AWS) aws.amazon.com emerged and provided a heap of cloud services such as capacity and computing. Later in 2006, Elastic Compute Cloud (EC2) also known as EC2 clusters, was introduced by Amazon which helped in setting up small and medium companies and let people rentout their servers for performing pointed computation. In the very same year, Simple Storage Service (S3) was also launched by Amazon which enabled people to use the cloud for storing their information online. After this many tech industries jumped into the business of different cloud services. Google in the year 2009, introduced “Google Apps” compatible with its chrome browser which helped engineers to develop their items and also permits them to host them on Google servers as a web application. Simultaneously Microsoft and Apple pushed their cloud capacity items too, i.e. OneDrive and ICloud respectively. Meanwhile, Microsoft started Microsoft Azure too to be utilized by the buyers to fulfill a variety of objectives from online capacity to databases, web APIs to full-grown web applications to fully presented Linux and Windows VM. As time passed, many stakeholders kept entering this field, and cloud computing technology is expected to be more reasonable easily accessible, and useful in the future, particularly by techstartups and administrators [4]. To share imaginative thoughts and developments in this cloud computing field, a premier conference was started in 2009 with the name “International conference on cloud computing” (ICCC). The effectiveness of the cloud lies in its boundless supply of services such as servers, the storage of information, and anything as a benefit (XaaS) is conceivable [5]. Cloud computing is a live field. This image remained the toast of conferences and gatherings in the IT spaces these days and we have found boosting clues of its services and acknowledgment within the ventures as well as the scholarly community [6]. Another conference named “International Conference on Parallel, Distributed and Grid Computing (PDGC – 2010)” has been started in 2010, due to the emerging importance of cloud computing. The ICCC and PDGC conferences emerged as the platform to share the ideas of the academicians and analysts of the zone of cloud computing. Besides these conferences, a separate journal dedicated to cloud computing was introduced to share the ideas within the said field by the name of “Journal of Cloud Computing: Advances Systems and Applications”, published by Springer. But despite all its buildup and utilization, the ideaof CCis pretty elusive and its definitionis still very unclear. In over simplified terms, the cloud gives further computing and capacity services from a pool of shared assets to its customers. A much more accurate definition is given in Table 1.

Table 1 Definitions of Cloud Computing
Full size table

Distinctive cloud computing services have been created to demonstrate CC which is, SaaS, IaaS, PaaS, CaaS, DaaS, BaaS, NaaS, OaaS, FaaS, HaaS, and XaaS [7]. Table 2 shows the list of CC services alongside its existing field.

Table 2 Cloud service models
Full size table

Several systematic literature reviews (SLR) in different areas of CC have been performed to synthesize the available research on different topics. For example, [33] presented an SLR on the “Cloud Brokerage: A Systematic Survey”. Hibatullah Alzhrani et al. [34] performed “A Brief Survey of Cloud Computing” to recognize the research gap in the field of cloud computing. As per the audit [35], a requirement of a study is present which includes recognition, evaluation, and interpretation of the CASB strategies and also provides guidance for the research work to be carried out in the future. Afterward, an SLR on CASB is shown by taking into account the rules of the cloud environment [33], to address the above saidsearched problem.In Sect. 4, this may be the essential consideration which appears the SLR on CASB with the point to address the RQs.

The cloud services market is flooded with a large number of heterogeneous cloud solutions, making cloud service selection a difficult undertaking for the Cloud Services Customer (CSC) [36,37,38]. Furthermore, because each CSP exposes its API, designing and developing an application so that it can be deployed on a specific CSP does little to reduce the development effort required to move the application to the selected CSP, for example, if it performs poorly. To fill in the gaps mentioned above, the cloud community has long advocated for CASB to act as a middleman between CSCs and CSPs, reducing the risk of choosing the wrong CSP. A CASB is a middleman between CSCs and CSPs who helps CSCs make decisions and improve service delivery (Barker et al. 2015) [39]. The range of difficulties surrounding CASB has prompted so much study that it is necessary to evaluate suggested solutions methodically. Few studies have looked into CASB research initiatives such as methodologies of selection of cloud services [40], cloud portability and interoperability [41], and different mechanisms of resource allocation [42], enhancing the security of cloud environmentwith CASB [43], different CASB policies [43], and Fuzzy CASB for requirements negotiation and prioritization [44]. They have discussed CASB from the perspective of a CSP, with a focus on portability and interoperability between CSP cloud services (i.e., IaaS, SaaS, PaaS, etc.). Furthermore, to our knowledge, no SLR on RSM Analysis-based CASB has been conducted, which is essential to assess progress in this subject and recommend dimensions for future research. This article presents the findings of an SLR conducted on the topic of RSM Analysis based CASB.

An SLR distinguishes, categories, and changes comparative suggestions of the current research and centers on information exchange within the research community [45]. Moreover, for this article, an SLR was carried out, with the essential aim to make out, taxonomically categorize, and methodically compare the existing research, based on arranging, implementation, and approving the relocation of bequest frameworks for CASB-based programs.

In this regard, the contribution of this article is to examine and evaluate existing solutions in terms of:

  • researching methods for designing and implementing CASB;

  • providing a thorough overview of existing CASB strategies, as well as how they have been applied to a cloud computing environment;

  • having a fundamental understanding of the functions performed by CASB;

  • highlighting areas for a future study where improvements can be made and recognizing the fundamental limits of present solutions;

  • investigating the reasons behind the demand for CASB;

More particularly, the article endeavors to answer the following questions, through conducting a methodological review of existing research:

  1. 1.

    What are the driving strengths behind CASB for cloudsecurity?

  2. 2.

    What are the current assignments, strategies, and processes to fortify CASB of legacy on-premise software to cloud environment? Additionally,What is the relevant existing research themes?

  3. 3.

    What measures ought to be taken in arrange to create future research direction about measurements in legacy to-cloud CASB?

The motive behind this workis to uniformly distinguish and categorize available resources on encryption and decryption of CASB [46]. Thereafter, correspondingly providing comparative analysis and foundations of the current research work.

The remainder of this article consists of seven sections: Sect. 2 present the related work. Section 3, defines the details of the CASB for the disciplined working of CC. Section 4 presents an understanding of the research process. Section 5 demonstrates the vulnerabılıty. Section 6 shows the outcomes of this SLR and deliberates the solutions of the RQs. Section 7 represents the RSM anaylsıs usıng CCD model for the CASB system. Section 8 analyzes the open challenges, issues,and future directions. Finally, Sect. 9 presents the conclusion and future research directions.

2 Related work

CASB is a big but fragmented area, with significant differences in contributions and the terminology used to describe them in academic papers. To our knowledge, this is the first survey that addresses this discrepancy and, in doing so, provides a full review of the state-of-the-art as well as precise and well-supported recommendations for future work. Table 3 shows the related previous work.

Table 3 Related previous work
Full size table

Although the proposed approach is comparable to theirs in some ways, the proposed analysis is from the standpoint of the CSC (i.e., how the CASB benefits the CSCs), whereas theirs is from the perspective of the CSP (i.e., the interoperability and collaboration between the CSPs). Other aspects of CC have been studied, including design [57], resource management [58] and [59], monitoring [60], migration [61], service composition [62], and security [63] and [64].

3 Cloud access securıty brokers

Cloud is the new place to store data, applications, and resources nowadays butthe cloud providers are not able to ensure the secure experience of using the cloud.CASB could be a preclude educate inside the field of CC whose aim is to recognize and survey all the cloud applications in use, give dealing with sensitive data, encrypt or tokenize sensitive substance to uphold the privacy, security, and workable make use of cloud organizations over a few cloud platforms [35]. CASB may be a colossal but ambiguous field. There is a critical conflict between commitments and the expression utilized to depict them in investigation papers. In [35], Gartner envisions the CASB as a course of activity of four interconnected columns, i.e., “visibility”, “compliance”, “data security”, and “threatprotection” as depictedin Fig. 1. CASBs are a data-key arrangement for securing data end-to-end, from any application to any gadget. Whereas early cloud security solutions were centered on SaaS security, CASBs have advanced into wide stages that ensure information over SaaS, IaaS, and private cloud applications. CASB works as a tool that sits between an organization’s- premises framework and a cloud provider's framework. As per the demand of organizations, which are transiting from internal bound-based applications to the cloud, deep visibility over corporate data as well as IT administrators’ granular control over data access is provided by CASBs by intermediating or “proxying” traffic between cloud applications and end-user devices. The movement of “packets” between users and applications essentially changes the strength of cloud and mobility. This has raised a necessity to adjust the list and the expenditure preferences in security controls for exhausting cloud services by any organization. By 2022 (Strategic Planning Assumptions) 60% of tremendous wanders will utilize a cloud CASB arrange for their cloud organizations, which is up from less than 20% these days [65]. Even though 2023, at the smallest 99% of cloud security disillusionments will be the customer’s fault [65]. The applications of CC and the encouragement to CASB are portrayed in Table 4.

Fig. 1
figure 1

Pillars of sCASBs [48]

Full size image
Table 4 Applications of CASB
Full size table

3.1 Challenges in CASB

In the SLR carried out, we have laid down (as shown by Table 5) various challenges within the CASB development and have attempted to reply to RQ2 by listing out different challenges that enterprises face, while adopting the CASB.

Table 5 CASB challenges [66]
Full size table

3.2 Best practices for CASB

Figure 2 shows the ten major categories of best practices for CASB in cloud computing.

Fig. 2
figure 2

Best practices for CASB [110]

Full size image

3.3 Cloud security work flow and cloud security life cycle-A conundrum

Cloud computing faces two main challenges Security and Reliability. As any other client can access the client's data in the cloud, this raises security issues in the cloud. Hackers could attempt to steal client data by authenticating using authorized user names and passwords, modifying the data, and making changes. So many techniques are available to achieve security in the cloud, such as Encryption, Authorization, and Authentication. Cloud security risks can be categorized into cloud users and cloud service providers. Some of the cloud security risks are Data leakage, Data breaches, and loss, Hacking, Denial of Service, malicious insiders attack, and some shared technology issues. Authentication, authorization, data protection, etc., are some of the security aspects that cloud service providers must cover and basic security goals that need to constitute basic security principles, and it became more crucial as data move to the cloud. Trust of the cloud service provider (CSP) and its services is among the principal drivers of a customer deciding to migrate to a cloud platform or conform to the legacy framework [67]. Trust relies upon deciding whether the provider is responsible for all risks such as data protection, VM security, and other regulatory concerns. "Confidentiality, Integrity and Availability " are the three considerations considered during the cloud system security review (CIA) [68]. This section's primary objective is to generalize security requirements for the modern cloud infrastructure since the CIA domain is the commonly used method for defining security vulnerabilities in the conventional information system. Figure 3 depicts the essential features of data security in cloud computing, as well as potential risks and defense techniques [69].

Fig. 3
figure 3

Important components of data security in cloud computing

Full size image

3.4 Confidentiality and privacy

The security of some business properties from exposing unauthorized users implies secrecy. Consumers like unauthorized access to data stored in the same database in a cloud world as the CSP data may be clients. The CSP itself can even include unethical or nefarious representatives who may access or even tamper with confidential, sensitive consumer data. Besides client info, the network of virtual computers, virtual pictures, etc., ultimately need secrecy.

Certain confidentiality concerns related to cloud data include:

  • A variety of cloud storage services send content to customer data-containing web folders.

  • Another aspect that impacts data security is the whole geographical area of the client’s information.

Cloud services are believed to be reliable but odd in some cases. They want to hear more about the details of personal data files and user privilege data. They want to hear more about the contents of user data files and user privilege data. The owners should formulate appropriate access management procedures to prevent specific scenarios.

The security of information systems, according to (Dukes 2015) [70], is characterized as “the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction to ensure confidentiality, integrity, and availability”. There are three main security services:

3.4.1 Integrity

Integrity applies to an asset's security property that ensures that it has not been changed by third-party employees who are not allowed to do so. Consequently, the accuracy and correctness of the asset concerning its owner are ensured by this property. Typically, inserting, removing, or modifying operations are assumed to alter the integrity of any support. With the user accessing cloud resources through web browsers, all web attacks in the cloud environment are widespread, causing user file contents, database, virtualized storage, or, indeed, WSDL files to be changed [71,72,73,74,75]. The following problems of data security were addressed here under the separate integrity specifications of the public cloud:

3.4.2 Data outsourcing

The outsourcing of data at the CSP end constitutes a direct challenge to its credibility. CSP will be able to erase any legitimate consumer data tuples, which the customer could never create.

3.4.3 Insecure API

The web developer has used the insecure API from Obscure sources for a lot of time, where the API key can lead to the attacker.

3.4.4 Collision attack

A collision attack is an operation that can merge several copies of media or other files to create a new copy. The tasks that include, but are not limited to, are data averaging, substitution, linear data mix, etc.

3.4.5 Wrapping attack

İs another common network attack that is naturally extremely likely to occur for cloud systems. The text and signature are duplicated and sent to the server as an authentic user during SOAP translation in TLS (Transport Layer service) layer.

3.4.6 Availability

Demand is one of the most critical protection factors to be maintained by a CSP. Multiple business organizations who utilize cloud-based technology to support their consumers should guarantee that these services remain available as a minor downtime will result in a significant irrecoverable financial loss. A standard service-level agreement lays out what the supplier has promised to supply and respond to demand. For, e.g., the service level could state that 99.999 percent of the time, if more than 80% of the support given is used, the programs will be utilizable, and more resources will be dynamically available.

3.4.7 Actors in cloud computing

In terms of responsibilities and roles, the reference architecture identifies five main actors (as shown by Fig. 4). Cloud consumers, cloud providers, cloud auditors, cloud brokers, and cloud carriers are among the actors [76, 77].

Fig. 4
figure 4

Actors in cloud computing and their duties

Full size image

Cloud consumer Who (person/organization) maintains business relationships with Cloud Providers and uses their services?

Cloud provider A (person/organization/entity) guarantees that a service is available to those who are interested.

Cloud broker A third party that can estimate cloud services, performance, information system operations, and security of cloud installation separately.

Cloud carrier An intermediary that provides cloud service connectivity and transmission (from CPS to Cloud Consumers).

Once a person is familiar with the cloud security workflow and cloud security lifecycle [see Figs. 5 and 6], one can adopt CASB and other cloud security solutions to provide full coverage for cloud applications usage [66].

Fig. 5
figure 5

Cloud security workflow [66]

Full size image
Fig. 6
figure 6

Cloud security lifecycle [66]

Full size image

3.5 CASB management portal

Enterprise CASB management portal should plan to integrate with their existing identity sources such as compute, data services, data storage, app services, and CASB pillars as shown by Fig. 7.

Fig. 7
figure 7

CASB management portal

Full size image

3.6 CASB use cases

In the SLR work, various use cases in the CASB process have been identified (refer to Table 6).

Table 6 CASB use cases [66]
Full size table

3.7 Identifying and protecting sensitive cloud data

In this SLR work, various sensitive cloud data processes have been identified (refer to Table 7).

Table 7 Identifying and protecting sensitive cloud data [66]
Full size table

4 Research methodology

To distinguish the research gaps with the help of a literature survey of the CASB; we have applied the steps proposed by Kitchenham and Charters [79]. The steps include “research questions” (RQs), “search strategy”, “study selection”, and “data synthesis”. These steps form the backbone of our review protocol.

4.1 Research questions (RQs)

The objective of this study is to get how different CASB frameworks were developed from the beginning of the state charts to cloud services and to identify an area for further research by considering the strength and weaknesses of the existing services. To achieve this objective, the following research questions (RQs) were formulated (Table 8):

Table 8 Research questions and their motivation
Full size table

4.2 Search policy

We have figured out the subsequent search string to extract the essential studies from five electronic database assets, i.e., “IEEE Xplore”, “ACM Digital Library”, “Springer”, “Science Direct”, and “Google Scholar”, based on the RQs given in Table 9. Based on the RQs listed above, we have created the search string as depicted below.

Table 9 RQs and SSs
Full size table

Search string (SS): ((Cloud OR cloud computing OR cloud access security broker OR RSM, PICO method, and CCD Model) AND (Cloud Simulators OR challenges of CASB OR automation OR limitations OR weaknesses OR strength OR advantages OR disadvantages) AND (review OR systematic review OR literature review OR systematic literature review OR survey OR journey OR literature mapping OR systematic literature mapping OR state-of-the-art)). The succeeding SSas shown by Table10 issuitably intended by using keywords, which are resulting from RQs through the PICO method. These SS are constructed by using Boolean ORs and ANDs.

Table 10 RQs and keywords
Full size table

This plan works in satisfying the queries related to key research questions successfully. SS was developed by using keywords. SSis structured by finding outsubstitutes and different orthographic studies for each of the query components and connecting them by using the Boolean OR and Boolean AND. Keywords are determine dusing the Population Intervention Comparison Outcomes (PICO) process [79] as shown by Table 8 and are used to make. The basics components of PICO are listed as under:

  1. 1)

    Population: The population could be any of the particular part, application, and the state of CASB.

    • Population – cloud computing.

  2. 2)

    Intervention: The intervention is the tool innovation or method that addresses a particular issue.

    • Intervention – CASB.

  3. 3)

    Evaluation Usually a device or innovation or strategy with which intercession is being compared.

    • Evaluation – Legacy on-premises application.

  4. 4)

    Results: Results should co-relate to factors of ranks to practitioners such as improved security, consistency, and cost assistance. All results ought to be indicated.

    • Results – Encrypt/Decryptframework for CASB, better performance, cost asset, applications, upgraded security features, methods, and tools.

4.3 Determination procedure

We also evaluated the pertinence, reliability, and applicability of the selected studies through some QA questions that include. Figure 8 shows the determination procedure for the same. In the first stage of the process, we have selected 173 studies from “IEEE Xplore; ACM Digital Library; Springer; Science Direct; Google Scholar. CC Journal, and Journal of Object Technology (JOT)”. Some of these selected studies were found to be redundant and irrelevant after being scrutinized based on the title and thus were removed from the SLR. Consequently, 82 primary studies were short listed. In the next phase, the selected papers were further reviewed based on abstract and conclusion. Thus, after this phase, 41 studies were shortlisted. Further in the selection process, quality assessment (QA) criteria were employed on the selected studies. Finally, 20 studies were identified and selected after the study selection process. These selected studies, grouped as primary studies, are used to answer the formulated RQs. We also evaluated the pertinence, reliability and the applicability of the selected studies through some QA questions that include (i) “Are the objective of the research clearly expressed ?” (ii) “Is the proposed CASB clearly described?” (iii) “Are the services applied on some case study?” (iv) “Does the research add value to the academia or industry?”. Assessment of these questions was done based onthe following weighting or scoring score: “YES = 1, NO = 0, and PARTIALLY = 0.5”. The selected 41 studies were evaluated on the premise of the over QA questions, and as a result, we have considered those things which have quality scores more noteworthy than 2 (50% of the rating score). Finally, 36 relevant papers using abstract were excepted from the starting inspected studies,and 20 most relevant papers were chosen in this SLR. Appendices 16 and 17 present the list of chosen studies and the quality scores of the chosen studies.

Fig. 8
figure 8

Search and selected process

Full size image

4.3.1 Criteria of inclusion

Table 11 was utilized to incorporate the chosen papers.

Table 11 Inclusion criteria
Full size table

4.4 Criteria of exclusion

The excluded existing research articlesthat did not meet the prerequisites expressed as appeared in Table 5 and the listedconstraints:

  • studies with no-peer reviewed

  • abstracts and editorials

  • articles shorter than six pages

4.5 Statistics fusion

The purpose of data synthesis is to abbreviate confirmation from the selected studies to verify the responses of the RQs. In this article,selectedstudies were created and implemented in the following ways:

  • Informationassociated with RQ-1 has been presented by bar charts.

  • RQ-2, RQ-3, and RQ-4 and RQ-5have appeared in Pie charts which show the dıscussıons as well as experımental results.

5 Vulnerability

Based on the strategies for searching, as per the previous discussions that contained different databases selecting criteria and quality criteria, studies were chosen to perform the SLR. Some possibilities still lie in missing studies as it is not practically possible to extract all the studies by only the usage of terms that appears in the RQs. To overcome this problem, extracted studies need to be scrutinized physically so that studies can be identified which were missed while searching initially. Besides the previous searches, articles from CC and CASB were also taken into consideration to figure out those studies that were not identified during the exploring procedure. To reduce the incorrectness of redundant data, a self-sufficient valuation is done by the author on the extracted studies based on the QA questions.

6 Dıscussıons as well as experımental results

Based on our SLR, we have distinguished ten unmistakable studies distributed from 2011 to 2021, as shown in Figs. 9 and 10. Within the chosen articles, there are five journal articles, three conference articles, and 2 other articles.

Fig. 9
figure 9

Distribution of publication types of selected studies

Full size image
Fig. 10
figure 10

Distributed of selected studies by years

Full size image

6.1 RQ-1: how to assess CASB with their functionalities?

The following objectives shows the CASB functionalities:

  1. 1.

    Form the hub of data (Server) that isconcerned about the CASB, and felicitate the above information among the researchers.

  2. 2.

    To analyze more noveltyin the field of CASB.

  3. 3.

    Characterize continuous arrangements within the area of CASB, and clear up the likenesses and differences between them employing a description system.

  4. 4.

    Simultaneously characterization of work that focuses on the methodology of CASB.

6.2 RQ-2: what are the key challenges for designing CASB?

RQ-2 focuses to identify the requirements i.e., functional requirements (FRs) and non-functional requirements (NFRs) that have motivatedthe research and advancement of CASB. The purpose of this RQ is to find the dares inside the CC degree that moved the assurance for CASBs. It has been established that CASBs are encouragedby the necessities to address the following five key challenges [35]:

  1. 1.

    Moreenterprises’ insufficiency a completeunderstanding of the cloud managements they retain and threats they achieve, which makes similarity and security tough.

  2. 2.

    Although cloud administrations are known, numerous companies endeavor to reliably confirm the secured approach of exact information interior and over these divergent services.

  3. 3.

    Enterprises have no calculated way to uncover whether (and when) compromised unmanaged gadgets are utilized to urge cloud organizations.

  4. 4.

    The CASB gives an arrangement of access-centric and threat-centric efficiencies, creating the complexity of a decision.

  5. 5.

    Several enterprises have entered the CASB advertise with a wide extent of competencies and gets to, complicating likely enterprises and obscuring use cases.

6.3 RQ-3: what are the fundamental duties of a CASB?

RQ-3 recognizes the scope of forms that are executed by CASB to attain its goals. RQ-3 makes a difference to look at the breaches between the supportive gestures and effectiveness of the arrangement and thus recognize areas of future research direction in CASB. Eight fundamental duties have been extricated from the chosen articles from [31] i.e., (i) “Decision Support”, (ii) “Resource Monitoring”, (iii) “Policy Enforcement”, (iv) “SLA Transaction”, (v) “Application Deployment”, (vi) “Relocation”, (vii) “API (Application Programming Interface) Abstraction”, (viii) “VM (Virtual Machine) Interoperability”.

6.4 RQ-4: what are the techniques available for designing the CASB framework?

RQ-3 distinguishes building strategies utilized to execute CASB and analyzes affiliations between strategies and results. The objective of this RQ is to explore how CASB has been caught on. Six fundamental methods has been extracted from the chosen articles from [33] i.e., (i) “Enterprises-based”, (ii) “Framework and Models”, (iii) “Toolkits”, (iv) “Middlewares”, (v) “Semantics”, and (vi) “Pseudo Code/Algorithms”.

6.5 RQ-5: which cloud simulators are available for CC research?

The CC simulators [35] have been created for diverse sorts of modeling. For illustration, CC simulators have been created to bolster taking after documentations: the “SAML (Security Assertion Markup Language)” for trading verification and approval information between organizations (personality supplier and a benefit supplier), “DRM (Digital rights management)” for the illegal redeployment of computerized media, “Cloud DLP (Data loss prevention)” for incessant information observing, “SIEM (Security Information and Event Management)” for explore and react to special cases, “IAM (Identity and Access Management)” for trade handle modeling, and “IPSs (Intrusion Prevention Systems)” for risk security [35]. In expansion to the CASB-Simulators, we have distinguished 46 clouds simulators based on comparison which has been proposed for the modeling of highly sensitive data as shown by Table 12.

Table 12 Comparison summary of cloud simulators
Full size table

7 RSM analysıs usıng CCD model for CASB

The experimental results were used as input for Research Surface Methodology (RSM) to obtain an empirical model. RMS is used to conduct many research works as [104]. For this, the five-level coding was employed for developing the model, three dependent parameters and four center values were considered. A model was developed that predicts vendor outcomes. The said model was seen on a polynomial equation obtained in terms of coded factors as shown in Table 13. The equations are developed to findthe outcome for the vendor when the dependent and independent variables show correlation with each other. The predicted value of each can be depicted by Eq. 1. The equations developed for predicting the outcome for the vendor is as follows:

$$ {\text{Outcome for Vendors}} = + 63.51 + 0.3114 \, A + 0.2890B + 0.8522C + 0.2901D + 1.69E - 0.5719AB + 1.62 \, AC - 1.34AD - 0.5469AE - 2.04BC + 0.5594BD - 0.4219BE - 0.9344CD - 0.6031CE - 0.1656DE + 0.0074 \, A^{2} + 0.3786B^{2} + 0.3786C^{2} + 0.0869D^{2} + 0.7233E^{2} $$
(1)
Table 13 Input parameters for modeling in CCD
Full size table

The condition in terms of coded components can be utilized to form desires nearly the reaction for given levels of each calculation. By default, the tall levels of the factors are coded as + 1 and the moo levels are coded as − 1. The coded condition is valuable for recognizing the relative influence of the components by comparing the figure coefficients. The values predicted from the model as well as actual values can easily be seen from Fig. 10. The principal component analysis (PCA) was used to assess the most influential parameters for vendors outcomes. This PCA has been done using Statistical Package for the Social Sciences (SPSS). The five components namely Vendor profile, Visibility and Governance, Compliance, Threat Protection, Office 365 security, IaaS, and custom apps security and data security were considered for the analysis. In terms of eigenvalue being greater than one, variance has been extracted as shown in Table 14. Component 1 i.e., Vendor profile explains about 52.13% of the variance in terms of the Outcome needed for the Vendor. The variance can be best explained by using the criteria having a cumulative percentage greater than 90, the 6 variables that emerged to be influential are Vendor profile, visibility and governance, compliance, threat protection, and data security have a cumulative percentage of 91.677%. The vendor outcome is predicted from Central Composite Design (CCD) using research surface methodology. The model was randomized so that the best and most appropriate polynomial model can be judged. The model was analyzed using 50 randomized field outputs that were collected from a field study (Fig. 11).

Table 14 Determination of variance explained by components
Full size table
Fig. 11
figure 11

The graph between Actual values and Predicted values

Full size image

The scree plot (as shown by Fig. 12) is a graphical representation of the component with its eigenvalue. The contribution of a componentis assessed by its eigenvalue. The more the eigenvalue, the more is the contribution of that component in the vendor's outcome. As shown in Fig. 11, there appears to be a strong contribution of the Vendor profile, visibility and governance, compliance, threat protection, and data security on vendors outcome out of six factors considered for the study. SaaS (software as a service) is becoming popular among businesses. Companies’ IT teams must oversee the safety of a potentially huge number of apps that handle sensitive data. Customers are responsible for protecting their data, even while the service provider has a robust security system in place (the provider does not understand the data semantics). The CASB is a newly developed system software type that can coordinate this form of security management (CASB). In addition to limiting application users' access to resources, CASB guards against malicious code infiltrating the system. This system’s design pattern. In cloud ecosystems, they play a critical role (Fig. 13).

Fig. 12
figure 12

Scree plot

Full size image
Fig. 13
figure 13

Contour graph of the predicted model

Full size image
Fig. 14
figure 14

3D surface plot of Vendors output (i) Visibility % Governance vs Vendors Profile (ii) Compliance vs Vendors Profile (iii) Threat Protection vs Vendor Profile (iv) Data Security vs Vendors Profile

Full size image

The KMO and Bartlett’s test has been considered for statistical analysis. KMO and Bartlett’s test also found some significant results. The Kaiser–Meyer–Olkin Degree of Sampling Adequacy came out to be 0.67. KMO test results of greater than 0.500 signify acceptable results. The foremost component examination requires that the likelihood related to Bartlett's test of Sphericity be less than the level of importance. The probability related to the Bartlett test is < 0.001, which is also satisfied as it is 0.000. Thus, the result is satisfactory as per the KMO & Barlett’s test and is presented in Table 15. Consumers may now benefit from a wide range of cloud-based products and services. Around 600 services are routinely used by most firms, mostly those of the SaaS kind. There may be a significant logistical challenge in controlling access to both external and internal resources since they might provide employees access to extremely sensitive corporate data. No matter how good a provider's security architecture is, the customer is ultimately responsible for managing who has access to their critical data. There is a new system program that can help manage these apps, and it's called the Cloud Access Security Broker (CASB). According to the literature review, there are now at least 14 different manufacturers of this product. It becomes a fundamental aspect of the institution’s IT governance framework when CASBs are implemented. CASBs can manage a wide range of access scenarios, including mobile devices like smartphones, tablets, and laptops, as well as granting temporary access to cloud apps for certain users. It is also crucial to have CASBs as part of your cloud infrastructure. Software product line extension to encompass systems other than the product itself and their interactions with it is known as an ecosystem. As part of cloud ecosystems, the CASB offers network functionalities for cloud reference architecture. When a software product line architecture expands to incorporate systems outside the product, it is called an “ecosystem”. This ecosystem is defined by the Cloud Security Reference Architecture (SRA).

Table 15 Bartlett’s test and KMO
Full size table

To determine the suitability of the models, Analysis of variance (ANOVA) and the statistical analysis including coefficient of determination, F value, and p value for each Vendors' outcome have been done and are listed in Table 15. Agreeing to ANOVA examination, for the more prominent values of F and P-value less than 0.05, it can be concluded that the models are factually critical. The tall values of the relationship coefficients moreover speak to the accuracy of the models to anticipate the reactions. The graphs of the 3D space model are as shown in Fig. 14. The graphs show the independence of variables and the outcome of the model space. The independent variable chosen from the PCA analysis was quite a significant influencing factor on the model and its outcomes. Within the same vein, the need fora fit test was not measurably noteworthy (p > 0.05) which demonstrated the tall wellness of the models. Concurring to the ANOVA test, a quadratic polynomial demonstration is measurably noteworthy to speak to the genuine relationship between reactions and the factors. Show F values of 13.32 with a little p value (< 0.0001) for all three reactions demonstrated the exactness of the show. A tall coefficient of assurance (R2 = 0.90) demonstratedthe capacity of anticipating the relationship between dependent and free variables. This design pattern explains how to protect a key component of a cloud ecosystem by allowing users to decide which cloud services they have access to. It will be validated as a pattern when designers implement it into their systems. The reaction surface plots were created for diverse intuition of any two independent factors, whereas keeping the esteem of the other variable consistent. The contour graph of the predicted model is as shown in Fig. 13, employing the range of space and independent variable locations.

8 Issues, problems, and future trends

The important CASB research concerns that have not yet been fully and properly studied as future research directions are described in this section. No support for multiple cloud service architectures (i.e., public, private, community, and hybrid cloud)and no ideal support for QoS features are common challenges for all CASBs. The CASB issues must be identified to assist future CASB designers in making them effective. In addition, some specific CASB in CC challenges are included below.

  • To achieve zero execution time

  • Reduced VM and data center costs, as well as data transfer processing time.

  • Introduced multi-user-multi-key scenario typical at the cloud-scale for AWS.

  • The CASB assists in the understanding of the person's intended outcomes and assists in the organization of resources and assistance needed to attain these outcomes.

9 Crıtıcal assessment and conclusion

This study assists in building an understanding of numerous results in the sprout field of CASB. Thus, we proceed with an SLR to guarantee an exact investigation of such answers. We focusedoncorrectlycharacterizing the ongoingstate-of-art in CASB and recognizing key accomplishments and challenges with different aspects of any enterprise. To perform the search, twenty main papers were considered for the SLR of CASB. The search was conducted using seven major publication databases. We examined 173 papers from which we have considered 36 outlining worthy significance to the study topic.Understanding the different independent parameters influencing the CASB is studied using PCA. It was agreed that five parameters were influencing PCA analysis. For more understanding of these independent variables' influence, on the CASB study, RSM analysis was employed. It was observed from the CCD model that the actual values showed significant influence with R2 = 0.90.

In this review paper, we have identified some studies which focus on the services of CASB [105]. In expansion to this, CC services [106], cloud service choice for CASB [106], and CASB columns [107] are the dynamic states which have gotten consideration by the CC society for modeling with RSM and PCA analysis. The CC Simulators have been created for modeling the “SAML”, “DRM”, “Cloud DLP”, “SIEM”, “IAM” and “IPSs” etc. We have distinguished 36 supportive simulators for modeling the security prerequisites [34, 80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103]. In [35], it was pointed out that SLR within the state of CASB is disregarded cloud computingstate by SLR. The applications, use cases, best practices, identifying and protecting sensitive cloud data/information of the continuous CASB have moreover been distinguished. Hence, in this article, a challenge has been made to fulfill this research gap. The major findings reveal that CASB has arisen as a cross-cloud model, driven by the heterogeneity and dimensionality of present cloud computing services, as well as the single-cloud paradigm's inability to meet the needs of clients. The proposed CASB will be responsible for a variety of functions, including “assisting clients with decision-making”, “application deployment”, “SLA negotiations”, and “resource monitoring”. Our extensive meta-analysis reveals that CASB is still in its infancy. Even though tremendous progress has been made in this subject, significant challenges remain, which are also noted in this survey. We have identifiedseveral prospective avenues in the field of CASB based on our analysis and reflection:

  • More work is needed in this area to aid CSCs in defining their applications' requirements, adapting them, and intelligent decision-making approach about cloud providers (i.e., AWS, Microsoft AZURE, and Google Cloud Compute) and services (SaaS, IaaS, and PaaS).

  • To create the CASBs system for the effective working of the Key Management System(KMS) is required [108].

  • Outlining the important areas in which further research on the application of load balancing techniques in the CASB process can be developed [109].

  • Examining future CC difficulties and the role that load balancing and CASB can play.

  • No CASBs system has been coordinating with KMS. It is a critical issue how to integrate CASB with KMS.

  • KMS has been broadly utilized in the cloud environment for safeguarding delicate data on the cloud [5]. More work is required to check the fittingness of the CASB system with KMS.

  • Employing the RSM analysis for the CASB system, it can be understood that, the different influencing variables can be analyzed separately. The independent variables havea future scope of deep research and understanding their interrelationship with each other and on the system.