5 SaaS Misconfigurations Leading to Major Fu*%@ Ups

Written by Ella Siman, Wing Security.

Originally published by The Hacker News.

With so many SaaS applications, a range of configuration options, API capabilities, endless integrations, and app-to-app connections, the SaaS risk possibilities are endless. Critical organizational assets and data are at risk from malicious actors, data breaches, and insider threats, which pose many challenges for security teams.

Misconfigurations are silent killers, leading to major vulnerabilities.

So, how can CISOs reduce the noise? What misconfiguration should security teams focus on first? Here are five major SaaS configuration mistakes that can lead to security breaches.

#1 Misconfiguration: HelpDesk Admins Have Excessive Privileges

• Risk: Help desk teams have access to sensitive account management functions making them prime targets for attackers. Attackers can exploit this by convincing help desk personnel to reset MFA for privileged users, gaining unauthorized access to critical systems.
• Impact: Compromised help desk accounts can lead to unauthorized changes to admin-level features enabling the attackers to gain access to critical data and business systems.
• Action: Restrict help desk privileges to basic user management tasks and limit changes to admin-level settings.

Use Case: The MGM Resort Cyberattack -> In September 2023, MGM Resorts International became the target of a sophisticated cyberattack. The attackers, allegedly part of a cybercriminal gang known as Scattered Spider (also referred to as Roasted 0ktapus or UNC3944), used social engineering tactics to penetrate MGM's defenses.

#2 Misconfiguration: MFA Not Enabled for All Super Admins

• Risk: Super admin accounts without MFA are high-value targets for attackers due to their elevated access privileges. If MFA is not enforced, attackers can easily exploit weak or stolen credentials to compromise these critical accounts.
• Impact: A successful breach of a super admin account can lead to the attacker getting full control over the entire organization's SaaS environment, resulting in potential data breaches and business and reputational damage.
• Action: Enforce MFA for all active super admins to add an extra layer of security, and safeguard these high-privilege accounts.

#3 Misconfiguration: Legacy Authentication Not Blocked by Conditional Access

• Risk: Legacy protocols like POP, IMAP, and SMTP are still commonly used in Microsoft 365 environments, yet they don't support MFA. These outdated protocols create significant vulnerabilities and without Conditional Access enforcement, attackers can bypass security measures and infiltrate sensitive systems.
• Impact: These outdated protocols make accounts more vulnerable to credential-based attacks, such as brute-force or phishing attacks, making it easier for attackers to gain access.
• Action: Enable Conditional Access to block legacy authentication and enforce modern, more secure authentication methods.

#4 Misconfiguration: Super Admin Count Not Within Recommended Limits

• Risk: Super admins manage critical system settings and mainly have unrestricted access to various workspaces. Too many or too few super admins increase the risk by overexposing sensitive controls or the operational risk of losing access and being locked out of critical business systems.
• Impact: Unrestricted access to critical system settings can lead to catastrophic changes or loss of control over security configurations resulting in security breaches.
• Action: Maintain a balance of 2-4 super admins (excluding "break-glass" accounts), for both security and continuity, as per CISA's SCuBA recommendations.

#5 Misconfiguration: Google Groups (Join / View / Post) View Settings

• Risk: Misconfigured Google Group settings can expose sensitive data shared via Google Workspace to unauthorized users. This exposure increases insider risks, where a legitimate user could intentionally or unintentionally leak or misuse the data.
• Impact: Confidential information, such as legal documents, could be accessed by anyone in the organization or external parties, increasing the risk of insider misuse or data leaks.
• Action: ensure that only authorized users can view and access group content to prevent accidental exposure and mitigate insider risk.

Proactively identifying and fixing SaaS misconfigurations saves organizations from catastrophic events impacting business continuity and reputation, but it's not a one-time project. Identifying and fixing these SaaS misconfigurations needs to be continuous because of the constantly changing nature of SaaS applications.