How Great CISOs Make SaaS Security a Priority for Business Leaders

Originally published by AppOmni.

Written by Harold Byun, Chief Product Officer, AppOmni.

CISOs and security leaders have wrestled with SaaS security program and policy adoption for decades. This perennial topic resurfaced in a recent podcast episode I participated in, where I shared how CISOs can better engage with their organizations’ SaaS app owners.

Check out the top five requirements for a robust SaaS security program from this practical conversation.

1. Learn What Your Business Peers Are Trying to Accomplish

Avoid kicking things off by drafting review procedures based on a type of SaaS app or risk profile. Start by understanding why a business leader is interested in a new SaaS platform.

Understand why your colleagues are seeking a new SaaS app or changes to existing work processes by asking these questions below.

Then, dive into threats and risks profiling questions. Focus on how to solve their problems, putting you in a better position to achieve business success.

2. Opt for Guard Rails Over Roadblocks

When your colleagues know what’s in bounds and out, they can solve many of their own problems without wondering (or fearing) if they’re maintaining security compliance.

Your policies should clearly illustrate what changes are acceptable without necessitating security or IT review. Some changes, like marketing operations adding new sales leads to the CRM, don’t require IT or security team review. But decisions like disabling MFA because sales finds it cumbersome requires a conversation with security.

Don’t deem a behavior outside the parameters as an automatic “no.” Aim for a yes, even if that yes looks different to what the business proposed. Marketing ops, in all likelihood, wants to disable MFA to speed up business, not to weaken the organization’s SaaS security posture. Tactfully reframe the request to focus on the core issue: “How can we make authentication easier for field sales?”

Guard rails enable your organization to grow their SaaS apps securely.

3. Translate Risks and Processes Into Language That Resonates

Understanding the SaaS security implications of your colleagues’ work and future plans is fundamental when building guard rails — and relationships. Overcoming language barriers between your team and theirs is crucial. Security has to speak in terms your business peers will appreciate.

Break down the SaaS security app risks into the context of their business goals and needs. Instead of saying:

“You’re potentially leaving X number of PII records publicly exposed, so this proposed solution of yours is unacceptable.”

Say…

“This approach gives hackers and our top competitors a very low bar of entry to steal our customers’ information, including their addresses and credit card numbers. Let’s see how else we can accomplish your goal without so much risk for our customer.”

When you proactively approach and speak the language of your centers of excellence, application groups, and SaaS app owners, it creates true partnership and better outcomes.

4. Devise Gaming Scenarios To Bring SaaS Security Concepts to Life

Make the risks you’ve presented more effective by using a gaming scenario. This method helps app owners and users contemplate how security incidents directly affect the business from their perspective.

One example, admittedly a bit extreme, comes from a security team in the airline industry. They asked their operations colleagues, “What happens if malware affects air traffic control and we have a planes-down situation globally? What are you doing in that situation? And what is the impact on your business?”

Gaming scenarios show the necessity of mitigating these risks without the CISO having to say a single world. As the business soon realizes the vast number of contingencies they’d need to execute should a SaaS breach occur, they’ll opt for preventive measures in a heartbeat.

5. Create a SaaS Security Leaderboard

When leaders can easily visualize how well (or poorly) they’re achieving SaaS security compliance compared to their peers, motivation kicks in.

Track overall SaaS risk ratings and consider using them for specific campaigns, like comparing team performance in anti-phishing exercises. Highlight standout teams and individuals by sharing to your intranet or relevant Slack channels. These tools make SaaS security adherence stick without forceful measures.

Conclusion

You might have noticed a recurring theme: Every recommendation takes a “carrot approach” instead of relying on the stick. Opt for the “carrot approach” in your organization for better SaaS security adoption and compliance.

---

About the Author

Harold Byun is Chief Product Officer at AppOmni. He has more than 25 years of experience in the security industry as both a practitioner and product leader. Prior to joining AppOmni, he held product leadership roles at ServiceNow, Skyhigh Networks, MobileIron, and Symantec. His career includes work in a number of security domains across security orchestration and automated response (SOAR), cloud access security broker (CASB), governance risk and compliance (GRC), data loss prevention (DLP), encryption and data access monitoring. Harold also holds several data security related patents.