How secure are your SaaS applications?

Written by Ian Sharpe, Product Leader at AppOmni

The dynamic nature of protecting the enterprise technology stack has always been a challenge for security teams. The complexities of this year, however, have forced teams to consider a new set of paradigms and additional risks given the abrupt shift to remote work. Now that managing a distributed team is commonplace for most companies, there’s even more need for flexibility and reliance on cloud-driven technologies. Software-as-a-Service (SaaS) platforms like Microsoft365, Salesforce, and Zoom — which were designed with these principles in mind — have all benefited greatly from this new work climate.

Market share across the public cloud is broken down into three categories: Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and, of course, SaaS. IaaS accounts for 21%, PaaS for 16%, and SaaS for a commanding 63% of the market. Given the consistent rise of COVID-19-driven remote work, it’s likely that enterprises will continue to adopt more SaaS platforms as this shift continues.

Why to prioritize SaaS security for the enterprise

Awareness and remediation of the security risks across IaaS and PaaS is not a new concept. Security teams and the IT and infrastructure teams that support these environments often work closely and have a history of interconnected programs and business processes. Additionally, there is a vast array of tooling and technologies to support security assessment and management of IaaS and PaaS.

SaaS applications operate a bit differently. They’ve been built to empower a wide range of teams across the enterprise. Examples include a system of record for your sales team’s customer data, your development team’s source code, and your people team’s human resource information systems. These SaaS applications are used daily and by many end users with varying degrees of technical familiarity. Due to the volume and complexity, these applications are predominately foreign to security teams and would require time and energy to intimately understand.

There is also the potential that the security team has had only brief engagements, if any, with the business units that purchase, manage, and support these SaaS applications. At best, the security team may have conducted an initial third party security assessment but the engagement with a SaaS application typically stops there. Due to these limited interactions, it makes it challenging for them to determine the breadth of use or the types of risks and threats posed to the enterprise from these applications once they are fully operational.

On the other hand, the internal teams that support these applications focus on delivering business requirements and functionality and may not be fully armed with the right guidance to properly secure these applications. Finding a balanced approach to fulfilling the needs of the business and properly securing SaaS applications requires a continuous joint effort. To date, this hasn’t occurred with consistency. It’s time to focus energy and resources on this risk vector. SaaS is critical infrastructure, afterall, and should be treated with the same priority as IaaS, PaaS, bare metal, and endpoints.

Wrangling the SaaS security outback

Gartner and the analyst community have taken note of this dilemma. They have warned that misconfigurations in SaaS applications caused by customer mistakes or lack of process oversight has been the leading cause of major cloud security incidents. Security researcher Aaron Costello suggested similar findings when he outlined the reconnaissance and exploitation steps an attacker may use to find and steal data through common SaaS misconfigurations. It’s a great, and necessary, read for anyone who works in security.

Understanding how your business-critical SaaS applications are being used across your company, including who uses them and why, are good first steps in establishing a baseline. How those SaaS applications are managed and administered are important factors as you garner additional awareness of the potential risk landscapes that have been introduced.

Finding a trusted partner to help you secure third-party SaaS applications

We have an entire team of security practitioners who have spent their careers protecting SaaS organizations, and we’ve spent the last two years building a product that addresses these risks. Sign up for a free risk assessment via our website.

---

About the Author

Ian Sharpe is a product leader at AppOmni who enjoys the ever-changing challenges of being a security practitioner. He believes in the power of democratizing security and advocates for industry and product collaboration.