5 Timely SaaS Security Recommendations for 2023

Written by Jesse Butts, Head of Content & Communications, AppOmni.

While our colleagues were winding down for the holidays, cybersecurity professionals spent the tail-end of 2022, and first week of 2023, responding to major SaaS breaches.

Late December ushered in disclosures of Okta, LastPass, and Slack source code theft. Within days of ringing in the new year, a CircleCI security incident sent its customers on a spree of rotating "secrets" (passwords or private keys), replacing project API tokens, and auditing internal logs for recent unauthorized access.

These events serve as timely — yet timeless — reminders to start 2023 by mitigating SaaS security risks that may not be so obvious. In particular, we recommend you:

1. Assess third-party application and plug-in connectivity across SaaS and cloud applications. These connections effectively operate as cloud-to-cloud and tertiary cloud connections that can expose organizations to compromise. And stale or dormant connections, which are quite common, can provide covert means for attackers to move laterally.
2. Secure your source code repositories. 2022 was anything but short on source code breaches, and threat actors will continue to pursue this angle of attack. Ensure you have proper access restrictions in place for code repos, and place them under continuous monitoring for permissions modifications and cloning.
3. Implement strong multi-factor authentication (MFA). Most organizations use these techniques sporadically and inconsistently, often opting for weak MFA methods such as text messaging. This approach equates to a firewall with openings like Swiss cheese. Attackers employ multiple methods to bypass inconsistently implemented security controls, and it’s difficult for companies to understand where they are actually exposed with spotty MFA enforcement.
4. Begin enacting security enhancements across the board. Zero trust implementations have grown in popularity as the frequency of breaches increases. As a result, we see — and endorse — placing more focus on privileged access management, MFA hardware tokens (such as a Titan Security Key or YubiKey), and access certification/revocation.
5. Establish a tighter security integration with CI/CD. Automation has been a key security focus for quite some time. The Security team can help the business by automating security tooling as a shared service for developers. This will increase release velocity by an X factor and free up security resources, creating a greater ROI in an uncertain economy.

We have no doubt that the sophistication of threat actors’ methods will evolve throughout 2023 and beyond. They’ll continually find new ways to prey upon any vulnerabilities in your SaaS security settings. Take the time now to prioritize programs for third-party app connectivity, data access permissions, and CI/CD integration across your entire SaaS ecosystem to reduce your risk.

About the Author

Jesse Butts heads up content and communications for AppOmni, the leader in SaaS security. With 15+ years of experience, he’s managed content programs in SaaS, FinTech, and healthcare. When he’s not thinking and writing about cybersecurity trends and SaaS data protection, you’ll find Jesse enjoying all Chicago has to offer and wondering what next repair awaits his 1920s bungalow.