Why It Is Critical To Secure SaaS

Software as a Service (SaaS) is used today by almost every organization to power almost every aspect of their business. Mission-critical SaaS applications like Microsoft 365, Google Workspace, Salesforce, Github, Slack and Atlassian have become deeply ingrained in all facets of business operations, elevating productivity and efficiency. The SaaS cost-effective subscription or pay-as-you-go models make it easy to scale business systems and services, enabling organizations to do whatever they need from any web browser, on any device, anywhere in the world, to fuel their productivity, efficiency, and growth. Of course, these applications’ primary focus is not on securing SaaS data or user access, which is the responsibility of the customer.

Recent SaaS Breaches Highlight the Risks

SaaS applications are essential for businesses, but recent high-profile breaches demonstrate a critical truth: SaaS applications have become a prime target, but many security programs lack critical capabilities to properly protect and secure SaaS. These incidents exposed source code and sensitive customer data, disrupted operations, and led to reputation damage and lawsuits, highlighting the potential impact of SaaS security misconfigurations and weak points.

Recent highly-publicized SaaS breaches include:

A case management system used by Okta Support was breached and then used to launch other attacks on SaaS providers BeyondTrust, Cloudflare and 1Password.

Stolen third-party OAuth tokens were used to access GitHub repositories and download private data.

The ‘Midnight Blizzard’ attack against Microsoft exposed misconfigurations in MFA, overprivileged OAuth applications, and the creation of new identities to access corporate email accounts, targeting senior leadership and legal teams.

Attackers used stolen signing keys to forge Azure AD tokens and gain access to emails of Microsoft 365 customers.

SaaS Security Challenges

What makes SaaS so great also makes it challenging to secure. Because an organization’s security is only as strong as its weakest link, it’s imperative that SaaS applications and SaaS environments don’t give attackers an easy opening they can exploit.

In SaaS, the security responsibility is shared between the SaaS provider who secures the underlying infrastructure and the customer who manages user access, data security within the application, and overall secure configuration. SaaS security encompasses all the people, products, and processes an organization uses to reduce SaaS risks and protect against attacks and misuse that threaten the critical data and operations of the business.

SaaS security challenges are numerous:

Limited Standardization
Unlike cloud infrastructure (IaaS) with established CIS benchmarks for the 3 biggest cloud providers and Kubernetes, SaaS platforms like Salesforce, Okta, NetSuite, GitHub, and Slack lack standardized security configurations or uniform best practices. Furthermore, general compliance frameworks (SOC 2, ISO 2701, HIPAA) don't focus directly on specific SaaS security best practices.

Unique & Complex Applications
SaaS tools vary greatly, requiring security teams to understand the individual terminology, configurations, permissions, and logs for effective monitoring of each SaaS application and collaboration with application owners.

Misconfigurations
Improper configuration of SaaS settings can expose sensitive data or grant unauthorized access. These can include misconfigured access permissions, lack of enforced multi-factor authentication (MFA) or single sign on (SSO), and more. As seen in a recent example, a simple Google Drive misconfiguration can expose sensitive data of millions of users.

Configuration Drift
This occurs when the configurations of your SaaS applications gradually diverge from their originally intended settings. While it's almost inevitable with regular updates and adjustments, unaddressed drift can create security vulnerabilities and expose your data.

Data Everywhere
SaaS applications-which host various types of highly sensitive data including customer personally identifiable information (PII), source code, financial data, legal documents, private messages, and proprietary information—are both accessible from various devices and locations, as well as intentionally allow for easy data sharing both internally and externally. It’s simple and fast to share with external collaborators or anyone with a link to a file on Google Drive and Sharepoint, for example, but users too often share too widely and without any time expiration.

Third-Party Integrations
Connecting SaaS applications with external tools—such as GenAI tools—introduces additional security considerations, requiring careful evaluation of potential vulnerabilities. All too often, limited visibility into third-party integrations creates a greatly expanded attack surface. When you add to that the fact that over half (51%) of an organization’s SaaS third-party integrations are inactive, the problem only increases over time.

Non-human Identities
Furthermore, organizations often struggle to manage the ever-increasing number of non-human identities like service accounts, OAuth tokens, and API keys required for these integrations. Since you cannot enforce traditional identity security best practices such as MFA on non-humans, these credentials, if compromised, can be exploited to access sensitive data and resources.

Shadow SaaS and Unmanaged Risk
Of course, it’s important to know what SaaS applications are connected to your enterprise accounts. Employees may subscribe to and use unauthorized SaaS applications to address work needs. These unsanctioned apps bypass IT oversight and security protocols, creating blind spots and introducing potential vulnerabilities into the organization's SaaS environment.

SaaS Security Best Practices

Here are some best practices to help secure SaaS applications.

Maintain Comprehensive Visibility

Keep an Updated Inventory
Have an automatically updated inventory of all SaaS applications used within your organization, including user identities, integrations, data shares, and security policies.‍
Track Data Shares
Understand where your data is accessed or shared. This data mapping helps identify potential vulnerabilities and inform secure data management practices.‍
Monitor User Activity
Actively monitor user activity within SaaS applications, focusing on privileged accounts and changes in access patterns.

Audit Your SaaS Integrations

Vet New Integrations
‍Review vendor security posture, configuration options, and monitoring capabilities as employees onboard new integrations.
Least Privilege & Onboarding Hygiene
‍Adhere to Principle of Least Privilege (PoLP) access policies and regularly remove unused integrations.
Continuous Communication
‍Collaborate with business users to understand integration needs and validate existing ones

Strengthen Identity and Access Management

Least Privilege & Admin Access Control
‍Grant users only the minimum permissions they need, and closely monitor high-privilege accounts.
Enforce Strong Authentication
‍Implement multi-factor authentication (MFA) and strong password policies for all SaaS accounts.
Streamline Identity Management
‍Leverage SAML, SSO, or IdP solutions for centralized access control.

Secure Your Data in Transit and at Rest:

Data Classification and Labeling
‍Classify data based on sensitivity and implement data labeling to guide secure sharing practices.
Monitor and Restrict External Data Sharing
Regularly review external shares and consider blocking them for users who don't have a clear need.
Secure Email Forwarding
Monitor and ideally restrict email forwarding, especially to personal accounts.

Maintain Secure Configurations and Compliance

Leverage Native Security Controls
‍Utilize built-in security features within SaaS applications as a starting point, with more extensive security monitoring as well.
Minimize Configuration Drift
Monitor for configuration changes and collaborate with owners to understand any drift.
Proactive Compliance Management
Identify relevant compliance requirements (NIST, ISo 27001, HIPAA., etc.) for your SaaS applications and adapt configurations as needed.

Enhance Threat Detection & Response

Monitor for Anomalies
Actively monitor SaaS application events, activity logs, and admin actions to identify suspicious behavior.
Support SOC Teams
Incorporate SaaS threat detection capabilities to improve SaaS incident response.
Learn from Breaches
Stay informed about recent SaaS breaches and incorporate those lessons into your security event monitoring processes.

The SaaS Security Solution Landscape

There are various technologies that focus on SaaS security to varying extent, and with different focus areas.

Today, organizations are using SaaS Security Posture Management (SSPM) to determine the full scope of SaaS risk in the environment. Advanced visibility starts with the known mission-critical SaaS applications and evaluates all misconfigurations, identity and data security issues, and all SaaS-to-SaaS integrations. Often, this is where many companies gain full awareness of the SaaS security issues that they face. Many SSPM solutions partially cover these discovery and reporting use cases. Security teams should evaluate the full width of SaaS coverage and how well the SSPM solution handles their important use cases.

SSPMs help security and IT teams regain control over their SaaS applications. It continually monitors and evaluates the risks associated with each SaaS application and supports their remediation to reduce the SaaS attack surface and protect the SaaS applications the company depends on. With SSPM, organizations can manage the security posture of their SaaS applications to help reduce risk and maintain compliance. They gain visibility into the wide network of SaaS applications and integrations that exist, allowing them to be monitored, managed and maintained to keep the organization’s SaaS data and workflows secure.

Traditional SaaS security solutions such as Cloud Access Security Brokers (CASB) largely focus on protecting User-to-SaaS access to different cloud services. CASBs have limitations when it comes to effectively securing SaaS environments. CASBs, for instance, were designed to discover SaaS applications in a corporate network based on a proxy architecture and to monitor user activities within these applications. However, over the years SaaS applications have become more complex and the modern SaaS mesh includes more SaaS applications and multiple layers of configurations, data, identities and third-party integrations which CASB solutions are blind to and do not monitor.

Traditional solutions also fail to provide sufficient business context of various applications, their integrations, and configurations that are needed to quickly understand, prioritize and remediate SaaS risks. Finally, traditional solutions can impose restrictive security controls that hinder business innovation and agility. When security teams strictly enforce blocking collaborative features or restrict the usage of popular SaaS applications, users may resort to unsanctioned workarounds that further undermine security.

Benefits of Utilizing SaaS Security Solutions

Enhanced Security Posture
Proactive identification and remediation of security weaknesses significantly reduce the attack surface.

Improved Compliance
Streamlined management of security posture ensures adherence to relevant regulations, such as ISO 27001, NIST, GDPR, and SOC 2.

Reduced Costs
Mitigating security risks helps prevent costly data breaches and potential fines.

Increased Operational Efficiency
Automating security tasks frees up IT resources for other critical activities.

Greater Visibility and Control
Centralized view of the SaaS security landscape empowers informed decision-making.

SaaS security vendors, like Valence Security, offer comprehensive solutions that go beyond simply identifying threats. They provide actionable insights and recommendations, enabling businesses to effectively address vulnerabilities and strengthen their overall security posture.

SaaS security solutions, like Valence Security's SaaS security platform, empower businesses to address these complexities and mitigate various security and compliance risks:

Misconfigurations: These solutions identify and rectify incorrect settings, ensuring adherence to security best practices and organizational policies.

Excessive User Permissions: SaaS security tools can monitor user access privileges, pinpointing unnecessary permissions and inactive accounts that pose security threats.

Data Breaches: By implementing robust data encryption and access controls, the risk of unauthorized data access and leaks is significantly reduced.

Third-Party SaaS Risks: Visibility into connected SaaS-to-SaaS integrations including GenAI tools, as well as non-human identities such OAuth tokens, API keys and service accounts is a valuable SaaS Security tool capability.

Compliance Violations: SaaS security tools help organizations adhere to data privacy regulations like GDPR and industry standards.

What is SaaS Security?