SaaS solutions: Convenient to use but with the right security tools

It's no surprise that enterprises like SaaS solutions; the average enterprise uses anywhere from a few dozen to over a hundred different SaaS solutions.

Enterprises have come to prefer SaaS solutions since they can offer best-of-breed niche solutions without the overhead of managing technology and being readily available to use.

While SaaS solutions offer a lot of convenience, enterprises also end up providing a lot of sensitive data to the SaaS solutions. After more than a couple decades of using SaaS solutions, companies are running into certain challenges with SaaS, particularly from a security perspective. Examples of those challenges include:

1. A false sense of security from Third-Party Risk Management (TPRM) programs since those are focused at the initial SaaS vendor relationships rather than ongoing assurance or technical security configurations
2. No golden SaaS configuration leading to insecure configurations being determined on-the-fly
3. API connections with authentication tokens vulnerable to theft and reuse leading to SaaS becoming a backdoor for enterprise systems
4. Integration of security logs at the SaaS provider with enterprise Security Information and Event Management (SIEM) tool.
5. A pattern of attacks across SaaS solution users - Threat actors exploit certain known gaps in configuration to go after a) all potential users of popular SaaS solutions such as Salesforce and Snowflake across enterprises, and b) security weakness in one SaaS utilized to compromise another SaaS solution at the same enterprise.

It's important that companies invest in building an enterprise SaaS security framework. This framework should help identify the enterprise stakeholders involved from SaaS evaluation to offboarding. It should also help facilitate consistent measurement of standardized security controls and further demonstrate regulatory compliance. Enterprises have been using Cloud Access Security Broker (CASB) solutions that secure the connections and enforce policies, but such solutions do not provide continuous posture monitoring, drift monitoring and Shadow SaaS detection. To make the process automated and efficient, enter the world of SaaS Security Posture Management (SSPM) tools. SSPM is currently one of the most practical tools available for enterprises to operate controls around SaaS — particularly around identities, configuration management, and third-party integration visibility. Some of the potential benefits of leveraging SSPM tools include:

1. Discovers shadow SaaS solutions in use by the enterprise by monitoring network traffic, identity providers, and application logs.
2. Enforces zero trust and least privileged access, which restricts risky and unauthorized users.
3. Automates configuration checks to provide continuous real-time monitoring of SaaS applications’ security settings and analyzes security gaps by comparing configurations against benchmarks.
4. Identifies privileged accounts without proper controls and revokes dormant access.
5. Integration risks — flags unapproved, new, or inactive integrations and assigns risk scores.

KPMG can help you build a SaaS security framework that is efficient and tailored to your risk profile. Further, we have alliances with several third-party SSPM solution providers and could also help implement, tune and operate such solutions under a managed services model.