In enterprise, it’s not unusual to take a software-as-a-service (SaaS)-first strategy. It is smart—there’s no must cope with the infrastructure, administration, patching, and hardening. You simply activate the SaaS app and let it do its factor.
However there are some downsides to that strategy.
The Drawback with SaaS
Whereas SaaS has many advantages, it additionally introduces a number of recent challenges, lots of which don’t get the protection they warrant. On the high of the listing of challenges is safety. So, whereas there are some very actual advantages of SaaS, it’s additionally essential to acknowledge the safety threat that comes with it. Once we speak about SaaS safety, we’re not normally speaking in regards to the safety of the underlying platform, however fairly how we use it.
Bear in mind, it’s not you, it’s me!
The Shared Duty Mannequin
Within the phrases and situations of most SaaS platforms is the “shared duty mannequin.” What it normally says is that the SaaS vendor is answerable for offering a platform that’s strong, resilient, and dependable—however they don’t take duty for the way you utilize and configure it. And it’s in these configuration adjustments that the safety problem lives.
SaaS platforms usually include a number of configuration choices, reminiscent of methods to share information, methods to ask exterior customers, how customers can entry the platform, what components of the platform they’ll use, and so forth. And each configuration change, each nerd knob turned, is the potential to take the platform away from its optimum safety configuration or introduce an sudden functionality. Whereas some purposes, like Microsoft 365, provide steerage on safety settings, this isn’t true for all of them. Even when they do, how simple is that to handle if you get to 10, 20, and even 100 SaaS apps?
Too Many Apps
Are you aware what number of SaaS apps you might have? It’s not the SaaS apps you recognize about which can be the difficulty, it’s those you don’t. As a result of SaaS is so accessible, it could actually simply evade administration. There are apps that folks use however a corporation is probably not conscious of—just like the app the gross sales workforce signed up for, that factor that advertising makes use of, and naturally, everybody needs a GenAI app to play with. However these aren’t the one ones; there are additionally the apps which can be a part of the SaaS platforms you join. Sure, even those you recognize about can comprise further apps you don’t learn about. That is how a mean enterprise will get to greater than 100 SaaS purposes. How do you handle every of these? How do you guarantee you recognize they exist and they’re configured in a approach that meets good safety practices and protects your info? Therein lies the problem.
Introducing SSPM
SSPM could be the reply. It’s designed to initially combine together with your managed SaaS purposes to supply visibility into how they’re configured, the place configurations current dangers, and the right way to deal with them. It can frequently monitor them for brand spanking new threats and configuration adjustments that introduce threat. It can additionally uncover unmanaged SaaS purposes which can be in use, consider their posture and current threat profiles of each the applying and the SaaS vendor itself. It centralizes the administration and safety of a SaaS infrastructure and the place its administration and configuration current threat.
Overlap with CASB and DLP
There’s some overlap available in the market, significantly with cloud entry safety dealer (CASB) and information loss prevention (DLP) instruments. However these instruments are a bit like capturing the thief as he runs down the driveway, fairly than ensuring the doorways and home windows have been secured within the first place.
SSPM is yet one more safety software to handle and pay for. However is it a software we want? Nicely, that’s as much as you; nonetheless, our use of SaaS, for all the advantages it brings, has introduced a brand new complexity and a brand new set of dangers. We’ve so many extra apps than now we have ever had, lots of them we don’t handle centrally, they usually have many configuration knobs to show. With out oversight of all of them, we do run safety dangers.
Subsequent Steps
SaaS safety posture administration (SSPM) is one other entry into the rising catalog of safety posture administration instruments. They’re usually simple to check out, and lots of provide free assessments that can provide you an thought of the size of the problem you face. SaaS safety is hard and infrequently doesn’t get the protection it deserves, so getting an thought of the place you stand may very well be useful.
Earlier than you end up on the fallacious finish of a safety incident and your SaaS vendor tells you it’s you, not me, it might be price seeing what an SSPM software can do for you. To be taught extra, check out GigaOm’s SSPM Key Standards and Radar experiences. These experiences present a complete overview of the market, define the factors you’ll wish to think about in a purchase order choice, and consider how quite a few distributors carry out in opposition to these choice standards.
In the event you’re not but a GigaOm subscriber, join right here.