Protecting SaaS with CloudEagle Co-Founder Prasanna Naik
During a time of increased cybercriminal activity, it is vital for businesses to ensure that their security measures are stringent enough to combat breaches.
Prasanna Naik believes that strategies are vital to protecting SaaS. During a time of increased digital threats and vulnerabilities, he speaks to Mobile Magazine about some of the key tactics for businesses to enact robust SaaS cybersecurity.
With his insight, Naik has seen unchecked growth of SaaS applications has resulted in so-called “SaaS sprawl” and inevitably caused security vulnerabilities. He highlights how 81% of organisations have had sensitive data exposed, with 43% facing security incidents directly related to SaaS misconfigurations.
“Authorise, Authenticate, and Control Access”
According to CloudEagle, companies with an employee size of 1000 to 2500 now use an average of 300 to 400 SaaS applications, which highlights how much this technology has been adopted.
Unauthorised access is a crucial security concern in the SaaS ecosystem. According to Prassana Naik, it has been reported that 36% of employees still have access to a company’s systems even after leaving their job, which ultimately leads to security breaches and data theft.
Naik says: “Proper access control is essential to SaaS security and data security. Organisations must know who has access to their systems and data. To secure this access, consider implementing Single Sign-On (SSO) and Two-Factor Authentication (2FA).
“SSO streamlines the authentication process, allowing users to access multiple applications with a single login. At the same time, 2FA provides an additional layer of security by requiring users to provide a secondary form of verification, like a one-time password or biometric authentication.
“Moreover, access control goes beyond authentication,” he says. “When employees leave an organisation, IT teams must promptly deprovision the user from all applications and revoke their access to prevent unauthorised entry and potential data breaches.
“Educate users and prevent them from sharing their passwords through unsecured channels, as this can expose sensitive data. Use an automated platform to have complete visibility and control over user access and permission levels and streamline user provisioning and deprovisioning.”
Shadow IT threats and the necessity of compliance
Prasanna Naik also addresses growing concerns about shadow IT and how it can be prevented before it irreversibly damages business operations. He reveals that approximately 80% of employees surveyed by CloudEagle have admitted to using SaaS applications at work without permission.
“Procuring and using unsanctioned applications without proper oversight can cause security issues due to integration challenges and make sensitive data vulnerable to potential risks,” Naik says.
“To counter the shadow IT threat, you must educate your workforce about the potential dangers of unsanctioned apps. Establish rules and leverage comprehensive SaaS management software to oversee and monitor the use of third-party applications.
“Lengthy approval processes can discourage employees, leading to them purchasing the product independently and using it (shadow IT). You can use an app catalogue of sanctioned applications, educate users on the standard buying process, and implement an automated procurement system to expedite purchases and prevent shadow IT.”
On a similar vein, it is clear that those working within an organisation must comply with the company’s security regulations in order to protect essential data.
Naik says: “Even if a company maintains internal compliance, relying on non-compliant SaaS providers can expose your applications to non-compliance issues.
“IT and security teams must ensure that SaaS vendors meet specific third-party risk management standards to achieve full compliance. Failing to do so can result in data breaches, substantial penalties, and loss of revenue.
He advises to “avoid entering into contracts with vendors who lack essential SaaS compliance certifications such as GDPR and SOC 2” as “such oversight could potentially result in losing valuable customers and other sensitive data. Also, have a central place to store all these compliance documents and perform yearly audits to keep them secure and compliant.”
Configuring the cloud and data protection
Misconfigurations are a significant security concern in the SaaS environment as, according to Naik, whilst cloud systems are designed to enhance each application's security with multiple layers of complexity, they also bring the risk of misconfigurations.
“Minor vulnerabilities are, at times, overlooked by security teams, who assume they won't lead to any significant consequences,” says Naik. “This negligence is often due to a limited understanding of the complexities of SaaS and its distinct security needs.”
“Businesses should educate the team on SaaS-cloud configurations and proactively implement SaaS Security Posture Management (SSPM) to address misconfiguration concerns. SSPM provides comprehensive control and visibility over the SaaS application stack, identifying and mitigating potential security gaps.
He continues: “Storing sensitive data in the cloud can be a security concern as organisations entrust third-party providers with data management and protection, thereby exposing themselves to the risk of illegal access, data breaches, and various security threats.
“To mitigate these risks, businesses should evaluate SaaS storage providers' compliance and regulatory standards. Do not trust vendors that lack SOC 2 certificates and implement robust data encryption to keep the data secure.”
Similarly, Naik also cites data encryption as essential for business cybersecurity. He says: “Encryption makes data unreadable without the right key, adding extra security even if there's a breach. Ensure data is encrypted during transfer. SaaS apps often use Transport Layer Security (TLS) for transit data; some also offer extra encryption for data at rest.”
Concerning remote and hybrid working patterns, he says: “In remote workplaces, users might connect their devices to unprotected public networks, putting your entire ecosystem at risk. In such situations, utilising a compliant cloud storage provider and encrypted data can play a pivotal role in safeguarding sensitive information.
“In the dynamic digital landscape, safeguarding SaaS data is a foremost priority. The 5-step playbook equips organisations with quick strategies to address security challenges. By securing data and access, tackling shadow IT, ensuring compliance, configuring the cloud, and encrypting data, organisations can confidently embrace a digitally resilient future.”
******
For more insights into the world of Mobile - check out the latest edition of Mobile Magazine and be sure to follow us on LinkedIn & Twitter.
Other magazines that may be of interest - Data Centre Magazine.
Please also check out our upcoming event - Net Zero LIVE on 6 and 7 March 2024.
******
BizClik is a global provider of B2B digital media platforms that cover Executive Communities for CEOs, CFOs, CMOs, Sustainability leaders, Procurement & Supply Chain leaders, Technology & AI leaders, Cyber leaders, FinTech & InsurTech leaders as well as covering industries such as Manufacturing, Mining, Energy, EV, Construction, Healthcare and Food.
BizClik – based in London, Dubai, and New York – offers services such as content creation, advertising & sponsorship solutions, webinars & events.
