In enterprise, it’s not unusual to take a software-as-a-service (SaaS)-first method. It is smart—there’s no must take care of the infrastructure, administration, patching, and hardening. You simply activate the SaaS app and let it do its factor.
However there are some downsides to that method.
The Drawback with SaaS
Whereas SaaS has many advantages, it additionally introduces a number of latest challenges, a lot of which don’t get the protection they warrant. On the prime of the checklist of challenges is safety. So, whereas there are some very actual advantages of SaaS, it’s additionally vital to acknowledge the safety danger that comes with it. Once we speak about SaaS safety, we’re not often speaking in regards to the safety of the underlying platform, however quite how we use it.
Keep in mind, it’s not you, it’s me!
The Shared Duty Mannequin
Within the phrases and situations of most SaaS platforms is the “shared duty mannequin.” What it often says is that the SaaS vendor is answerable for offering a platform that’s strong, resilient, and dependable—however they don’t take duty for a way you employ and configure it. And it’s in these configuration modifications that the safety problem lives.
SaaS platforms typically include a number of configuration choices, akin to methods to share knowledge, methods to ask exterior customers, how customers can entry the platform, what components of the platform they will use, and so forth. And each configuration change, each nerd knob turned, is the potential to take the platform away from its optimum safety configuration or introduce an surprising functionality. Whereas some purposes, like Microsoft 365, provide steerage on safety settings, this isn’t true for all of them. Even when they do, how straightforward is that to handle whenever you get to 10, 20, and even 100 SaaS apps?
Too Many Apps
Are you aware what number of SaaS apps you could have? It’s not the SaaS apps about which are the problem, it’s those you don’t. As a result of SaaS is so accessible, it might probably simply evade administration. There are apps that folks use however a corporation will not be conscious of—just like the app the gross sales staff signed up for, that factor that advertising makes use of, and naturally, everybody needs a GenAI app to play with. However these aren’t the one ones; there are additionally the apps which are a part of the SaaS platforms you join. Sure, even those about can comprise further apps you don’t find out about. That is how a median enterprise will get to greater than 100 SaaS purposes. How do you handle every of these? How do you guarantee they exist and they’re configured in a manner that meets good safety practices and protects your data? Therein lies the problem.
Introducing SSPM
SSPM may be the reply. It’s designed to initially combine together with your managed SaaS purposes to supply visibility into how they’re configured, the place configurations current dangers, and tackle them. It would regularly monitor them for brand new threats and configuration modifications that introduce danger. It would additionally uncover unmanaged SaaS purposes which are in use, consider their posture and current danger profiles of each the appliance and the SaaS vendor itself. It centralizes the administration and safety of a SaaS infrastructure and the place its administration and configuration current danger.
Overlap with CASB and DLP
There may be some overlap out there, significantly with cloud entry safety dealer (CASB) and knowledge loss prevention (DLP) instruments. However these instruments are a bit like capturing the thief as he runs down the driveway, quite than ensuring the doorways and home windows have been secured within the first place.
SSPM is yet one more safety instrument to handle and pay for. However is it a instrument we want? Nicely, that’s as much as you; nevertheless, our use of SaaS, for all the advantages it brings, has introduced a brand new complexity and a brand new set of dangers. We have now so many extra apps than we have now ever had, a lot of them we don’t handle centrally, and so they have many configuration knobs to show. With out oversight of all of them, we do run safety dangers.
Subsequent Steps
SaaS safety posture administration (SSPM) is one other entry into the rising catalog of safety posture administration instruments. They’re typically straightforward to check out, and plenty of provide free assessments that may give you an concept of the dimensions of the problem you face. SaaS safety is difficult and sometimes doesn’t get the protection it deserves, so getting an concept of the place you stand may very well be useful.
Earlier than you end up on the mistaken finish of a safety incident and your SaaS vendor tells you it’s you, not me, it could be value seeing what an SSPM instrument can do for you. To study extra, check out GigaOm’s SSPM Key Standards and Radar experiences. These experiences present a complete overview of the market, define the factors you’ll wish to think about in a purchase order resolution, and consider how a lot of distributors carry out towards these resolution standards.
In case you’re not but a GigaOm subscriber, enroll right here.