Your SaaS Security Solution Checklist
With the growing use of SaaS apps in businesses and the increasing complexity of SaaS security, organizations are finding themselves searching for a robust SaaS security tool that can provide security teams visibility over the entire SaaS ecosystem.
However, the market for SaaS security tools is evolving, and not all are created equally. Some focus on securing misconfigurations, while others are excellent at detecting connected shadow apps but not much else. Still others are excellent at managing users, but don’t review configurations to ensure the applications are secure.
This checklist will help you get started while looking for a solution. If you have a large SaaS stack, you are going to want a robust solution that fully secures your applications. For more information, download our full Checklist.
Getting Started With SaaS Security
The only true way to secure your SaaS applications is with a SaaS Security Posture Management (SSPM) platform. CASBs and manual audits are often used by organizations, but neither one provides a comparable level of coverage when compared to an SSPM.
When looking for an SSPM, you should look for one with the following features and functionality:
Application Coverage
Integrates with the application you use or has an integration tool to integrate any application
User Behavior
Monitors user activities and identifies behavioral anomalies
Compliance
Compares configurations to standards and alerts users when configurations are not aligned
Permissions Inventory
Provides visibility into user permissions even in complex applications like Salesforce and Workday
Your SSPM should also provide visibility into SaaS security’s core ues cases:
Misconfiguration Management
Device-to-SaaS User Risk Management
Identity Security Posture Management
3rd Party and Shadow App Discovery and Control
Identity and Threat Detection & Response
Misconfiguration Management
Misconfigurations can happen at any time on any application. Your SaaS Security tool should be able to automatically detect these misconfigurations, prioritize them effectively, and initiate an appropriate incident response.
Checks every security setting
Identifies settings that fail company policy
Shows priority level for each security check
Offers explanation as to why security check failed
Provides remediation to correct each setting
Associates each security check to an industry standard or best practice, such as SOC2
Allows users to leave notes relating to specific checks
3rd Party and Shadow App Discovery and Control
Effective SaaS Security requires visibility into the applications that are connected to hub apps and the permissions that have been granted. For a large organization, there can be thousands of these types of apps.
Your SaaS security tool should include the following capabilities:
Identify connected apps
Recognize high-risk scopes
Track impacted users of a third-party app
Send alerts when high-risk apps or apps that use scopes out of company policy are integrated into SaaS stack
Device-to-SaaS User Risk Management
Security teams require insight into the devices accessing the applications and their users. This allows them to better understand the risk coming from devices, and take necessary steps to ensure the applications are secure.
The following features limit the exposure from user devices:
Associate devices with users
Show which devices are managed
Display device posture score
Show device checks
Identify and describe vulnerabilities, as well as recommend remediation actions for the device
Identity Security Posture Management (ISPM)
Security teams need an SSPM that can monitor all human and non-human application accounts. This allows the team to understand the risk level coming from user accounts, and positions them to remove or modify access as needed.
Your SaaS security tool should enable identity & access governance with the following functionalities:
User discovery
User classification
Guest status
Privileged users
Full employee visibility
Your ISPM solution is critical in monitoring SaaS logins and ensuring that user activity meets security guidelines.
SSO
Analyze single sign-on state in all accessed platforms
MFA
Track multi-factor authentication in all accessed platforms, including for each user
Password management
Assess password complexity and expiration settings
Authentication Protocols
Identify open legacy authentication protocols, such as POP3, SMTP, MAPI, and the users capable of leveraging these protocols. Monitor and gain context to the measurements for actual usage of such protocols.
Video conferencing
In conferencing systems like Zoom and Cisco Webex, identify the state of guest participants’ access control and identification
Identity Threat Detection & Response
Your SSPM should include ITDR capabilities based on data from the entire SaaS stack. By extending the data collected across the SaaS stack, the ITDR tools have a far richer understanding of standard user behavior, and can better protect against threat actors.
Your SaaS Security ITDR should include the following capabilities:
Threat prioritization
Defines the severity of the threat so the incident response team can take appropriate action
Threat description
Describes the nature of the threat so the incident response team understands the issue
Threat target
Identifies the app or apps that are under attack so the incident response team can secure the application
Source
Includes the source of the alert to aid in investigation
Remediation guidance
Provides step-by-step directions to guide the investigation and eliminate the threat
Data Management
Security teams need visibility into the shared settings of documents that are publicly available or externally shared. This visibility enables them to close gaps in document security and prevent data leaks from occurring.
Your SaaS security solution should include these capabilities in the area of data leakage protection:
Access level
Displays whether item is externally or publicly shared
Owner
Shows item’s owner
Last modified
Adds context as to whether the resource should continue to be shared
Password protected
Shows whether publicly facing resources have a level of security
Shared with
Includes a list of users who have been granted access to the document
Conclusion
Choosing the right SaaS security solution is crucial in preventing the next attack, which is where an in-depth and contextualized SaaS security solution checklist comes in. Your solution should be easy to deploy and allow your security team to easily add and monitor new SaaS applications. Top security solutions should integrate easily with your applications and your existing cybersecurity infrastructure, to create a comprehensive defense against cyber threats.
