Data Leaks in SaaS Security

Data leaks refer to unauthorized exposure of sensitive information. When viewed through a SaaS setting, these are data exposures emanating from a SaaS application. Data leaks can result in the compromise of personal, financial, or business-critical information. While some define data leaks as unintentional, the term is used interchangeably with data breaches.

Any application that handles sensitive data is susceptible to data leaks. For example:

Data leaks from SaaS applications are unintentional and occur without threat actor involvement. They typically come from one of three places – misconfigured settings, weak access controls, and user error. 

When applications are poorly configured, they can lead to unintended exposures. For example, when sharing a document or file, most SaaS applications have two options: 

• Share with a specific user
• Share with anyone with the link

Share with a specific user requires users to authenticate themselves in some way while allowing anyone with a link make the file available to anyone. If that link is exposed, the data is accessible. 

Weak access controls also lead to data leaks. Most applications also have access control configurations that allow dashboards, repositories, and workspaces to be shared publicly. These configurations can lead to massive data leaks. 

User error is another primary cause of data leaks. App admins who don’t understand the implications of the different configurations make mistakes and inadvertently share files and databases with the public.

Preventing data leaks in SaaS applications requires implementing several key measures. Regular security audits through a SaaS Security Posture Management (SSPM) tool are essential for continuously monitoring and assessing security configurations to identify and address vulnerabilities. These tools provide real-time insights and automated checks, ensuring that security policies are up-to-date and effective.

Identity Threat Detection and Response (ITDR) systems are crucial for identifying and mitigating threats related to user identities, such as detecting unusual login patterns and responding to potential breaches swiftly, as well as user behavior.

Multi-factor authentication combined with strong password policies should be enforced, guiding employees to create complex, unique passwords and implement mechanisms such as multi-factor authentication. These combined efforts create a robust security framework that significantly reduces the risk of data leaks in SaaS environments.

Employee training is another critical component, focusing on areas such as recognizing phishing attempts, adhering to security protocols, and understanding the importance of data protection. Educating employees about the latest security threats and best practices ensures a security-conscious culture within the organization. 

While some define data leaks as unintentional data loss and data breaches as unauthorized access, these terms are often used interchangeably. Reports often use each term to describe any data exposure.

One of the concerns organizations have with using GenAI with their SaaS application is that it will use and share unauthorized data in reports, proposals, and other collateral materials. It is of paramount importance to prevent GenAI tools, like Salesforce Copilot, from accessing confidential data.

In May, threat actors announced that they had stolen over half-a-billion customer records from Snowflake. Records include names, email addresses, physical addresses, and partial credit card number. 

Last year, a misconfiguration in Salesforce Communities led financial services companies and healthcare providers to leak data. Guests on various sites were able to view records that contained social security numbers and financial information.

There are several ways to prevent data leaks. Using an SSPM, organizations can find and remediate misconfigurations that expose data to the public.

It is worth noting that remediation will not always secure data that has already been publicly exposed. For example, if a setting allows all workspaces to be made publicly available, changing that setting will prevent future workspaces from being available, but may not change the settings of existing workspaces. Those may require manual interventions.

Leading SSPMs also include data inventories, which list all documents and files that have been shared. Using this data and a SIEM, organizations can review the files and automatically change the permissions on the individual files.