SSPM: System Hardening for SaaS

SaaS Security Posture Management (SSPM) is a set of security tools that an organization’s security team can use to gain visibility and manage security for their Software as a Service (SaaS) applications.

SaaS is an increasingly popular model for consuming software. SaaS providers manage security via a shared responsibility model, in which customers protect their data and user access, while the SaaS vendor is responsible for the infrastructure, hypervisor, network traffic, operating system, and application management. Organizations can use SSPM to manage their side of the shared security responsibility for SaaS applications.

The security posture in a SaaS environment is the overall security status of software and hardware assets, code repositories, SaaS applications, data pipelines, networks, and services. SSPM enables system hardening, protecting applications from cyberattacks and allowing security teams to enforce security policies across a portfolio of SaaS applications. SSPM is a critical part of an organization’s ability to detect cyberattacks, mitigate incidents, and recover.

The Importance of SSPM

Cloud security is an umbrella term encompassing IaaS, PaaS, and SaaS. Gartner established the SaaS Security Posture Management (SSPM) category for solutions that evaluate security risk on an ongoing basis and manage the security posture of SaaS applications.

Organizations of all sizes depend on numerous SaaS applications – research shows that with 1,000 employees or more, an organization tends to have hundreds of applications. This complex structure creates a need for visibility. Given this, SaaS security configurations are becoming increasingly important.

Here are key challenges SaaS security needs to address:

• Insufficient control over a growing portfolio of SaaS applications.
• Insufficient governance in the SaaS application lifecycle: from purchase through to deployment, maintenance, and operation.
• Insufficient visibility of configurations in SaaS application portfolio.
• A skills gap in an accelerating, complex, and evolving cloud security environment.
• Overwhelming workload required to monitor and evaluate hundreds to tens of thousands of permissions and settings.

The native security controls of SaaS applications are generally sturdy. Nevertheless, it is the organization’s responsibility to ensure that all configurations are set correctly—from user roles and privileges to global settings. If an unaware SaaS user shares the wrong data or changes a setting, they could expose confidential company information.

The security team needs to be aware of every application, configuration, and user, ensuring compliance with company and industry standards. Successful SSPM solutions answer these pain points and offer full visibility into the organization’s SaaS security posture. Such solutions automatically assess compliance with industry and company policies.

Certain solutions enable automated remediation from within the solution. This is an important capability that can reduce workloads and improve results for security teams.

A Complete Approach to SaaS Security

A comprehensive SaaS security approach should rest on the foundation of a properly understood SaaS environment. Security teams must understand who uses business-critical applications and various services and how they use them. This context is crucial for informing decisions about security posture management and threat mitigation.

The following measures are essential for providing well-rounded SaaS security.

Activity and State Data Consolidation

Before the security team can implement measures to improve an organization’s SaaS security posture and mitigate threats, it must understand all the SaaS applications used and their unique data schemas. This understanding enables the security team to make informed decisions.

First, the team must map all the entities and actions of each application in the SaaS environment, including files, users, permissions, roles, activities, and configurations. Once they’ve aggregated the relevant data, security analysts and responders must normalize and enrich it to conduct investigations across various applications. For example, all the data from disparate services should have a standard format and include relevant contextual information.

Proactive Application Posture Hardening

SaaS applications may vary widely in terms of configurations and user privileges. It is possible to optimize each application to minimize risks and mitigate the damage in the event of a breach. However, application owners often launch and manage services without assessing configuration settings or restricting access privileges. For example, they may grant privileged roles to many users to facilitate business operations.

The failure to prioritize SaaS security can expose business-critical SaaS services to more vulnerabilities and increase a breach’s potential impact. The security team must have clear, comprehensive insights into the configuration and permissions settings throughout the SaaS environment to minimize risk. Consolidating these insights in a central inventory makes it easier to keep track of and manage settings, prevent configuration drift, maintain least-privilege access, and improve the organization’s overall SaaS security posture proactively.

Continuous Threat Monitoring and Mitigation

Threat actors increasingly target the sensitive data stored in SaaS applications and leverage methods like cookie theft and session hijacking to bypass security measures (i.e., MFA and SSO). Therefore, the security team must maintain a continuous monitoring system to generate the necessary insights to detect malicious activity quickly and prevent or mitigate actions like data theft.

Organizations typically have multiple integrations connected to their core applications, so vulnerabilities in one service may enable attackers to access sensitive data in another. Security analysts must understand normal user activity in various applications—they can use the baseline of typical behavior to analyze behavioral patterns and identify anomalous activities that might indicate an insider threat or account takeover.

Incident responders can use additional layers of contextual information about configurations and permissions to delineate the scope of an attack and report incidents smoothly and quickly.

Conclusion: System Hardening for a SaaS Portfolio

In this article, I explained the basics of SSPM and described three practices that can help an organization achieve holistic system hardening for SaaS applications:

• • Activity and state data consolidation – use SSPM to gain a holistic view of activities and security statuses across the SaaS application portfolio.

• Proactive application posture hardening – take proactive action, either automated or manual, to improve the security posture of applications.
• Continuous threat monitoring and mitigation – it is impossible to mitigate all vulnerabilities, so continuously monitor and be ready to remediate additional vulnerabilities as they are discovered.

I hope this will be useful as you improve visibility, control, and security of SaaS applications.

By Gilad David Maayan