A new report reveals that 31% of organizations experienced a SaaS data breach in the past 12 months, a 5% increase from the previous year. This increase may be related to inadequate visibility into the applications being deployed, including third-party connections to major SaaS platforms.
Nearly half of businesses using Microsoft 365 believe they have fewer than 10 apps connected to the platform, but aggregated data from the report shows the average number of connections is more than 1,000. A third admitted they don’t know how many SaaS apps are deployed in their organization.
SaaS applications: a popular target for cybercriminals
For its State of SaaS Security 2024 Report, security platform AppOmni surveyed managers and IT experts at 644 companies in the US, UK, France, Germany, Japan, and Australia in February and March 2024. Nearly half have more than 2,500 employees.
“Business units or individuals often bypass traditional IT procurement processes to adopt new third-party SaaS applications that integrate seamlessly with their core SaaS platforms,” the authors wrote.
According to another recent report from Onymos, the average enterprise now relies on more than 130 SaaS applications compared to just 80 in 2020.
They are a popular target for cybercriminals due to the sensitive data they store, the numerous entry points due to their wide adoption and integration with other services, and their reliance on often poorly configured cloud environments.
Gartner predicted that 45% of organizations worldwide will have experienced attacks on their software supply chains by 2025.
SEE: Millions of Apple apps were vulnerable to CocoaPods supply chain attack
Decentralized security governance accompanies the deployment of SaaS applications, which can lead to breaches
Another factor at play is the gradual move towards decentralisation of security governance, which has led to confusion over responsibilities and, therefore, dangerous gaps.
SaaS has largely replaced on-premise software, which is easily protected by physical security measures such as cameras and guards. Because SaaS is cloud-based, deployed on different devices and used by different people, its security and governance have also become dispersed.
Only 15% of respondents indicated that responsibility for SaaS security is centralized within the organization’s cybersecurity team.
“The benefits of decentralized operations come with a blurring of responsibilities between the CISO, line-of-business heads, and the cybersecurity team,” the report’s authors wrote. “The changes required for comprehensive SaaS security often take a backseat to business objectives, even when business unit heads lack the expertise to implement security controls.”
They added: “And because there is so much autonomy at the application owner level with respect to security controls, it is difficult to implement consistent cybersecurity measures to protect against application-specific vulnerabilities.”
Verification of SaaS applications is not up to par, even for those authorized by the company
Almost all organizations surveyed only deployed SaaS applications that met defined security criteria. However, 34% said the rules are not strictly enforced. This marks an increase of 12% from the 2023 survey.
The confusion of responsibilities between business leaders and IT teams and their desire to realize efficiency benefits as quickly as possible means that applications do not always receive the highest standard of security vetting before deployment.
Furthermore, only 27% of respondents are confident in the security levels of applications that have been sanctioned. Less than a third are confident in the security of their company’s or customer data stored in enterprise SaaS applications, a 10% decrease from last year.
The report’s authors wrote: “SaaS applications vary widely in how they handle policies, events, and controls to manage access and permissions. Therefore, ad hoc policy management for each application can lead to inconsistent implementation.”
Recommendations for building a secure SaaS environment
The AppOmni team provided several steps to ensure a secure SaaS environment:
- Identify the SaaS attack surface by auditing the SaaS estate and determining access levels. Prioritize applications that store and process business-critical information.
- Define roles and responsibilities for security professionals and business leaders, and develop standard operating procedures for processes such as onboarding new applications, establishing policy baselines, and user onboarding and offboarding.
- Establish robust permissions and accurate threat detection across the SaaS estate to minimize the number of security alerts and enable systemic remediation.
- Ensure that detection and approval policies are in place for connected SaaS applications and OAuth connections, not just core applications. Use the Open Source SaaS Event Maturity Matrix to review supported events for connected applications.
- Formulate an incident response strategy that prioritizes response to SaaS risks and incidents, including scoping, investigation, protection, and reporting.
Brendan O'Connor, CEO and co-founder of AppOmni, said in the report: “Gone are the days of waiting for SaaS vendors to be the primary security providers for your SaaS estate.
“As an enterprise’s operating system, your SaaS estate requires a well-structured security program, organizational alignment on responsibility and accountability, and continuous monitoring at scale.”
