The Rising Threats of Expanding SaaS Usage

SaaS Security Risks: Protecting Organizations in an Evolving Landscape

Macro trends such as the shift to cloud services, a growing remote (or hybrid) workforce, and heavy reliance on third-party partners and contractors have transformed the way organizations operate their IT infrastructure. As a result, organizations are now working with more software-as-a-service (SaaS) applications than ever before. While the adoption of SaaS brings numerous benefits, it also comes with inherent security risks.

The Nature of SaaS Attacks

Attackers have been quick to exploit the ubiquity of SaaS applications, targeting insecure default configurations and weakly secured identities. Intercepting OAuth tokens, bypassing multifactor authentication schemes, and exploiting misconfigured systems and applications are just some of the methods attackers have employed to gain unauthorized access to business-critical applications such as GitHub, Microsoft 365, Google Workspace, Slack, and Okta.

In the recently published “2023 State of SaaS Security” report from Valence Threat Labs, researchers have shed light on the various ways SaaS usage exposes organizations to attack. The findings of the report are based on organizations that have deployed Valence Security’s SaaS security platform.

Underutilized and Inactive Resources

One of the key findings of the report is that organizations need to do a better job of tracking abandoned applications, files, and user accounts. Shockingly, 51% of an organization’s SaaS third-party integrations are inactive. Furthermore, 90% of an average organization’s shared assets (files and folders shared with external collaborators) have not been accessed for at least 90 days. This reveals a significant vulnerability, as dormant accounts and underutilized resources provide potential entry points for attackers.

On average, 1 in 8 employee accounts are dormant, belonging to users who are no longer with the company. Additionally, 10% of an organization’s shared integrations and data belong to ex-employees. This highlights the importance of effective offboarding processes to ensure that when an employee leaves the company, their access is promptly revoked, minimizing the risk of unauthorized access.

SaaS Integration Challenges

SaaS has evolved into an ecosystem of interconnected applications that share data and identities, no longer limited to standalone single-function applications. While integration brings efficiency and improved collaboration, it also introduces security challenges. The report reveals that 100% of organizations grant full read/write access to email, files, and calendar to at least one third-party tool or service. Additionally, there are an average of 21 integrations per organization with tenant-wide access to company and employee data.

Data sharing is also a concern, with files being shared with personal accounts 30% of the time. Furthermore, there are 54 shared resources (files, folders, SharePoint sites) per employee, and a staggering 193,000 shared resources per company, on average. Many of these resources are sitting idle, representing potential security risks.

Implementing Effective Risk Management

While the benefits of SaaS are undeniable, organizations need to take proactive measures to mitigate the associated security risks. Regularly removing unused integrations and revoking unnecessary sharing can significantly reduce the attack surface. Implementing automated processes to automatically revoke data shares after a certain time period, such as 30 days, is a crucial step to mitigate the risk of unauthorized access.

Furthermore, effective life cycle management is essential to ensure that existing business processes are not impacted when an employee leaves the company. Deactivating user accounts promptly upon an employee’s departure is vital to reduce the risk of unauthorized access and maintain data security.

Conclusion

The rapid adoption of SaaS applications has revolutionized the way organizations operate, providing increased flexibility and collaboration. However, these advancements bring with them risks that organizations must address proactively to safeguard their sensitive data, maintain compliance, and protect their digital infrastructure.

By prioritizing security measures such as monitoring abandoned applications and accounts, revoking unnecessary data sharing, and implementing effective life cycle management processes, organizations can ensure a robust and secure SaaS environment.