January 11, 2017 By Domenico Raguseo 2 min read

Cloud solutions can boost an organization’s ability to quickly adopt services and reduce the total cost of ownership. That is why chief information officers (CIOs) are looking to software-as-a-service (SaaS) to satisfy the demand for effective and efficient services that won’t break the bank.

Despite the benefits, however, it’s important to consider the security implications of adopting SaaS. The key to a smooth cloud transformation is to use proper security controls when moving a solution to SaaS.

Best Practices for Adopting SaaS

Adopting SaaS does not automatically guarantee the security of the overall infrastructure. It’s important to look at the security controls of the services that need to be protected. You must understand, for example, the specific consequences of an attack against a customer relationship management (CRM) solution. At the same time, you must ensure that your security information and event management (SIEM) solution is able to collect data from this CRM.

It’s also important to manage federated identities, since many SaaS solutions require different types of authentication. Forcing users to enter numerous passwords is not enough to establish a proper culture of security.

IT managers often decide whether to adopt cloud delivery models based on strategic decisions that are out of sync with reality. But if the company decides not to allow its employees to leverage cloud services, it may be too late. Cloud services are already used in enterprise functions — many libraries use application program interfaces (APIs) in the cloud, for example — and employees have been using de facto cloud apps for years.

A Complex Ecosystem

The life cycles of cloud applications must include dynamic security analysis. These applications are part of a complex ecosystem. They can be secure one day and lousy with vulnerabilities the next, depending on the state of that ecosystem.

Focus on installing security controls into the service and ensuring that technologies adopted to implement these controls do not depend on the delivery model. Otherwise, you may be forced to adopt future techniques and business models based not on strategic decisions, but a desire to salvage previous investments. Providing the same security controls for on-premises and cloud services is a key element of a good security strategy.

The SaaS Provider’s Responsibility

Applications are windows through which malicious actors hurl cyberattacks. Therefore, security needs to be part of the development cycle of these apps. Application security should not end with the general availability of a product. SaaS providers need to test their products continuously and respond to vulnerabilities according to the processes and best practices laid out by the security response experts.

Vendors should also provide SaaS on top of very solid infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) solutions. Lastly, it’s essential for SaaS providers to comply with regulations on privacy and data management.

Listen to the podcast: Cloud Data Security Trends, Challenges and Best Practices

More from Cloud Security

What is data security posture management?

3 min read - Do you know where all your organization’s data resides across your hybrid cloud environment? Is it appropriately protected? How sure are you? 30%? 50%? It may not be enough. The Cost of a Data Breach Report 2023 revealed that 82% of breaches involved data in the cloud, and 39% of breached data was stored across multiple types of environments. If you have any doubt, your enterprise should consider acquiring a data security posture management (DSPM) solution. With the global average…

Endpoint security in the cloud: What you need to know

9 min read - Cloud security is a buzzword in the world of technology these days — but not without good reason. Endpoint security is now one of the major concerns for businesses across the world. With ever-increasing incidents of data thefts and security breaches, it has become essential for companies to use efficient endpoint security for all their endpoints to prevent any loss of data. Security breaches can lead to billions of dollars worth of loss, not to mention the negative press in…

The importance of Infrastructure as Code (IaC) when Securing cloud environments

4 min read - According to the 2023 Thales Data Threat Report, 55% of organizations experiencing a data breach have reported “human error” as the primary cause. This is further compounded by organizations now facing attacks from increasingly sophisticated cyber criminals with a wide range of automated tools. As organizations move more of their operations to the cloud, they must also become increasingly aware of the security risks and threats that come with it. It’s not enough anymore to simply have a set of…

How I got started: Cloud security engineer

3 min read - In today’s increasingly cloud-focused business environment, cloud security engineers are pivotal in protecting an organization’s critical data and infrastructure. As experts in cloud security, they leverage their expertise to ensure that the ever-expanding amount of cloud data is safe from emerging threats and vulnerabilities. Cloud security professionals combine their passion for technology with a deep understanding of security principles to design and implement robust cloud security strategies. What experience do these security experts have, and what led them to the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today