SaaS Notes

Security Concerns in the SaaS Environment

Concern about security is cited as one of the greatest hurdles to implementing SaaS. I had the opportunity to talk to a few SaaS providers regarding security concerns and would like to share what I learned from these providers.

Security is a broad term that can be broken down into three areas: data center, application and user. Each of these areas has its own security best practices schema and ignoring any one area presents a security vulnerability to the firm and its data. The best SaaS providers in the market discuss each of these areas with their customers, demonstrating how their SaaS solution is as secure, and frequently more secure, than what an internal IT department can provide. A bold statement, I know, but read on and you will learn why SaaS implementations are more secure than on-premise solutions.

Data Center Security

There are only two points of entry into a SaaS environment: The front-end, which the users utilize; and the back-end, used by the SaaS provider for maintenance and management. Limited entry eliminates all the ways in which data is lost or stolen. Front-end entry is always through a secure, encrypted VPN leveraging identity and role-based access.

All of the firms I talked with for this piece referenced Symantec's research about rogue employees and lost laptops as the primary sources of data loss and theft. Working in the cloud removes the laptop issue and even the smartphone issue. Reducing broad access by limiting employees to the groups and teams they work in reduces the potential for intellectual property theft.

Application Security

Application security is directly associated with identity and role based access permissions. Application security includes, but goes beyond the standard password access. By utilizing SaaS, application security also includes encryption of the password, logs the number of attempts to logon, and can encrypt field/text/attachments. Application security also disables Java Scripts, one of the leading causes of malware and malicious activities.

User Security

User security is rooted in role-based access and identity management. Identity management is maintained in the firm's LDAP directories. Permissions and denials are controlled by the firm's administrator. The directories can be either inside the firm's firewall, at the SaaS provider's site, or in a DMZ. Having the firm control the identity management directories enables the administrator to move quickly to enable or disable users as needed.

Certifications

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world