Security Baselining SaaS and PaaS: An Overlooked Necessity

This IDC Perspective describes common breach scenarios that can be mitigated by SaaS platform hardening along with recovery steps. Addressing this risk robustly relies on sound governance and hardening based on risk. We cover the security program foundations needed to make these efforts successful and outline a tactical approach to hardening individual systems. Third-party SaaS platforms often ship with permissive configurations that favor ease of adoption over security. Organizations that fail to assess the security capabilities of these platforms and harden them appropriately prior to deployment may inadvertently expose themselves to compromise by malicious actors or personnel who accidentally mishandle sensitive data."SaaS platforms are a significant and growing attack surface for organizations that require a thoughtful approach to harden consistently," says Joel Sandin, adjunct research advisor for IDC's IT Executive Programs (IEP). "Central IT infrastructure and management tools can help, but the ultimate success of these efforts rests on sound governance and risk-informed review and configuration."