Top 3 Software as a Service (SaaS) Security Threat for 2022

With 2021 drawing to a close and many companies finalizing their plans and budgets for 2022, it’s time to take a look at the SaaS Security challenges that lie ahead. Here are the top three SaaS security posture challenges, as seen by us:

• The mess of misconfiguration management 

The good thing is that more organizations than ever are turning to SaaS apps like GitHub, Microsoft 365, Salesforce, Slack, SuccessFactors, Zoom, and others to help employees stay productive even in the most difficult of situations. The bad news is that many organizations are struggling to adequately address each app’s constantly changing security risks. This problem starts with a simple oversight, and businesses entrust security teams with ensuring that each app’s security configurations are correct.

• Users, privileged users anywhere 

Consider the average employee who isn’t well-versed in security procedures and how their connectivity or entitlements raise the risk of stolen, revealed, or impacted sensitive data. The convenience with which SaaS apps can be utilized and accepted is incredible. With employees working from all over the world, the need for more robust privileged access governance is noticeable.

• Ransomware through SaaS

Threat actors can use various methods to target your SaaS applications, from the most basic to the most sophisticated. A traditional line of attack on a business email account via a SaaS application looks like this:

1. A cybercriminal sends a phishing email for an OAuth application
2. The user clicks on the link.
3. The user logs in to their account.
4. The application requests that the user be granted access to read email and other features.
5. The user selects “accept”.
6. This generates an OAuth token, which is directly sent to the cybercriminal.
7. The OAuth token grants the cybercriminal access to the cloud-based email or drive, etc.
8. Cybercriminals use OAuth to access and encrypt email, drives, and other data.
9. The next time the user signs into their email or drive, etc., their information will be encrypted. The ransomware attack has been initiated.
10. The user receives a notification that their email has been encrypted and must pay to regain access.

Other malicious attacks through OAuth applications can occur in an organization’s environment, but this is a specific type of SaaS attack.