Thirty-one percent of organisations experienced a SaaS data breach in the last 12 months, a 5% increase over the previous year, a new report has found. This surge may be linked to inadequate visibility of the apps being deployed, including third-party connections to core SaaS platforms.

Nearly half of firms who use Microsoft 365 believe they have fewer than 10 applications connected to the platform, but the report’s aggregated data shows that the average number of connections is over a thousand. A third admitted that they don’t know how many SaaS apps are deployed in their organisation.

SaaS applications: A popular target for cybercriminals

For the “State of SaaS Security 2024 Report,” security platform AppOmni surveyed managers and IT experts from 644 firms in the U.S., U.K., France, Germany, Japan, and Australia in February and March 2024. Nearly half have over 2,500 employees.

“Business units or individuals often bypass traditional IT procurement processes to adopt new third-party SaaS apps that seamlessly integrate with their core SaaS platforms,” the authors wrote.

According to another recent report from Onymos, the average enterprise now relies on over 130 SaaS applications compared with just 80 in 2020.

They are a popular target for cybercriminals due to the sensitive data they store, the numerous entry points due to their widespread adoption and integration with other services, and their reliance on oft-misconfigured cloud environments.

Gartner predicted that 45% of organisations globally will have experienced attacks on their software supply chains by 2025.

SEE: Millions of Apple Applications Were Vulnerable to CocoaPods Supply Chain Attack

Decentralised security governance accompanies SaaS app deployment, which can lead to gaps forming

Another factor at play is the gradual move towards the decentralisation of security governance, which has generated confusion over responsibilities and, therefore, dangerous gaps.

SaaS has largely replaced on-premises software that is easily protected with physical security measures like cameras and guards. As SaaS is cloud-based, deployed across different devices, and used by different personas, its security and governance has also become dispersed.

Only 15% of the survey’s respondents indicated that responsibility for SaaS security is centralised in the organisation’s cybersecurity team.

“The benefits of decentralized operations are accompanied by a blurring of responsibilities between the CISO, line-of-business heads, and the cybersecurity team,” the report’s authors wrote. “Changes required for comprehensive SaaS security often take a backseat to business goals, even as business unit heads lack the knowledge to implement security controls.”

They added: “And because there is so much autonomy at the app-owner level regarding security controls, it’s difficult to implement consistent cybersecurity measures to protect against app-specific vulnerabilities.”

Vetting of SaaS apps is not up to scratch — even those sanctioned by the company

Nearly all of the respondent organisations only deployed SaaS apps that met defined security criteria. However, 34% said the rules are not strictly enforced. This marks an increase of 12% from the 2023 survey.

The obfuscation of responsibilities between business leaders and IT teams and their desire to reap efficiency benefits as quickly as possible means that apps don’t always get the highest standard of security vetting before being rolled out.

Furthermore, only 27% of respondents are confident about the security levels of the apps that have been sanctioned. Less than one-third are confident in the security of their company’s or customers’ data stored in enterprise SaaS apps, marking a 10% decrease on last year.

The report’s authors wrote: “SaaS apps vary widely in how they handle policies, events, and controls to manage access and permissions. Therefore, ad hoc management of policies on a per application basis can lead to inconsistent implementation.”

Recommendations for building a secure SaaS environment

The AppOmni team provided several steps to ensure a secure SaaS environment:

1. Identify the SaaS attack surface by auditing the SaaS estate, determining access levels. Prioritise the apps that store and process business-critical information.
2. Define the roles and responsibilities of security professionals and business leaders, and draw up standard operating procedures for processes like onboarding new apps, setting policy baselines, and adding and offboarding users.
3. Establish robust permissions and accurate threat detection in the SaaS estate to minimise the number of security alerts and enable systemic fixes.
4. Ensure detections and approval policies are in place for connected SaaS apps and OAuth connections, not just the core apps. Use the open source SaaS Event Maturity Matrix to review supported events for the connected apps.
5. Formulate an incident response strategy that prioritises responding to SaaS risks and incidents, including scoping, investigating, securing, and reporting.

Brendan O’Connor, CEO and co-founder of AppOmni, said in the report: “The days of waiting on SaaS vendors as the primary security providers for your SaaS estate are over.

“As the operating system of business, your SaaS estate requires a well-structured security program, organizational alignment on responsibility and accountability, and continuous monitoring at scale.”