5 SaaS Security Risks to Consider when Choosing a Solution

The use of SaaS applications has been gaining momentum with many businesses as an “on-demand” and “pay-as-you-go” solution. Low setup costs, easy implementation, and without the need to build or maintain any infrastructure, SaaS has empowered businesses to quickly address challenges and expand with low barriers to entry.

With such a model, it’s easy to question how secure your data is in a cloud-based environment.

Your SaaS security risks checklist

If you’re looking to unlock new opportunities and markets, or address some of your business challenges, we’ve put together 5 SaaS security risks to consider when choosing a SaaS provider as your business partner.

Using a shared environment

A SaaS service is usually a shared environment that will be accessed by multiple users. Cloud services have become almost necessary for most businesses, yet there are many risks that need to be covered and mitigated. Security misconfigurations can expose sensitive data to hackers, and attackers can pose as a user to exploit the vulnerabilities within the environment and gain unauthorised access.

Ensure that your SaaS provider has strong access controls on APIs to prevent hackers from gaining access to other services. At CINNOX, we have put in place a range of controls to ensure system safety and mitigate risks from unauthorised access:

• Regular vulnerability scanning
• Dedicated Security Operation Centre & Incident response team
• External penetration test by 3rd party experts
• Bug bounty programs
• Following SSDLC (Secure Software Development lifecycle)
• Using best practices from OWASP (Open Web Application Security Project) and NIST (National Institute of Standards and Technology)
• Internal security test by the red team before each deployment
• Advanced password policies
• Two-factor authentication and third party authentication
• User roles and permissions for data access levels, as well as user audit logs

Data location & compliance issues

Government mandates, such as GDPR (General Data Protection Regulation), and regulations for industries such as healthcare – HIPAA (Health Insurance Portability and Accountability Act), retail – PCI DSS (Payment Card Industry Data Security Standard), and finance – SOX (Public Company Accounting Reform and Investor Protection Act), require auditing and reporting tools to demonstrate cloud compliance, in addition to data protection requirements.

Any SaaS provider you consider should be compliant (especially for GDPR) based on your unique business needs and local government and industry regulations.

CINNOX is fully compliant with GDPR, PCI, and HIPAA; as well as being ISO 27001 and ISO 9001 certified by following best practices and standards.

Data encryption

To protect data stored in shared environments, providers and users must make sure it is encrypted in transit and at rest with the latest standards. Anyone could access the data if it is not encrypted, including staff from the SaaS provider or cloud provider, third parties with access, or hackers.

At CINNOX, the data in transit and rest is encrypted with the latest and most advanced industry standards, TLSv1.3 and AES256. We also provide private encryption key generators to generate keys for administrators and selected users to access encrypted data, which is unique to every user.

Backup, recovery, and data retention

With data stored in a shared environment, it’s important for SaaS providers to provide a detailed data backup and recovery policy. In case of data loss or a major disaster, this will prevent you from losing your valuable data and records.

CINNOX will securely backup all data daily per every region, and based on agreement with partners, can simultaneously store data in multiple locations. CINNOX also provides a hybrid cloud model, allowing data to be encrypted and securely stored on public cloud or private data centres. Large enterprises, or those with strict data retention regulations, prefer to have a copy of data on their own servers and for it to be completely deleted from their SaaS provider’s servers. For these partners, CINNOX provides a data retention package, where data is backed up, encrypted, and transited using a secure file transfer protocol to their server and fully deleted from CINNOX’s servers regularly.

Learn more about data retention

Service-Level Agreement (SLA) & availability

Availability of a SaaS provider is key, especially in a world that’s growing divided by trade war tariffs and bans on certain tech and apps. Depending on the host location of the SaaS provider or its country of origin, your service may face attacks like Distributed Denial-of-Service (DDoS) to reduce application availability, be outright banned in certain markets, or heavily censored and restricted.

Services that are used for customer engagement such as CINNOX, need to ensure there’s elasticity during hardware problems or attacks. CINNOX is also available worldwide, combining traditional telecom channels with digital channels to bridge the divided world and empower teams and customers to connect – anywhere, with full omnichannel capabilities (Facebook, SMS, virtual numbers, live chat).

With a carrier-grade contractual Service Level Agreement (SLA), CINNOX guarantees an annual uptime of 99.95% with real-time service delivery, monitoring, and support 24 hours a day, 365 days a year. High-performance connections and availability are achieved through our globally-distributed IP network comprising strategically positioned points of presence (PoPs) and direct interconnections with over 160 tier-1 telecom carriers and mobile operators worldwide.

Don’t worry about SaaS security risks – choose CINNOX

CINNOX is an instantly available solution worldwide, designed with security in mind. Leave the backend, infrastructure and SaaS security risks to us – so you can focus on growing your business.

References:
SECURITY CONCERNS AND COUNTERMEASURES IN CLOUD – PALLAVI SIDELLA – April 2012

NIST SaaS definition