Cloud services have become increasingly important to many companies’ daily operations, and the rapid adoption of web apps has allowed businesses to continue operating with limited productivity hiccups, even as global coronavirus restrictions have forced much of the world to work from home.
But at the same time, even major corporations have fallen prey to hackers. How can you maintain the integrity of your IT resources and data while still taking advantage of the benefits of software as a service (SaaS)?
While cybersecurity is a broad and complicated topic, let’s consider a hypothetical SaaS scenario and examine some of the risks.
Imagine that one of your employees is writing a sensitive report. It could have financial or medical data in it. It could have information on a revolutionary new design. Whatever it is, the report needs to be kept confidential.
What would happen if your employee writes the report in Google Docs? Let’s assume that this decision wasn’t run past the IT department. The employee just did it out of habit because Google Docs is what he or she had been using for years to share documents easily with coworkers.
What are some of the risks facing your company?
The problem of unsanctioned applications
A key problem that you may face is simply being unaware that the report is in Google Docs. When your IT department doesn’t know about the SaaS applications that your team uses, they can’t evaluate whether they are safe.
These apps are, therefore, considered shadow IT, tech used without the permission or knowledge of the IT department. The issue, of course, is not about Google.
The same problem could occur with a Word document synced through Dropbox or with any number of other legitimate SaaS applications that store data in the cloud. The problem is the lack of visibility.
Shadow IT can be a severe problem, but it often exists because employees lack the right tools. As Harvard Business Review noted, shutting down shadow IT “may at times be an appropriate response, but we have also seen IT adopt an open-minded approach and successfully work with the rogue unit to help secure data, standardize APIs, and ultimately assemble solutions that combine internal and external services. In general, we lean towards the latter approach.”
Sometimes the right approach is to secure the applications and make sure that they are used responsibly.
How to improve your SaaS security
What can you do to improve the sanctioning processes, compliance, and security of your SaaS applications? Aside from doing your due diligence in researching service providers, here are some suggestions.
Passwords are low-hanging fruit. Make sure that everyone in your company has and uses a proper password manager like LastPass or 1Password. You may want to consider requiring hardware security keys like the ones from Yubico. Google has had great success in preventing phishing attacks simply by requiring employees to use physical security keys for two-factor authentication.
You may also benefit from using a SaaS management tool, especially if you use a large number of software services or have a problem with shadow IT.
Torii, a SaaS management platform, can help you discover and evaluate all of the cloud-based applications used within your organization.