NEWS

In 2023, cyberattacks targeting or leveraging Software as a Service (SaaS) applications raised significant concerns among organizations, including high-profile incidents involving prominent groups like UNC4899, 0ktapus, and Midnight Blizzard APT.

As SaaS applications become increasingly integral to modern businesses, they also pose a new frontier for security threats, akin to a supply chain vulnerability.

A study was conducted analyzing 493 companies using SaaS in Q4 2023, shedding light on common risks associated with SaaS use and providing useful information to mitigate them. The study identified four main risks associated with SaaS:

1. Trusted Relationships (T1199): SaaS adoption introduces supply chain risks as organizations entrust sensitive data to external vendors, potentially exposing themselves to broader network infiltration by attackers.
2. Forgotten Tokens: Users often grant tokens to SaaS applications for access, but these tokens are frequently forgotten or unused, expanding the attack surface for potential breaches.
3. Shadow AI: The integration of AI capabilities into SaaS applications has become ubiquitous, with organizations inadvertently allowing these applications to utilize and refine models using confidential data. This introduces risks of data misuse or unauthorized access.

To address these 2024 challenges, some mitigation strategies are suggested. These include continuous IT discovery and management, with a focus on remediating SaaS misconfigurations, optimizing vulnerability detection, and monitoring the use of artificial intelligence in such applications.

Furthermore, the report highlights two major areas of concern:

1. Shadow SaaS: Many organizations are unaware of the extent of SaaS usage within their networks, with a significant portion of applications being single-user or unused for extended periods. This creates security and resource strains, increasing the likelihood of security incidents.
2. MFA Bypassing: Users sometimes bypass multi-factor authentication measures, opting for less secure login methods, which compromises overall security posture.

In summary, the rise of SaaS applications introduces new security challenges for organizations, but proactive measures can mitigate these risks. By prioritizing SaaS security measures, organizations can better protect their data and infrastructure from evolving threats in the digital landscape.