Every day, at any given time across an organization, workers use software-as-a-service (SaaS) solutions. These activities are prime targets for security breaches and can benefit from extra protection through something known as SaaS Operations (SaaSOps).
“Nowadays, it’s difficult to escape the daily news headlines about the latest security breach or company plagued by ransomware,” says Onix Solutions Engineer James Sanchez. “Cloud security is a huge concern. It’s a highly connected environment that allows traffic to flow in and out of it through the internet. Security in the cloud requires preventing unauthorized access. It’s a challenge in this SaaS-driven era.”
Chances are, each user on your network has at least 100 or more interactions with SaaS solutions each day. Consider the activity at your organization. Workers are interacting via Chat or Hangouts. They’re downloading, uploading and exporting files. They’re logging into apps. They’re installing browser add-ons and deleting files. And they’re connecting with sources inside and outside of your organization, ones that are trusted, but also ones that are unknown.
SaaS apps are everywhere, driving workplace productivity, efficiency and overall impact when done well. Workers have come to rely on them. But they can also be a security nightmare.
“SaaS is becoming like the Wild West,” says David Politis, CEO of BetterCloud, a longtime Onix partner. “It’s become a chaotic, ‘free-for-all’ frontier. Previously, enterprise application installation on corporate servers required IT’s help, but today anyone can buy, deploy and use SaaS.”
Good thing SaaS platforms are secure, right? Yes, Politis says, but with one caveat: SaaS platforms only secure their applications. You must secure how they are being used within your organization. Your organization’s insiders are your biggest threat, whether they mean to be or not.
“Your users are closest to your data. [They] are the new perimeter in the digital workplace,” Politis writes in The IT Leader's Guide to SaaSOps (Volume 2): How to Secure Your SaaS Applications.
So how do you balance your need for security and compliance with your workers’ needs for effortless collaboration in the cloud?
The answer is SaaSOps. It’s how your IT team manages and secures SaaS apps through centralized and automated operations, resulting in reduced friction, improved collaboration and a better employee experience. It also contributes to improved cloud security.
Here’s a look at how it all works.
What is SaaSOps?
SaasOps is the practice of “automating the operational and security tasks” that keep your organization’s SaaS apps running effectively. It takes into account how people use applications in their everyday computing activities, and focuses on how SaaS application data is managed and secured through centralized and automated operations.
Think about another cloud practice, DevOps. As Politis notes in his book, DevOps was born out of the need for faster deployment with fewer defects. A related practice, DevSecOps arose from the need to provide baked-in security inside these development workflows. SaaSOps grew from a similar path, a need for faster, more efficient management of software-as-a-service.
With SaasOps, you reduce human error and enjoy that baked-in security for your IT workflows, protecting against new risks that SaaS can introduce into your cloud computing architecture. In the process, SaasOps delivers excellent business value.
What SaaSOps Isn’t
Now that you have a brief overview of what SaaSOps is, let’s take a quick look at all the things it is not.
If you’re looking to deploy SaaSOps so that you enjoy better app uptime, availability or performance, you’re won’t realize those benefits. As Politis notes in his book, your SaaS vendor, in most instances, is responsible for those aspects of SaaS usage.
SaaSOps also doesn’t have anything to do with application infrastructure security. That’s again on the SaaS vendors. They provide physical data center security and also ensure the delivery of secure data, hardware and software that make up the infrastructure’s foundation.
“SaaSOps focuses on what’s in IT’s wheelhouse; the operational tasks related to managing users and the way those users engage with SaaS applications,” Politis notes.
Centralized SaaS Management and Security
SaaSOps is based on two core principles that rely on centralization, management and security. Because SaaS apps are siloed, centralizing all of the data ensures you manage and secure it effectively. A comprehensive view of all data objects connected across apps gives you the ability to automate workflows and protect that data.
On the management side, SaaSOps ensures that the right users have access to the right data. It also automates such processes as user onboarding and offboarding. This allows your IT team to focus on more strategic projects.
When it comes to security, SaaSOps steps in to protect “mission-critical data” to help companies mitigate a data breach threat. This also helps them avoid hefty compliance sanctions, loss of intellectual property, their competitive advantage — and even business disruption.
All interactions are not created equal. You have trusted users. Untrusted users. Internal interactions. External interactions. These are guided by such factors as time of day, worker roles and even if users work in the office or remotely. And they all have nuances.
Management and security are critical SaaSOps components that are affected by these users and interactions. Centralizing these operations allows you to have control over how they drive and support the scaling and protection SaaSOps provides. Without them, you wouldn’t have these benefits or even the concept of SaaSOps. They are non-negotiable.
Tradeoffs between Productivity & Security
As Politis notes in his book, “Most modern workplaces have a [SaaS] philosophy that falls somewhere in the middle of the productivity/security spectrum,” a concept that has complete productivity on one end and total security on the other. There’s a painful trade-off between choosing entirely between one or the other.
BetterCloud used a webinar poll to determine that only 3% of IT pros adopt an “open-access, complete-user-trust” philosophy, while 31% prefer to “mitigate risk” and “restrict all suspicious activity.”
The rest support moderated collaboration and educating users about risky behavior. This approach eases the tensions that can arise when it comes to balancing user and employer SaaS needs.
As SaaS apps introduce operational challenges into the modern cloud-first workplace, it’s crucial to secure all of those interactions created in these platforms. The thing is, there are interactions everywhere. Ones between users. Across apps. Even outside of your organization.
“It’s beneficial to keep your data safe in today’s cloud computing environment,” Sanchez says. “With increased threats, securing your SaaS apps is your responsibility, not just that of the provider. SaaSOps allows you to control user interactions in a fluid, flexible way that allows you to be as lenient or strict as you need to be.”