#SaaS Security
#TrustEverybodyButCutTheCards
The
#SaaS attacks matrix from PushSecurity: useful
#attack examples -
linkedin.com/posts/francesco…
****
#Initialaccess and poisoned tenants
-
#credentialstuffing and email
#phishing
-
#waterhole attack using poisoned tenant , ie an attacker-controlled tenant.
**** Living-off-the-(SaaS)-land to persist and avoid detection
- use legit SaaS apps that specialize in workflow automation to create shadow workflows
- best example here is using a well-known automation app like
#Zapier
How
#SAML,
#OAuth &
#OIDC are different, their application and how it works? -
linkedin.com/posts/francesco…
“They Live": non-human identities in the world of
#SaaS
**** In the world of SaaS, non-human actors, i.e.
#3rdparty connected apps count multiple times human ones -
linkedin.com/posts/francesco…
-
#serviceaccounts
-
#OAuth authorizations
-
#APIkeys
**** Examples -
linkedin.com/posts/francesco…
-
#Calendly integrating with
#GoogleWorkspace through an OAuth authorization: the integration is initiated by a human, but Calendly is non-human.
-
#SwiftPOS, a
#pointofsale (
#POS) application and device transfers POS data to a
#businessintelligence platform, like
#Microsoft #PowerBI, through a non-human account.
****
#Risks of Non-human Accounts -
linkedin.com/posts/francesco…
- Every SaaS app has its own approach to managing these types of user accounts
- Non-human accounts are authenticated one time and forgotten
-
#MFA or
#SSO don't apply well.
- Humans have typical
#behavior patterns, such as logging on to applications during working hours. Non-human accounts often access apps during off-peak time to reduce network traffic
- In an effort to simplify non-human
#accountmanagement, many organizations use the same
#APIkey for all integrations.
- Non-human accounts are largely unmonitored and have wide-ranging
#permission scopes.
**** Securing Non-human Accounts -
linkedin.com/posts/francesco…
- Non-human accounts require the same
#visibility by security teams as human accounts:
-
#Risk level associated with the user based on
#role and existing configurations
- Activated/deactivated
#users
- Dormant users
- Orphan users
- Privileged roles assigned to the user
- All apps user is
#connected to
- Failed
#securitychecks
- User devices being used
- Users with multiple
#login usernames (accounts).
Non-human accounts:
- should be limited to specific
#IPaddresses that are pre-approved on an
#allowlist
- should not be granted access through the standard
#loginscreens
- should have
#permissions should be tailored to meet their specific needs as apps, and not be wide-ranging or matching their human counterparts
- should be used under a strict policy of prohibiting
#accountsharing.
Non-human accounts may access SaaS apps at all hours of the night, but they are usually fairly consistent in their interactions: this is where
#ITDR plays an important role
#OAuth 2.0 and
#OIDC: the foundation of
#APIsecurity -
linkedin.com/posts/francesco…
#TrustEverybodyButCutTheCards