IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Organizations at risk from misconfigured SaaS installations

Half of security teams delegate SaaS security to users, survey finds

Saas on a blue screen with a finger stretching to touch it

Misconfigured SaaS deployments are putting organizations at risk of cyber threats, according to a new study.

The research — carried out by IT security firm Adaptive Shield — found that 85% of companies see SaaS misconfigurations as a top security threat, putting it in the top three challenges for today's enterprises.

The SaaS Security Survey Report 2021 surveyed IT security professionals from North America and Western Europe in companies of 500 or more employees. According to the report, despite SaaS misconfigurations being a top threat, the more apps a company has, the less they check security settings and permissions for misconfigurations. Only 12% of companies with 50 to 99 applications check them weekly.

The research found that despite 60% of survey respondents reporting high concern with more than 25% of their SaaS app configurations, their frequency of reported checks remained low. 

The report found that one big problem for security teams is configuring the settings of all internal SaaS apps. Each app has different settings, a different user interface, its terminology, and its distinct complexities. According to the report, manually configuring settings for these disparate apps for hundreds to thousands of users is an impossible task.

SaaS owners in corporate marketing, sales, and product departments have found themselves, not the business’s security teams, responsible for the security of such code in 52% of organizations. The situation was better in companies with over 5,000 employees where the IT department is responsible for monitoring the security settings in 53% of companies.

The report said that one in four companies allows department owners (e.g., sales, marketing) to access SaaS security settings.  

“Any human error by the SaaS owner, who is often not trained in security, can lead to an increase in SaaS security misconfigurations, a reported high concern of CISOs and security professionals,” the report said.

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeFree download

The report said that unlike the other cloud security solutions in the market today, there are no widely used tools that enable security teams to have complete and continuous visibility of SaaS security settings and configurations. The survey shows that SaaS Security Posture Management (SSPM) has become the top priority for 48% of companies in 2021. 

“These findings present a clear view of an urgent need to secure the SaaS landscape," said Maor Bin, CEO of Adaptive Shield.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update
Whitepaper

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update

12 May 2022
Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022
Dell Technologies World 2022: Dell unveils security offerings for major cloud providers
public cloud

Dell Technologies World 2022: Dell unveils security offerings for major cloud providers

3 May 2022
How do you become an ethical hacker?
ethical hacking

How do you become an ethical hacker?

29 Apr 2022

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
IT admin deletes company’s databases and is jailed for seven years
Policy & legislation

IT admin deletes company’s databases and is jailed for seven years

16 May 2022