Appropriate permissions across SaaS
One of the seven deadly sins in SaaS is over-entitlement. Excessive privileges can lead to data loss, catastrophic data breaches, and wasted resources that could otherwise be allocated to other cyber threats.
This phenomenon occurs for various reasons. Administrators who think it would be a pain to respond to requests for additional access rights, or ``I don't want productivity to be hindered because my team members can't access important resources,'' may want to grant all access rights to users in advance. It may also be granted. Additionally, there may be cases where a regular administrator creates multiple privileged accounts and shares them with the team so that they can perform tasks in case the regular administrator is absent for some reason.
To properly protect your company's SaaS data, you need to grant appropriate privileges and create policies that align with the principle of least privilege.
What is the principle of least privilege?
Considering that all user accounts are the boundary between keeping an application secure or not, it makes sense to restrict access to individual accounts. If the credentials of a privileged account were to be compromised, it could cause significant damage.
An attacker can use sophisticated techniques to compromise a privileged account and then move laterally throughout the application in order to achieve nefarious goals.
The principle of least privilege grants each user access to only the data, resources, and applications they need to perform their job. By optimizing privilege levels according to user needs, even if an attack occurs, only the compromised account will be hijacked, which will narrow the scope of the damage.
Appropriate authority
Customizing permissions to meet employee needs can be a tricky task. Almost all SaaS applications include some form of role-based access control (RBAC) functionality, but to leverage it to precisely meet your company's unique needs, you can configure settings for this functionality in your application's configuration settings. Sometimes you have to make fine adjustments.
Defining roles in each application is necessary to help SaaS administrators assign the appropriate level of access to individual employees who use the application.
Additionally, administrators need to be on the lookout to avoid privilege creep. Privilege creep occurs when a coworker is granted higher-than-usual privileges while away or working on a particular project, and then forgets to take them back.
Additionally, privilege creep tends to occur frequently on Salesforce. When users cannot access a particular file, they typically file a ticket to request permission to access the information they need. There are hundreds of settings for access control within the Salesforce application. If the administrator does not know the configuration settings necessary to grant access rights, there are cases where the administrator grants the "view all data" privilege. Users are given too much access to the entire application, exposing internal data to unnecessary risks. Unfortunately, this form of overpowering problem rarely goes away.
Too many administrators is the source of trouble
Having too many administrators of a SaaS application makes it nearly impossible to maintain control over the application. This is because any user with administrator privileges can change settings at any time to suit their needs without thinking about what happens next.
Most administrators are business users who are trying to get the most value out of their applications, or at least get their work done quickly. If these admins find that multi-factor authentication (MFA) is slowing their productivity or want to share files with anyone using a link, how can they make the necessary changes? This means that you have the following.
While these may be well-intentioned, disabling MFA or allowing all users to download files can lead to serious problems, including data leaks and ransomware attacks on SaaS. there is. It is of utmost importance to have proper privileges and limit the number of administrators.
Avoiding risks
SSPM (SaaS Security Posture Management) solutions can be of great help in ensuring that privileges are appropriate. SSPM allows you to identify highly privileged users and alert your security team when the number of such users exceeds a certain threshold.
Many SSPM solutions provide user information, allowing security teams to see all the user data they need to design policies for privilege regulation. SSPM is not an identity and access management (IAM) tool and cannot be used as a replacement for IAM, but it is a useful governance measure to ensure your IAM solution is working as expected.
These automated tools help prevent over-privileging of users and ensure that data across SaaS applications is always protected.
Inquiry/Document request
In charge of Macnica Adaptive Shield Co., Ltd.
- TEL：045-476-2010
- E-mail：AdaptiveShield-sales@macnica.co.jp
Mon-Fri 8:45-17:30
