Why user privileges are important for SaaS security
Earlier this year, attackers compromised Mailchimp, a popular SaaS email marketing platform. The attackers viewed over 300 Mailchimp customer accounts and exported audience data for 102 of them. This breach was preceded by a successful phishing attack that led to malicious attacks against Mailchimp customers' end users.
Three months later, Mailchimp suffered another attack. Once again, the employee's account was compromised after a successful phishing attempt.
Although the personal information of the compromised Mailchimp accounts was not made public, it is clear that user permission settings may have contributed to the attack. After escaping detection and infiltrating the system, the attacker gained the necessary access to utilize internal tools capable of finding the data of interest. The attack ended when the security team suspended user access, but the data that had been downloaded was still in the hands of the attackers.
Using role-based account control (RBAC) to manage user privileges could have significantly reduced the damage caused by the intrusion. Had the principle of least privilege been applied, the compromised account may not have been able to access the internal tools used in the attack. Additionally, reducing access privileges could have stopped the attack entirely and ultimately kept the number of compromised accounts to far less than 100.
What are user privileges?
SaaS user permissions allow app owners to limit users' resources and actions based on their roles. You can use RBAC to grant read or write permissions, assign privileges to high-level users, and assign permissions to determine the level of access to your company's data.
What is the purpose of the principle of least privilege?
The principle of least privilege is an important security concept that gives users the least amount of access they need to perform their job. In practice, limiting high-level access to a small number of privileged users reduces the attack surface. Even if a user's account with limited privileges is compromised, the attacker has limited access to sensitive data contained within the application.
Why user privileges are important for security
App administrators often end up granting full access to team members, especially when targeting a small group of users. App administrators, who are business users who are not security experts, don't always realize how risky it is to grant such access. Administrators often think it's better to grant full permissions from the beginning than to be asked for specific permissions later.
Unfortunately, this approach can put sensitive data at risk. User permissions help clarify what data is exposed in the event of a data breach. Protecting data through privileges ensures that an attacker who accesses your information can only access data that is available to the victim.
Poorly configured user permissions can easily allow attackers to carry out automated attacks. Granting broad API permissions to multiple users makes it easy for attackers to infiltrate SaaS apps to auto-launch ransomware or steal data.
Why user access reviews are important
A user access review is essentially an audit that examines users and their access rights. User access reviews allow security team members and app owners to see how much access individual users have and adjust the level of permissions as needed. Masu.
This feature can help you identify users who retain unnecessary levels of privileges after changing roles or teams within your company, or alert you to employees who are exhibiting suspicious behavior that deviates from their normal behavior. This is important for notifying your team. Additionally, this feature can help you identify former employees who still have access or high-privileged permissions.
Access reviews should be conducted at regular intervals to identify unnecessary permissions within a set time period.
Conclusion
User permissions are a security feature that is often misunderstood. User privileges have the ability to protect your organization from both external attacks and internal data sharing mistakes.
SSPM solutions enable effective user permission management, allowing security professionals and app owners to confidently understand the scope of individual user permissions and monitor SaaS security hygiene for specific users. You can check. This real-time monitoring of users is much more effective than user access auditing, which simply shows a snapshot of user privileges at a specific moment in time.
Inquiry/Document request
In charge of Macnica Adaptive Shield Co., Ltd.
- TEL：045-476-2010
- E-mail：AdaptiveShield-sales@macnica.co.jp
Mon-Fri 8:45-17:30
