云安全联盟2022年SaaS安全调查报告

◎2022CloudSecurityAlliance-AllRightsReserved.Youmaydownload,store,displayonyourcomputer,view,print,andlinktotheCloudSecurityAllianceathttps://cloudsecurityalliance.orqsubjecttothefollowing:(a)thedraftmaybeusedsolelyforyourpersonal,informational,non-commercialuse;(b)thedraftmaynotbemodifiedoralteredinanyway;(c)thedraftmaynotberedistributed;and(d)thetrademark,copyrightorothernoticesmaynotberemoved.YoumayquoteportionsofthedraftaspermittedbytheFairUseprovisionsoftheUnitedStatesCopyrightAct,providedthatyouattributetheportionstotheCloudSecurityAlliance. 3 5 5 6 6 6 7 8 9 17 TheCloudSecurityAlliance(CSA)isanot-for-profitorganizationwithamissiontowidelypromotebestpracticesforensuringcybersecurityincloudcomputingandITtechnologies.CSAalsoeducatesvariousstakeholderswithintheseindustriesaboutsecurityconcernsinallotherformsofcomputing.CSA'smembershipisabroadcoalitionofindustrypractitioners,corporations,andprofessionalassociations.OneofCSAsprimarygoalsistoconductsurveysthatassessinformationsecuritytrends.Thesesurveysprovideinformationonorganizationsycurrentmaturity,opinions,interests,andactionsregardinginformationsecurityandtechnology.AdaptiveShieldcommissionedCSAtodevelopasurveyandreporttobetterunderstandtheindustry'sknowledge,attitudes,andopinionsregardingSaaSsecurityandrelatedmisconfigurations.AdaptiveShieldfinancedtheprojectandco-developedthequestionnairebyparticipatingwithCSAresearchanalysts.ThesurveywasconductedonlinebyCSAfromJanuarytoFebruary2022andreceived340responsesfromITandsecurityprofessionalsfromvariousorganizationsizesandlocations.CSA'sresearchteamperformedthedataanalysisandinterpretationforthisreport.ofsecuritytoolsforSaaSapplicmisconfiguration.Thisnumbercouldbeashighas63%asanotableamountwereunsureiftheirorganizationhadexperiencedasecurityincidentduetoaSaaSmisconfiguration.Thisfactisparticularlystrikingwhencomparingsimilardata20%UnsureonlaaSmisconfigurations;17%oforganizationsOrganizationsneedtoembraceautomationandcontinuousscanningfornotjustlaaSmisconfigurationsbutalsoSaaSmisconfigurations,topreventsuchsecurityincidents.Automationenablesorganizationstoremediatetheissueinreal-43%Yestime,sotheyaren'tleftvulnerable.Theleadingcausesofthesecurityincidentsaretworelatedissues:toomanydepartmentshaveaccesstotheSaaSsecuritysettings(35%)andalackofvisibilityintochangesintheSaaSsecuritysettings(34%).Thisfindingisnotsurprisingfortworeasons:1.LackofvisibilityintoSaaSsecuritysettingswasratedatopconcernwhenadoptingSaaSapplications.2.Onaverage,organizationshavemultipledepartmentswithaccesstosecuritysettings(seethesectiontitled"ResponsibleforSaaSappsecuritysettings"formoredetails).FortypercentoforganizationsreportthatdepartmentswithsecurityaccesstoSaaSappsarebusinessdepartments(e.g.legal,marketing,sales)thatarefocusedonperformingjob-relatedtasks.Oftentheylackthepropertrainingandfocusonsecuritytobemakingchangestosecuritysettings.1However,theyneedthislevelof1accesstotheSaaSapplicationtoperformtheirjob.Thismeansformultipledepartmentsandprovidethesecurityteamsinsightintosecuritysettingchanges.detect,prevent,and/orcorrectifanimproperchangehasoccurred.Overthepastyear,81%oforganizationshaveincreasedtheirinvestmentinbusiness-criticalSaaSapplications,butfewerorganizationsreportincreasingtheirinvestmentinsecuritytools(73%)andstaff(55%)forSaaSSecurity.ThischangemeansthereisanincreasingburdenontheexistingsecurityteamstomonitorSaaSsecurity.Asseeninanotherkeyfinding,theuseofautomationformonitoringSaaSsecuritycanhelptodecreasethispressure,butonly26%oforganizationsutilizethistechnology.Securityteamsarespendingmoretimemanuallyassessingsecurity,detecting,andremediatingmisconfigurations.Organizationsmustconsiderthiswheninvestinginbusiness-criticalSaaSapplicationsasthecurrentinvestmentpatternwillbeunsustainablelong-term.8◎Copyright2022,CloudSecurityAlliance.Allrightsreserved.OrganizationsthatutilizeanSSPMcandetectandremediatetheirSaaSmisconfigurationssignificantlyquicker.Mostoftheseorganizations(78%)checkedtheirSaaSsecurityconfigurationsweeklyormorefrequently.ComparethistoorganizationsnotutilizinganSSPM;only45%wereabletocheckweeklyormoreregularly.Whenresolvingthemisconfigurations,73%oforganizationsusinganSSPMresolveditwithinaday,and81%resolveditwithintheweek.Comparethistoorganizationsthatdon'tuseanSSPM;only36%resolvethemisconfigurationwithinadayand61%resolveitwithinoneweek.Takethisinformationtogether,andSSPMusersreducethetimetheirorganizationisexposedandlikelytoexperienceasecuritybreach.OrganizationshavechangedtheirinvestmentinSaaSapplicationsandsecurityoverthepastyear.However,investmentinbusiness-criticalapplicationsisoutpacinginvestmentinsecuritytoolsandstaffforSaaSapplications.Ifthistrendcontinues,organizationswillcontinuetosignificantlyoverburdenoverburdentheirsecurityteams.Organizations,onaverage,reportthatmorethantheITorsecuritydepartmentsareresponsibleforSaaSappsecuritysettings.Thetopdepartmentsresponsiblearesecurity(59%),IT(50%),andbusinessapplicationowners(40%),whichsignifiesmultipledepartmentsthatsitoutsideofsecurity.Whilebusinessapplicationownershavevalidreasonstohavethislevelofaccess,thesedepartmentslacktheproperknowledgeofsecurityandinterestinmaintainingtheapplication'ssecurity.ThisultimatelycancauseissuesforthesecurityandITdepartmentswhodo.ThebuinessepplieationownergsalesmerThemostcommonmethodformonitoringSaaSsecurityconfigurationsismanually(57%).Ofthoseorganizationsthatmonitormanually,63%performthisassessmentmanually.Thisisnotonlyatime-consumingtaskbutalsopronetohumanerror.Approximately1notmonitoringSaaSsecurityconfigurationsall.Thiscouldbeduetoamultitudeofreasons,oneofwhichmaybealackofresources(e.g.tooltoautomatemonitoring;manually).新建文本文档.htmlsharing/storage(49%).Identityandaccessmanagement-e.g.Okta,Duo,ActiveDirectoryCommunicationandcollaboration-e.g.Slack,MicrosoftTeams,GoogleWorkspaceFilesharingandstorage-e.g.OneDrive,Dropbox,BoxVirtualmeetingplatforms-e.g.Zoom,Skype,GoToMeeting,WebexClouddataplatforms-e.g.AmazonRedshift,Snowflake,DruidCustomerrelationshipmanagement-e.g.Salesforce,HubspotEnterprisebusinessintelligence-e.g.Tableau,PowerBIElectronicsignature-e.g.DocuSign,AdobeSignTicketing-e.g.JIRA,ZendeskDaysweekly(23%).新建文本文档htmlThetopareasofconcernfarecomplementarytheywanttoavoidacceOperationalResilience新建文本文档htmlsameproblem.Thesecurityteamweretheabilitytodetectandauto-remediateSaaSmisconfigurations(54%)andvisibilityintopolicyviolationsinSaaSapplications(23%).reportedtheirSaaSsecurityimproved(51%),andtheysavedtimewithSaaSsecuritymanagementandmaintenanceCurren1.ProvidesecurityteamswithpropervisibilityintoSaaSappsecuritysettings,including3rdpartyappaccess,anduserpermissions.Thisvisibilityallowsmultipledepartmentstomaintaintheiraccesswithoutriskingi