Identity And Access Management From The SaaS Application Perspective

Identity And Access Management From The SaaS Application Perspective

The SaaS Application Perspective

Software-as-a-Service (SaaS) has taken the enterprise by storm as the go-to delivery model for applications, and the cloud service is here to stay…for better or worse. Enterprises look to its benefits including dramatic cost savings, app availability from anywhere, and seamless updates and upgrades pushed to users from the SaaS provider.

There’s certainly no trepidation surrounding the benefits that the cloud rains down on enterprises, but what makes CISOs uneasy about SaaS delivery of apps is the lack of control and visibility into who has access to them while floating around in the cloud. Enterprises can obviously call the shots when data and apps are stored on-premise, but the fear of data breaches is amped up when applications and data, and who controls the access to them, is out of the hands of the enterprise and in the hands of the SaaS provider.

So what should a SaaS application developer or provider do so enterprises can govern their identity and access issues effectively? There are three key Identity and Access Management (IAM) areas that deserve close attention.

Authentication

SaaS apps can take several routes for authenticating users. The first is independent authentication with a private user directory and independent user account management. This is a poor choice because it forces the SaaS application to manage passwords and forces users to remember separate credentials for the SaaS app.  In addition, from an enterprise perspective, supporting joiners, movers and leavers (who’s moving in and out of your organization) here becomes difficult.

A variant of the independent option is internal authentication with a private user directory synched to an external user repository, usually Active Directory. While this approach may seem to be fine for a single application, as the number of applications scales, IT administrators have trouble managing the synching, and the risk of a breach goes up significantly when credentials are transmitted outside the perimeter.

The ideal authentication setup for a SaaS app is token-based authentication and SSO based on directory federation. SAML (Secure Access Markup Language) tokens issued by corporate identity providers fit the bill perfectly. Why? A single corporate username and password enables access across multiple SaaS applications. The process is intelligent, too, because user attributes relevant to authorization can be delivered in the token, and “just-in-time” provisioning (automated account setup for a first-visit user) can be supported.  While this approach requires the management of trust relationships between individual enterprises and the SaaS application in question, and at least basic user account management, the headaches of syncing and having hundreds of passwords are off the table here.

Entitlements

So your users have been authenticated to your SaaS apps. That’s the easy part, but effective management of entitlements – what your users can do within those apps at a fine-grained, nitty-gritty level, is far more difficult.

Most SaaS applications come with their own entitlement model, with internal administration of entitlement policies and an application-specific user interface for defining who gets what entitlements within the application. From an application developer’s perspective, this approach seems convenient, but in reality, it provides poor support for enterprise identity and access lifecycle management and compliance.  Setting up joiners and movers or de-provisioning leavers requires manual intervention, and tracking “who has access to what” often means the creation of application-specific reports.

The best option here is for SaaS applications to support an entitlement model that includes pre-defined application roles, and an API that supports the collection of current user-role and user-entitlement bindings as well as the provisioning or de-provisioning of user-to-role and user-to-entitlement bindings.  With this approach, administering user-to-role policies is done by each enterprise outside of the SaaS application, while the runtime authorization enforcement based on provisioned user bindings or user attributes is done within the SaaS application. Leaving policy administration out of the application and up to the enterprise makes change management and compliance much easier.

The benefit of having application roles is that it’s far easier to track and change user access to SaaS apps when each application’s access can be described in terms of tens of application roles and a few out-of-role entitlements, versus  thousands of entitlements.

It’s likely that a standards-based protocol will emerge someday for the API referenced above, but SPML (Secure Provisioning Markup Language) fell short, and SCIM (Simple Cloud Identity Management), while useful for account and user profile provisioning, doesn’t help with entitlements.

Auditing

Your users have been authenticated and can wield the power they’ve been given by individual application roles and entitlements within SaaS applications. But are you taking notes on every move they make within your organization? Probably not!  Automated logging of user activity for each SaaS app is crucial to both the audit trail needed when the auditor comes knocking and the real-time alerting required by enterprise SOCs (security operations centers). If a subset of the application roles and entitlements for a SaaS app is considered sensitive or privileged, it is up to the SaaS application developer and provider to ensure that the use of this privileged access can be closely and continuously scrutinized.

It is important to note that mobile and cloud computing is causing the Identity and Access Management industry to adopt new models and consider new standards.  OpenID Connect and OAuth, for example, are very promising standards, but SaaS applications targeted for broad-based enterprise use can’t rely exclusively on them today.

While SaaS applications, being outside the perimeter, aren’t inherently ideal for meeting enterprise identity and access lifecycle management and compliance initiatives, SaaS app developers and providers should look to these areas as the first action items when rolling out cloud-based applications across the enterprise.

By Deepak Taneja,

Contributor Deepak Taneja is Founder and CTO of Aveksa, provider of the industry’s most comprehensive Business-Driven Identity and Access Management platform.  By uniquely integrating Identity and Access Governance, Provisioning and Authentication, Aveksa enables enterprises to manage the complete lifecycle of user access for SaaS and On-premise applications and data.  Learn more at www.aveksa.com.

About CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as offer green/cleantech learning and consultive services around the world.

Our vision is to create awareness and to help find innovative ways to connect our planet in a positive eco-friendly manner.

In the meantime, you may connect with CloudTweaks by following and sharing our resources.

View All Articles

Sorry, comments are closed for this post.

Comic
Fintech Exploiting AI and Blockchain Technology

Fintech Exploiting AI and Blockchain Technology

AI and Blockchain Technology The field of artificial intelligence (AI) had progressed rapidly in the last ten years, though first recognized in the 1950s. From autonomous motor vehicles to digital personal assistants, the technology is making its way into a variety of industries, enabling better task automation, language processing, and data analytics. But more recently,…

Staying on Top of Your Infrastructure-as-a-Service Security Responsibilities

Staying on Top of Your Infrastructure-as-a-Service Security Responsibilities

Infrastructure-as-a-Service Security It’s no secret many organizations rely on popular cloud providers like Amazon and Microsoft for access to computing infrastructure. The many perks of cloud services, such as the ability to quickly scale resources without the upfront cost of buying physical servers, have helped build a multibillion-dollar cloud industry that continues to grow each…

What’s On The Horizon For Cloud Computing

What’s On The Horizon For Cloud Computing

Cloud Computing Trends Now that we are a little more than halfway through 2016, many experts are beginning to make their predictions about cloud computing for the rest of the year and beyond. While many of the trends aren’t too unexpected (the ever increasing acceptance of cloud solutions by businesses, for instance) other trends are…

Tesla Solar Plan Would Cost Billions To Implement

Tesla Solar Plan Would Cost Billions To Implement

A 1,500-word manifesto that Elon Musk unveiled last week, outlining his plan to expand Tesla Motors Inc.’s electric-vehicle line and to build “stunning solar roofs,” may end up costing the company tens of billions of dollars to carry out. Musk, Tesla’s chairman and chief executive officer, gave the estimate on Tuesday after a tour of the…

Healthcare IoT Security To Grow To $47 Billion In 2021

Healthcare IoT Security To Grow To $47 Billion In 2021

Healthcare IoT Security It’s obvious that IoT can make the entire healthcare industry more efficient. The kind of data involved can be used to save time, physical energy and operating costs. Because of this, devices that facilitate medical data are becoming more commonplace in the industry. This includes things such as wearables that can track…

Ending The Great Enterprise Disconnect

Ending The Great Enterprise Disconnect

Five Requirements for Supporting a Connected Workforce It used to be that enterprises dictated how workers spent their day: stuck in a cubicle, tied to an enterprise-mandated computer, an enterprise-mandated desk phone with mysterious buttons, and perhaps an enterprise-mandated mobile phone if they traveled. All that is history. Today, a modern workforce is dictating how…

Four Keys For Telecoms Competing In A Digital World

Four Keys For Telecoms Competing In A Digital World

Competing in a Digital World Telecoms, otherwise largely known as Communications Service Providers (CSPs), have traditionally made the lion’s share of their revenue from providing pipes and infrastructure. Now CSPs face increased competition, not so much from each other, but with digital service providers (DSPs) like Netflix, Google, Amazon, Facebook, and Apple, all of whom…

Cloud And The Military – In The US

Cloud And The Military – In The US

Cloud And The Military Scandalous cost overruns; the newest high tech doesn’t work any better than very old tech; sweetheart monopoly deals with favorite defense contractors; sole sourcing key components from our enemies – the litany just goes on and on. The military’s relationship with technology always seems to be like watching a slow motion…

Digital Transformation: Not Just For Large Enterprises Anymore

Digital Transformation: Not Just For Large Enterprises Anymore

Digital Transformation Digital transformation is the acceleration of business activities, processes, and operational models to fully embrace the changes and opportunities of digital technologies. The concept is not new; we’ve been talking about it in one way or another for decades: paperless office, BYOD, user experience, consumerization of IT – all of these were stepping…

Protecting Devices From Data Breach: Identity of Things (IDoT)

Protecting Devices From Data Breach: Identity of Things (IDoT)

How to Identify and Authenticate in the Expanding IoT Ecosystem It is a necessity to protect IoT devices and their associated data. As the IoT ecosystem continues to expand, the need to create an identity to newly-connected things is becoming increasingly crucial. These ‘things’ can include anything from basic sensors and gateways to industrial controls…

The Industries That The Cloud Will Change The Most

The Industries That The Cloud Will Change The Most

The Industries That The Cloud Will Change The Most Cloud computing is rapidly revolutionizing the way we do business. Instead of being a blurry buzzword, it has become a facet of everyday life. Most people may not quite understand how the cloud works, but electricity is quite difficult to fathom as well. Anyway, regardless of…

Cloud Infographic – Guide To Small Business Cloud Computing

Cloud Infographic – Guide To Small Business Cloud Computing

Small Business Cloud Computing Trepidation is inherently attached to anything that involves change and especially if it involves new technologies. SMBs are incredibly vulnerable to this fear and rightfully so. The wrong security breach can incapacitate a small startup for good whereas larger enterprises can reboot their operations due to the financial stability of shareholders. Gordon Tan contributed an…

Cost of the Cloud: Is It Really Worth It?

Cost of the Cloud: Is It Really Worth It?

Cost of the Cloud Cloud computing is more than just another storage tier. Imagine if you’re able to scale up 10x just to handle seasonal volumes or rely on a true disaster-recovery solution without upfront capital. Although the pay-as-you-go pricing model of cloud computing makes it a noticeable expense, it’s the only solution for many…

Why Small Businesses Need A Business Intelligence Dashboard

Why Small Businesses Need A Business Intelligence Dashboard

The Business Intelligence Dashboard As a small business owner you would certainly know the importance of collecting and analyzing data pertaining to your business and transactions. Business Intelligence dashboards allow not only experts but you also to access information generated by analysis of data through a convenient display. Anyone in the company can have access…

Cloud Computing Offers Key Benefits For Small, Medium Businesses

Cloud Computing Offers Key Benefits For Small, Medium Businesses

Cloud Computing Benefits A growing number of small and medium businesses in the United States rely on as a means of deploying mission-critical software products. Prior to the advent of cloud-based products — software solutions delivered over the Internet – companies were often forced to invest in servers and other products to run software and…

Cloud Infographic – Big Data Predictions By 2023

Cloud Infographic – Big Data Predictions By 2023

Big Data Predictions By 2023 Everything we do online from social networking to e-commerce purchases, chatting, and even simple browsing yields tons of data that certain organizations collect and poll together with other partner organizations. The results are massive volumes of data, hence the name “Big Data”. This includes personal and behavioral profiles that are stored, managed, and…