Identity And Access Management From The SaaS Application Perspective

Identity And Access Management From The SaaS Application Perspective

The SaaS Application Perspective

Software-as-a-Service (SaaS) has taken the enterprise by storm as the go-to delivery model for applications, and the cloud service is here to stay…for better or worse. Enterprises look to its benefits including dramatic cost savings, app availability from anywhere, and seamless updates and upgrades pushed to users from the SaaS provider.

There’s certainly no trepidation surrounding the benefits that the cloud rains down on enterprises, but what makes CISOs uneasy about SaaS delivery of apps is the lack of control and visibility into who has access to them while floating around in the cloud. Enterprises can obviously call the shots when data and apps are stored on-premise, but the fear of data breaches is amped up when applications and data, and who controls the access to them, is out of the hands of the enterprise and in the hands of the SaaS provider.

So what should a SaaS application developer or provider do so enterprises can govern their identity and access issues effectively? There are three key Identity and Access Management (IAM) areas that deserve close attention.

Authentication

SaaS apps can take several routes for authenticating users. The first is independent authentication with a private user directory and independent user account management. This is a poor choice because it forces the SaaS application to manage passwords and forces users to remember separate credentials for the SaaS app.  In addition, from an enterprise perspective, supporting joiners, movers and leavers (who’s moving in and out of your organization) here becomes difficult.

A variant of the independent option is internal authentication with a private user directory synched to an external user repository, usually Active Directory. While this approach may seem to be fine for a single application, as the number of applications scales, IT administrators have trouble managing the synching, and the risk of a breach goes up significantly when credentials are transmitted outside the perimeter.

The ideal authentication setup for a SaaS app is token-based authentication and SSO based on directory federation. SAML (Secure Access Markup Language) tokens issued by corporate identity providers fit the bill perfectly. Why? A single corporate username and password enables access across multiple SaaS applications. The process is intelligent, too, because user attributes relevant to authorization can be delivered in the token, and “just-in-time” provisioning (automated account setup for a first-visit user) can be supported.  While this approach requires the management of trust relationships between individual enterprises and the SaaS application in question, and at least basic user account management, the headaches of syncing and having hundreds of passwords are off the table here.

Entitlements

So your users have been authenticated to your SaaS apps. That’s the easy part, but effective management of entitlements – what your users can do within those apps at a fine-grained, nitty-gritty level, is far more difficult.

Most SaaS applications come with their own entitlement model, with internal administration of entitlement policies and an application-specific user interface for defining who gets what entitlements within the application. From an application developer’s perspective, this approach seems convenient, but in reality, it provides poor support for enterprise identity and access lifecycle management and compliance.  Setting up joiners and movers or de-provisioning leavers requires manual intervention, and tracking “who has access to what” often means the creation of application-specific reports.

The best option here is for SaaS applications to support an entitlement model that includes pre-defined application roles, and an API that supports the collection of current user-role and user-entitlement bindings as well as the provisioning or de-provisioning of user-to-role and user-to-entitlement bindings.  With this approach, administering user-to-role policies is done by each enterprise outside of the SaaS application, while the runtime authorization enforcement based on provisioned user bindings or user attributes is done within the SaaS application. Leaving policy administration out of the application and up to the enterprise makes change management and compliance much easier.

The benefit of having application roles is that it’s far easier to track and change user access to SaaS apps when each application’s access can be described in terms of tens of application roles and a few out-of-role entitlements, versus  thousands of entitlements.

It’s likely that a standards-based protocol will emerge someday for the API referenced above, but SPML (Secure Provisioning Markup Language) fell short, and SCIM (Simple Cloud Identity Management), while useful for account and user profile provisioning, doesn’t help with entitlements.

Auditing

Your users have been authenticated and can wield the power they’ve been given by individual application roles and entitlements within SaaS applications. But are you taking notes on every move they make within your organization? Probably not!  Automated logging of user activity for each SaaS app is crucial to both the audit trail needed when the auditor comes knocking and the real-time alerting required by enterprise SOCs (security operations centers). If a subset of the application roles and entitlements for a SaaS app is considered sensitive or privileged, it is up to the SaaS application developer and provider to ensure that the use of this privileged access can be closely and continuously scrutinized.

It is important to note that mobile and cloud computing is causing the Identity and Access Management industry to adopt new models and consider new standards.  OpenID Connect and OAuth, for example, are very promising standards, but SaaS applications targeted for broad-based enterprise use can’t rely exclusively on them today.

While SaaS applications, being outside the perimeter, aren’t inherently ideal for meeting enterprise identity and access lifecycle management and compliance initiatives, SaaS app developers and providers should look to these areas as the first action items when rolling out cloud-based applications across the enterprise.

By Deepak Taneja,

Contributor Deepak Taneja is Founder and CTO of Aveksa, provider of the industry’s most comprehensive Business-Driven Identity and Access Management platform.  By uniquely integrating Identity and Access Governance, Provisioning and Authentication, Aveksa enables enterprises to manage the complete lifecycle of user access for SaaS and On-premise applications and data.  Learn more at www.aveksa.com.

About CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as offer green/cleantech learning and consultive services around the world.

Our vision is to create awareness and to help find innovative ways to connect our planet in a positive eco-friendly manner.

In the meantime, you may connect with CloudTweaks by following and sharing our resources.

View All Articles

Sorry, comments are closed for this post.

Your Biggest Data Security Threat Could Be….

Your Biggest Data Security Threat Could Be….

Paying Attention To Data Security Your biggest data security threat could be sitting next to you… Data security is a big concern for businesses. The repercussions of a data security breach ranges from embarrassment, to costly lawsuits and clean-up jobs – particularly when confidential client information is involved. But although more and more businesses are…

Cloud-Based Services vs. On-Premises: It’s About More Than Just Dollars

Cloud-Based Services vs. On-Premises: It’s About More Than Just Dollars

Cloud-Based Services vs. On-Premises The surface costs might give you pause, but the cost of diminishing your differentiators is far greater. Will a shift to the cloud save you money? Potential savings are historically the main business driver cited when companies move to the cloud, but it shouldn’t be viewed as a cost-saving exercise. There…

Disaster Recovery – A Thing Of The Past!

Disaster Recovery – A Thing Of The Past!

Disaster Recovery  Ok, ok – I understand most of you are saying disaster recovery (DR) is still a critical aspect of running any type of operations. After all – we need to secure our future operations in case of disaster. Sure – that is still the case but things are changing – fast. There are…

The Security Gap: What Is Your Core Strength?

The Security Gap: What Is Your Core Strength?

The Security Gap You’re out of your mind if you think blocking access to file sharing services is filling a security gap. You’re out of your mind if you think making people jump through hoops like Citrix and VPNs to get at content is secure. You’re out of your mind if you think putting your…

Cloud Services Providers – Learning To Keep The Lights On

Cloud Services Providers – Learning To Keep The Lights On

The True Meaning of Availability What is real availability? In our line of work, cloud service providers approach availability from the inside out. And in many cases, some never make it past their own front door given how challenging it is to keep the lights on at home let alone factors that are out of…

Using Private Cloud Architecture For Multi-Tier Applications

Using Private Cloud Architecture For Multi-Tier Applications

Cloud Architecture These days, Multi-Tier Applications are the norm. From SharePoint’s front-end/back-end configuration, to LAMP-based websites using multiple servers to handle different functions, a multitude of apps require public and private-facing components to work in tandem. Placing these apps in entirely public-facing platforms and networks simplifies the process, but at the cost of security vulnerabilities. Locating everything…

Why Security Practitioners Need To Apply The 80-20 Rules To Data Security

Why Security Practitioners Need To Apply The 80-20 Rules To Data Security

The 80-20 Rule For Security Practitioners  Everyday we learn about yet another egregious data security breach, exposure of customer data or misuse of data. It begs the question why in this 21st century, as a security industry we cannot seem to secure our most valuable data assets when technology has surpassed our expectations in other regards.…

Connecting With Customers In The Cloud

Connecting With Customers In The Cloud

Customers in the Cloud Global enterprises in every industry are increasingly turning to cloud-based innovators like Salesforce, ServiceNow, WorkDay and Aria, to handle critical systems like billing, IT services, HCM and CRM. One need look no further than Salesforce’s and Amazon’s most recent earnings report, to see this indeed is not a passing fad, but…

Virtual Immersion And The Extension/Expansion Of Virtual Reality

Virtual Immersion And The Extension/Expansion Of Virtual Reality

Virtual Immersion And Virtual Reality This is a term I created (Virtual Immersion). Ah…the sweet smell of Virtual Immersion Success! Virtual Immersion© (VI) an extension/expansion of Virtual Reality to include the senses beyond visual and auditory. Years ago there was a television commercial for a bathing product called Calgon. The tagline of the commercial was Calgon…