2024年软件即服务（SaaS）安全状况报告_趋势_风险及应对措施洞察_18页_16mb

2024 SaaS Security Report Summary

Key Findings & Statistics

• SaaS Growth: Average of 490 SaaS apps per business, a 3.7% increase from 2023. Only 229 are officially authorized, leaving 261 shadow apps outside security oversight.
• Shadow SaaS: 25% of all SaaS usage is shadow SaaS, contributing to expanded attack surfaces.
• MFA Gap: 9.5% of user accounts (including admin accounts) lack Multi-Factor Authentication, posing risks to unauthorized access.
• Data Leak Risks: Critical misconfigurations found in 91% of Salesforce and 78.7% of Snowflake instances, increasing data exposure.
• GenAI Adoption: Average of 17 GenAI apps per company, up 30.7% from July, introducing new security challenges when integrated with third-party resources.

Recommended Countermeasures

1. Strengthen Governance:

   • Implement centralized SaaS management platforms and approval processes.
   • Deploy SaaS discovery tools to detect shadow apps and unauthorized usage.
   • Enforce Single Sign-On (SSO) and the principle of Least Privilege.

2. Secure Authentication:

   • Enforce MFA for all accounts, especially privileged ones.
   • Conduct regular audits of user access and account configurations.

3. Address Configuration Vulnerabilities:

   • Use SaaS Security Posture Management (SSPM) tools to monitor and fix misconfigurations (e.g., insecure file-sharing settings).
   • Enable Zero Trust policies to restrict access based on user context and behavior.

4. Manage GenAI Risks:

   • Develop clear policies for GenAI tool usage and integration.
   • Vet third-party vendors for security and compliance standards.

5. Leverage Automation:

   • Use automated workflows for rapid remediation of security issues.
   • Integrate with SIEM/SOAR solutions for real-time threat detection and response.

Actionable Insights

• Organizations must prioritize visibility into all SaaS environments to mitigate risks.
• Balancing innovation and security: Establish oversight for GenAI adoption to avoid unintended data leaks.
• Proactive monitoring and policy enforcement are critical amid accelerating SaaS sprawl and GenAI adoption.

Conclusion

The report emphasizes the need for robust SaaS governance, advanced monitoring, and a Zero Trust approach to address growing threats including shadow apps, misconfigurations, and GenAI integration risks.