Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/23/2021
10:00 AM
Viral Trivedi
Viral Trivedi
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

SOC 2 Attestation Tips for SaaS Companies

Attestation helps SaaS vendors demonstrate that digital security is a primary focus.

Companies are increasingly turning to software-as-a-service (SaaS); IDG predicts that organizations' share of SaaS apps will rise to 36% by the end of 2021, up from 24% in mid-2020.

This growth reflects the advantages organizations see in SaaS. For example, businesses can use SaaS to achieve faster deployment times than they can with on-premises software. In addition, SaaS solutions can run with a Web browser on any type of device, and operational management is minimal. There are no lengthy installation processes or equipment updates. There aren't even upfront hardware costs; organizations can use pay-as-you-go plans to scale their SaaS solutions, including investments in security technology and expertise.

Related Content:

Reducing the Risk of Third-Party SaaS Apps to Your Organization

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: The CISO Life Is Half as Good

Many employees are using the cloud to access business applications remotely, and organizations want to make sure their data remains safe in the process. A 2020 survey found that 52% of companies were using cloud services that had experienced a breach involving user data. The last thing businesses want is to work with a cloud service provider with a record of user data stolen in a breach.

This raises an important question: How can SaaS vendors demonstrate proof of their commitment to taking their customers' data security seriously?

SOC 2: An Overview
One way SaaS vendors can demonstrate this is by achieving attestation with SOC 2. According to the Association of International Certified Professional Accountants (AICPA), SOC 2 is a means for SaaS vendors and other organizations to obtain reports that provide detailed information and assurance about the systems they use to process users' data. It does so by using criteria from five categories:

  • Security: This attests that an organization's systems are protected against instances of unauthorized access and unauthorized information disclosure. It also serves as proof that organizations have taken steps to protect their systems against damage that could compromise the availability, integrity, confidentiality, and privacy of their stored information along with systems that play an essential part in meeting their objectives.
  • Availability: This confirms that attested organizations' information and systems are available as a means of meeting their respective objectives.
  • Processing integrity: This validates that an organization's system-processing capabilities are complete and accurate.
  • Confidentiality: This demonstrates that organizations keep their confidential information protected so that it doesn't end up in the wrong hands and prevent them from reaching their business goals.
  • Privacy: This shows an attested organization's lifecycle for managing personal information, including processes for properly retaining, disclosing, and disposing of information.

SOC 2 attestation helps SaaS vendors demonstrate that digital security is a primary focus. Many large organizations require vendors to provide a SOC 2 report and submit an SOC 2 attestation audit annually.

But the security impact of SOC 2 is even broader than that. For example, SaaS vendors must minimize the risk of a data breach to obtain a clean report. This requires vendors to implement foundational security controls such as multifactor authentication (MFA) and incorporate security into every business process (including DevOps). These efforts help SaaS organizations strengthen their systems' security and make them more valuable to potential customers of all sizes.

Where This Leaves SaaS Vendors
Given the benefits of SOC 2 attestation, SaaS companies need to take the appropriate steps to make attestation flow as smoothly as possible. One of the first things they need to do is consider attestation early so that they can create a strategy for implementing security controls and investing in their security awareness training program. This proactive approach will help them foster security by design without wasting time and resources.

Up next is to tailor their security plans, budgets, and schedules for SOC 2. Related to this, they need to foster cross-department dialogue by asking IT personnel to engage other segments of the organization using non-technical language. What's needed is a business language that highlights the importance of security companywide and emphasizes how each employee is individually responsible for contributing to and shaping the employer's overall level of security.

Viral Trivedi is the Chief Business Officer at Ampcus Cyber Inc—a pure-play cybersecurity service company headquartered in Chantilly, Virginia. As a CBO at Ampcus Cyber, Viral leads many customer-facing initiatives, including market strategy, channel partner programs, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26543
PUBLISHED: 2021-05-06
The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
CVE-2021-27216
PUBLISHED: 2021-05-06
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
CVE-2021-29490
PUBLISHED: 2021-05-06
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and ex...
CVE-2021-29491
PUBLISHED: 2021-05-06
Mixme is a library for recursive merging of Javascript objects. In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the ava...
CVE-2021-29921
PUBLISHED: 2021-05-06
Improper input validation of octal strings in Python stdlib ipaddress 3.10 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on Python stdlib ipaddress. IP address octects are left stripped instead of evaluated as valid I...