Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

// // //
4/23/2021
10:00 AM
Viral Trivedi
Viral Trivedi
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv

SOC 2 Attestation Tips for SaaS Companies

Attestation helps SaaS vendors demonstrate that digital security is a primary focus.

Companies are increasingly turning to software-as-a-service (SaaS); IDG predicts that organizations' share of SaaS apps will rise to 36% by the end of 2021, up from 24% in mid-2020.

This growth reflects the advantages organizations see in SaaS. For example, businesses can use SaaS to achieve faster deployment times than they can with on-premises software. In addition, SaaS solutions can run with a Web browser on any type of device, and operational management is minimal. There are no lengthy installation processes or equipment updates. There aren't even upfront hardware costs; organizations can use pay-as-you-go plans to scale their SaaS solutions, including investments in security technology and expertise.

Related Content:

Reducing the Risk of Third-Party SaaS Apps to Your Organization

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: The CISO Life Is Half as Good

Many employees are using the cloud to access business applications remotely, and organizations want to make sure their data remains safe in the process. A 2020 survey found that 52% of companies were using cloud services that had experienced a breach involving user data. The last thing businesses want is to work with a cloud service provider with a record of user data stolen in a breach.

This raises an important question: How can SaaS vendors demonstrate proof of their commitment to taking their customers' data security seriously?

SOC 2: An Overview
One way SaaS vendors can demonstrate this is by achieving attestation with SOC 2. According to the Association of International Certified Professional Accountants (AICPA), SOC 2 is a means for SaaS vendors and other organizations to obtain reports that provide detailed information and assurance about the systems they use to process users' data. It does so by using criteria from five categories:

  • Security: This attests that an organization's systems are protected against instances of unauthorized access and unauthorized information disclosure. It also serves as proof that organizations have taken steps to protect their systems against damage that could compromise the availability, integrity, confidentiality, and privacy of their stored information along with systems that play an essential part in meeting their objectives.
  • Availability: This confirms that attested organizations' information and systems are available as a means of meeting their respective objectives.
  • Processing integrity: This validates that an organization's system-processing capabilities are complete and accurate.
  • Confidentiality: This demonstrates that organizations keep their confidential information protected so that it doesn't end up in the wrong hands and prevent them from reaching their business goals.
  • Privacy: This shows an attested organization's lifecycle for managing personal information, including processes for properly retaining, disclosing, and disposing of information.

SOC 2 attestation helps SaaS vendors demonstrate that digital security is a primary focus. Many large organizations require vendors to provide a SOC 2 report and submit an SOC 2 attestation audit annually.

But the security impact of SOC 2 is even broader than that. For example, SaaS vendors must minimize the risk of a data breach to obtain a clean report. This requires vendors to implement foundational security controls such as multifactor authentication (MFA) and incorporate security into every business process (including DevOps). These efforts help SaaS organizations strengthen their systems' security and make them more valuable to potential customers of all sizes.

Where This Leaves SaaS Vendors
Given the benefits of SOC 2 attestation, SaaS companies need to take the appropriate steps to make attestation flow as smoothly as possible. One of the first things they need to do is consider attestation early so that they can create a strategy for implementing security controls and investing in their security awareness training program. This proactive approach will help them foster security by design without wasting time and resources.

Up next is to tailor their security plans, budgets, and schedules for SOC 2. Related to this, they need to foster cross-department dialogue by asking IT personnel to engage other segments of the organization using non-technical language. What's needed is a business language that highlights the importance of security companywide and emphasizes how each employee is individually responsible for contributing to and shaping the employer's overall level of security.

Viral Trivedi is the Chief Business Officer at Ampcus Cyber Inc—a pure-play cybersecurity service company headquartered in Chantilly, Virginia. As a CBO at Ampcus Cyber, Viral leads many customer-facing initiatives, including market strategy, channel partner programs, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-42247
PUBLISHED: 2022-10-03
pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name.
CVE-2022-41443
PUBLISHED: 2022-10-03
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
CVE-2022-33882
PUBLISHED: 2022-10-03
Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code.
CVE-2022-42306
PUBLISHED: 2022-10-03
An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process.
CVE-2022-42307
PUBLISHED: 2022-10-03
An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.