Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/23/2021
10:00 AM
Viral Trivedi
Viral Trivedi
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

SOC 2 Attestation Tips for SaaS Companies

Attestation helps SaaS vendors demonstrate that digital security is a primary focus.

Companies are increasingly turning to software-as-a-service (SaaS); IDG predicts that organizations' share of SaaS apps will rise to 36% by the end of 2021, up from 24% in mid-2020.

This growth reflects the advantages organizations see in SaaS. For example, businesses can use SaaS to achieve faster deployment times than they can with on-premises software. In addition, SaaS solutions can run with a Web browser on any type of device, and operational management is minimal. There are no lengthy installation processes or equipment updates. There aren't even upfront hardware costs; organizations can use pay-as-you-go plans to scale their SaaS solutions, including investments in security technology and expertise.

Related Content:

Reducing the Risk of Third-Party SaaS Apps to Your Organization

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: The CISO Life Is Half as Good

Many employees are using the cloud to access business applications remotely, and organizations want to make sure their data remains safe in the process. A 2020 survey found that 52% of companies were using cloud services that had experienced a breach involving user data. The last thing businesses want is to work with a cloud service provider with a record of user data stolen in a breach.

This raises an important question: How can SaaS vendors demonstrate proof of their commitment to taking their customers' data security seriously?

SOC 2: An Overview
One way SaaS vendors can demonstrate this is by achieving attestation with SOC 2. According to the Association of International Certified Professional Accountants (AICPA), SOC 2 is a means for SaaS vendors and other organizations to obtain reports that provide detailed information and assurance about the systems they use to process users' data. It does so by using criteria from five categories:

  • Security: This attests that an organization's systems are protected against instances of unauthorized access and unauthorized information disclosure. It also serves as proof that organizations have taken steps to protect their systems against damage that could compromise the availability, integrity, confidentiality, and privacy of their stored information along with systems that play an essential part in meeting their objectives.
  • Availability: This confirms that attested organizations' information and systems are available as a means of meeting their respective objectives.
  • Processing integrity: This validates that an organization's system-processing capabilities are complete and accurate.
  • Confidentiality: This demonstrates that organizations keep their confidential information protected so that it doesn't end up in the wrong hands and prevent them from reaching their business goals.
  • Privacy: This shows an attested organization's lifecycle for managing personal information, including processes for properly retaining, disclosing, and disposing of information.

SOC 2 attestation helps SaaS vendors demonstrate that digital security is a primary focus. Many large organizations require vendors to provide a SOC 2 report and submit an SOC 2 attestation audit annually.

But the security impact of SOC 2 is even broader than that. For example, SaaS vendors must minimize the risk of a data breach to obtain a clean report. This requires vendors to implement foundational security controls such as multifactor authentication (MFA) and incorporate security into every business process (including DevOps). These efforts help SaaS organizations strengthen their systems' security and make them more valuable to potential customers of all sizes.

Where This Leaves SaaS Vendors
Given the benefits of SOC 2 attestation, SaaS companies need to take the appropriate steps to make attestation flow as smoothly as possible. One of the first things they need to do is consider attestation early so that they can create a strategy for implementing security controls and investing in their security awareness training program. This proactive approach will help them foster security by design without wasting time and resources.

Up next is to tailor their security plans, budgets, and schedules for SOC 2. Related to this, they need to foster cross-department dialogue by asking IT personnel to engage other segments of the organization using non-technical language. What's needed is a business language that highlights the importance of security companywide and emphasizes how each employee is individually responsible for contributing to and shaping the employer's overall level of security.

Viral Trivedi is the Chief Business Officer at Ampcus Cyber Inc—a pure-play cybersecurity service company headquartered in Chantilly, Virginia. As a CBO at Ampcus Cyber, Viral leads many customer-facing initiatives, including market strategy, channel partner programs, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-22352
PUBLISHED: 2021-08-04
The gf_dash_segmenter_probe_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CVE-2020-24829
PUBLISHED: 2021-08-04
An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file.
CVE-2021-38114
PUBLISHED: 2021-08-04
libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.
CVE-2021-38115
PUBLISHED: 2021-08-04
read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
CVE-2021-20028
PUBLISHED: 2021-08-04
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier.