Addressing SaaS Security

Transcription

1 White Paper Addressig SaaS Security by Padma Krisha O V E R C O M I N G L I M I T S

2 This paper ide fies some of the best prac ces ad desig priciples followed by Triget i developig SaaS applica os to address iheret security challeges. Security co ues to be oe of the biggest cocers for a SaaS based offerig. I this paper we will examie three areas of possible iforma o leakage which are: Saas Vedors SaaS Hos g Providers Co-teats of the SaaS Applica os deployed o the same Image Iforma o leakage mechaisms i these areas are: Iforma o security with the SaaS vedor ad SaaS Hos g Providers. How ca uauthorized access to teat data be preveted? What precau os ad preve o prac ces ca be used for protec o agaist other coteats of the same applica o ge applica o errors? g accidetal access to each others data due to SaaS solu o providers eed to provide a appropriate security solu o model that would help their customers feel cofidet about their data security, ad that these are uderstood ad addressed with the best prac ces available i the market today. Therefore, this paper will describe geeral desig priciples that ca be used to best mi gate the data security cocers as applied to SaaS applica os. Triget So ware Ic. 2 Willow Street, Suite 201, Southborough, MA All trademarks, marked ad umarked, are the property of their respec ve owers. 2

3 Security Priciples While there seems to be o silver bullet for solvig all the security eeds of complex eterprise grade SaaS applica os, they require a well thought out iterplay of both security architecture ad security techiques. Whe Triget develops eterprise grade applica os, we follow a Defese i Depth priciple. I short, the Defese i Depth priciple prescribes buildig mul ple complemetary defese levels across the key layers of a applica o, such as: UI, Busiess ad Data base. I addi o, we complimet this architecture with a wide rage of best prac ce security techiques icludig physical security access, firewalls, appropriate etwork access, SSL cer ficates, two factor authe ca o, OpeID, etc. It is importat to employ the best security techiques at appropriate levels. Whe doe carefully ad though ully it will be extremely difficult to compromise your sesi ve data either accidetally or o purpose. I the followig sec os we describe desig priciples used by Triget i developmet of SaaS applica os. Data Security ad Ecryptio Data Segrega o The most importat priciple i a SaaS applica o is that of data segrega o which esures that each Teat s data is properly segregated ad that o teat is able to access aother teat s data. This is achieved by developig a filterig layer betwee the teat ad the data source so that data access via the filterig layer returs oly the selected teat s data. This is doe by eforcig a cotext based coec o to the database, thus esurig that oly authorized data is retured. Such security blocks are implemeted at commo access poits i the database layer ad i the busiess layer esurig that a teat s data is always properly segregated. Data Ecryp o Aother ecessary ii a ve is ecryp g selected sesi ve database fields such as SSN, bak accout details etc. This is to prevet users like admiistrators who have access to the database from viewig this sesi ve iforma o. We typically ecrypt these fields by usig a combia o of keys or a key ad a exteral radom sequece of bits (called a salt ) which is used to further obscure the ecrypted data. A commoly used scheme calls for oe part of the key for decryp g the sesi ve field to be programmed ito the applica o itself, thus makig it almost impossible for say, a database admiistrator to compromise the data. This esures that data ca be decrypted oly by a authorized user ruig the very applica o itself ad ot by a database user who gets access to the database otherwise. Database Ecryptio Microso SQL Server 2008 provides TDE (Trasparet Data Ecryp o) fuc oality which does ecryp o of the uderlyig data files of the database. Therefore if oly the data files get compromised, it is ot possible for the itruder to restore the database ad access sesi ve data. TDE therefore provides the ability to comply with may laws, regula os ad guidelies established i various idustries. For more iforma o o TDE, please refer h p://msd.microso.com/e-us/library/bb aspx. Triget So ware Ic. 2 Willow Street, Suite 201, Southborough, MA All trademarks, marked ad umarked, are the property of their respec ve owers. 3

4 Dual Validatio o Cliet Side ad Server Side Applica os makig use of JavaScript to perform certai valida os are vulerable to security issues as scripts ca be ijected to chage the behavior of the applica o. While JavaScript is highly preferred for quicker UI respose mes, they do pose a security risk. Such vulerabili es should be assessed ad aother valida o should be performed o the server side to esure the correctess of the data. Obfuscatio of Code Assemblies Obfusca o usig prove techiques is recommeded for developmet i eviromets such as Microso.Net applica os. This is ecessary so the code assemblies may ot be otherwise be reverse egieered thus providig isight ito how the applica o s security works. This also has the addi oal beefit of protec g the SaaS vedor s IP. A example of such a obfuscator tool is PreEmp ve Do uscator for the Microso.Net pla orm should be assessed ad aother valida o should be performed o the server side to esure the correctess of the data. Coclusios New security threats evolve, as SaaS model matures. These prac ces will also ecessarily evolve or chage to keep pace with such eeds. The above methods are some of the recet prac ces we have established for developig SaaS applica os. It is also importat to stadardize o may of these prac ces usig reusable libraries or compoets to speed up such implemeta os ad get reliable, repeatable performace. Triget So ware Ic. 2 Willow Street, Suite 201, Southborough, MA All trademarks, marked ad umarked, are the property of their respec ve owers. 4

5 About Triget Triget is a CMM Level-4 techology solu os compay with its US office at Southborough, MA, ad Idia office at Bagalore. Triget provides comprehesive solu os for busiess problems via outsourced so ware product ad applica os desig, developmet ad quality assurace. Triget serves customers like Idepedet So ware Vedors (ISVs), eterprises ad SMBs i the High Tech, Healthcare, Educa o, Ecommerce ad Maufacturig areas. Triget's solu os help cliets overcome budget, schedule ad resource costraits. To lear more about Triget visit Our Headquarters Triget So ware Ic. 2 Willow Street, Suite #201 Southborough, MA (877) sales@triget.com Other Loca o Triget So ware Ltd. Khaija Bhava, 1st Floor #49, West Wig, Race Course Road Bagalore , Idia +91 (80) O V E R C O M I N G L I M I T S