Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently I have been approached by various SaaS (Software as a service) providers offering me different scenarios to deliver their solutions.

One in particular has my 50 employees accessing the software via a remote desktop connection 100% of the time. Keep in mind that the software is the main tool our employees will use 8 hours per day. It handles CRM (Customer Relationship Management), Operations, AR and even payroll...

What are the risks?

share|improve this question

2 Answers 2

With Remote Desktop, the application is not actually running on your computers, but on theirs. Your data is there. This implies a lot of things, including:

  • In case of loss of network connectivity, business stops.
  • If the SaaS provider ceases activity, you lose your tools and your data.
  • Any disaster (flood, fire...) affecting the server centre of the SaaS provider will impact you dearly.
  • All security decisions with regards to your information assets will be taken by the SaaS provider.
  • If you handle data classified as "personal information" then compliance to applicable regulations depends on what the SaaS provider does.
  • If your network connectivity is not top notch, especially with a low latency, then your 50 employees will hate the Remote Desktop immensely.

On the other hand:

  • Disaster on your site won't harm your data.
  • You might benefit from the infrastructures of the provider; e.g., the provider may offer an efficient and comprehensive backup solution for your data.
  • You may relocate more easily your premises, and employees may possibly telecommute.

Globally, going SaaS to that level is like marrying a polygamous man: you trust the provider exclusively with your business, but you know that the provider has some interests elsewhere as well.

share|improve this answer
    
Also unless the contract includes an explicit and free data liberation clause, you will have a form of vendor lock-in. –  LateralFractal Oct 4 '13 at 0:26

Pros:

  1. Cost savings - expense of installing, maintaining and upgrading on-premises can be solved.
  2. Scalability - As your business grows and you need to add more users, rather than investing in additional in-house server capacity and software licences you can adjust your monthly SaaS subscription as required.
  3. Accessibility- A browser and an internet connection is all that's usually required
  4. Upgrade-ability : You don't have to worry about hardware/software updates, your service provider takes care of it.
  5. Resilience : Ready back Up in case of any data loss due to unexpected harms.
  6. Security : Anti-malware scanning,Web filtering and monitoring,Firewalling/intrusion prevention,Secure remote access,Insider threat mitigation are taken care.

Cons:

  1. Security : The number-one concern for businesses considering SaaS is often security and privacy: if sensitive company data and business processes are to be entrusted to a third-party service provider, then issues such as identity and access management — particularly from mobile devices — need to be addressed.
  2. Compliance : When your business data resides in a service provider's datacenter, ensuring that you comply with the relevant government data-protection regulations can be a problem.
  3. Performance : A browser-based application hosted in a remote datacenter and accessed via an internet connection is likely to cause worries about performance when compared to software running on a local machine or over the company LAN.
  4. Even a small disruption in the internet connection is a guaranteed loss of production.
  5. You have no longer have direct access to control the versions of software/hardware used, the security of your data.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.