Questions tagged [saas]
Software as a service (SaaS) is a licensing model where software is sold as a cloud service.
26
questions
0
votes
0
answers
13
views
Does phone number SMS verification prevent spam / malicious bulk site registration? [duplicate]
I own a fintech SaaS app which has been running successfully for a couple years without much spam or malicious activity. Recently, however, there has been an uptick in maliciously created accounts ...
- 101
0
votes
1
answer
74
views
Does splitting auth SSO and MFA parts, between client and service companies have any issues?
My company provides a single SaaS product for corporate clients.
For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
- 51
0
votes
0
answers
188
views
Best way to encrypt client side data for SaaS inside the web
I am planning a SaaS-solution, where my clients store and save sensitive data on my servers.
Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
1
vote
2
answers
326
views
How to make SaaS application accessible only on intranet?
We are a SaaS-based product but one of the client requirement is to make our application accessible only on their intranet. Is that even possible?
- 153
0
votes
2
answers
104
views
allowing users to add custom html/js code and show it only under another domain
I have a web app where I allow users to create a one-page portfolio using drag and drop, also I allow them to add custom HTML freely (basically any html or js code)
I'm aware that I shouldn't allow ...
- 129
0
votes
1
answer
332
views
Is it possible to use Kerberos for SSO in a SaaS application?
If I have a webapplication in my internal Microsoft Windows network I'm aware that I can use the kerberos protocol to make a Single Sign on (SSO) into this application with the web browser.
Is it a ...
- 103
3
votes
1
answer
358
views
ISO 27001 compliance for application or hosting?
I received a question as follows: Does the vendor solution need to have the ISO 27001 certification for the application itself, or just for the hosting of the platform?
In my understanding, ISO 27001 ...
- 39
2
votes
0
answers
157
views
Patch management for production servers
I'm trying to implement an automated patching program at a small SaaS provider.
When a customer signs up for our software, we provision them a Linux VM in our primary datacenter.
Each customer also ...
- 17
4
votes
1
answer
181
views
Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?
Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
- 43
2
votes
2
answers
155
views
TCP Traffic, SSL or extra Tunnel
I have a situation where we (as a SaaS vendor) are migrating one of our clients away from their local premise to our public SaaS.
However as a security concern they want to route all their TCP ...
- 23
5
votes
4
answers
886
views
Public API security: authentication vs. rate limiting etc
We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
- 718
1
vote
0
answers
60
views
Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?
SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand"
are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
2
votes
2
answers
362
views
What to do about vulnerability in a SaaS product I buy?
I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems.
Two months ago, I ...
1
vote
1
answer
2k
views
do we need VPN for SaaS cloud applications?
If we need to connect to the corporate network from home, we need to have the VPN connection. However, what if for accessing SaaS applications like Google Doc, Salesforce, etc, do we need still need ...
- 11
0
votes
1
answer
824
views
PCI compliance of a SaaS provider
We (merchant) will be using a SaaS to sell learning modules and accept credit card payments through a redirect to a service provider that will process the credit card payments. The SaaS will be hosted ...
1
vote
1
answer
119
views
How can I make sure that my Python code cannot be accessed by the user of my web app?
I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following:
def add(n1, n2):
return n1 + n2
I'd ...
- 1,349
1
vote
0
answers
131
views
Responsibility of Malware infection in SaaS contracts [closed]
We are a SaaS company and I have been asked to review the 'Security' section of the contract proposed by one of our potential clients. I would like to know whether the following two statements are ...
- 1,317
5
votes
2
answers
2k
views
How to manage customer-supplied encryption keys in a multi-tenant cloud SaaS?
I'm working at an EU-based company and we'd like to offer business customers some kind of OS-independent cloud-based SaaS platform for processing and storing sensitive (health) data. We'd like to ...
- 51
4
votes
2
answers
243
views
How much information about our Security & Penetration Testing should we share with customers?
We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
- 71
3
votes
1
answer
459
views
Can password based SSO be trivially compromised?
Many cloud SSO providers now offer "password based SSO" (e.g. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis ), where, even if the SaaS you want to log in ...
- 31
3
votes
1
answer
521
views
Is PCI necessary as a SaaS provider when payments handled on third party site?
We've been asked by one of our clients to complete a SAQ-D. Even though PCI is not a law, we don't want to attest to something that shouldn't apply to us in the first place.
We're not sure ...
2
votes
1
answer
98
views
Is there any way to verify that an organization operating an open-source SaaS is using an untampered-with version of the software?
Some organizations have begun offering access to servers running open-source software (mail servers, chat servers), operated and maintained by those organizations, for a nominal recurring upkeep fee.
...
- 1,240
5
votes
1
answer
16k
views
How secure is Slack for sensitive information compared to other alternatives like Mattermost? [duplicate]
Our company is contemplating the benefits of switching from Slack to Mattermost.
One of the arguments is that the 'sensitive information should be more secure because it is stored on our servers'.
...
- 169
5
votes
1
answer
3k
views
Azure AD B2C vs Auth0 [closed]
I am trying to work on security architecture for our SaaS application.
The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0.
Is this is correct comparison?...
- 51
3
votes
2
answers
1k
views
Is crossdomain policy file required by EVERY web application?
1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ?
2) If a web application does not host crossdomain / clientaccess policy file, is it ...
0
votes
3
answers
588
views
What are some metrics to be used to evaluate SaaS security?
What are some metrics to be used to evaluate a SaaS app's security?
Some examples:
static code analysis (Fortify)
code coverage (bugs being a potential source of vulnerabilities)
others?
In case it ...
- 334