Questions tagged [saas]

Software as a service (SaaS) is a licensing model where software is sold as a cloud service.

Filter by
Sorted by
Tagged with
2
votes
0answers
51 views

Patch management for production servers

I'm trying to implement an automated patching program at a small SaaS provider. When a customer signs up for our software, we provision them a Linux VM in our primary datacenter. Each customer also ...
2
votes
1answer
30 views

Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?

Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
2
votes
2answers
66 views

TCP Traffic, SSL or extra Tunnel

I have a situation where we (as a SaaS vendor) are migrating one of our clients away from their local premise to our public SaaS. However as a security concern they want to route all their TCP ...
4
votes
4answers
462 views

Public API security: authentication vs. rate limiting etc

We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
1
vote
0answers
18 views

Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?

SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand" are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
1
vote
2answers
183 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
1
vote
1answer
461 views

do we need VPN for SaaS cloud applications?

If we need to connect to the corporate network from home, we need to have the VPN connection. However, what if for accessing SaaS applications like Google Doc, Salesforce, etc, do we need still need ...
0
votes
1answer
234 views

PCI compliance of a SaaS provider

We (merchant) will be using a SaaS to sell learning modules and accept credit card payments through a redirect to a service provider that will process the credit card payments. The SaaS will be hosted ...
1
vote
1answer
59 views

How can I make sure that my Python code cannot be accessed by the user of my web app?

I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following: def add(n1, n2): return n1 + n2 I'd ...
1
vote
0answers
68 views

Responsibility of Malware infection in SaaS contracts [closed]

We are a SaaS company and I have been asked to review the 'Security' section of the contract proposed by one of our potential clients. I would like to know whether the following two statements are ...
5
votes
2answers
544 views

How to manage customer-supplied encryption keys in a multi-tenant cloud SaaS?

I'm working at an EU-based company and we'd like to offer business customers some kind of OS-independent cloud-based SaaS platform for processing and storing sensitive (health) data. We'd like to ...
4
votes
2answers
191 views

How much information about our Security & Penetration Testing should we share with customers?

We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
3
votes
1answer
333 views

Can password based SSO be trivially compromised?

Many cloud SSO providers now offer "password based SSO" (e.g. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis ), where, even if the SaaS you want to log in ...
3
votes
1answer
347 views

Is PCI necessary as a SaaS provider when payments handled on third party site?

We've been asked by one of our clients to complete a SAQ-D. Even though PCI is not a law, we don't want to attest to something that shouldn't apply to us in the first place. We're not sure ...
2
votes
1answer
58 views

Is there any way to verify that an organization operating an open-source SaaS is using an untampered-with version of the software?

Some organizations have begun offering access to servers running open-source software (mail servers, chat servers), operated and maintained by those organizations, for a nominal recurring upkeep fee. ...
5
votes
1answer
16k views

How secure is Slack for sensitive information compared to other alternatives like Mattermost? [duplicate]

Our company is contemplating the benefits of switching from Slack to Mattermost. One of the arguments is that the 'sensitive information should be more secure because it is stored on our servers'. ...
4
votes
1answer
2k views

Azure AD B2C vs Auth0 [closed]

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison?...
2
votes
2answers
569 views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
0
votes
3answers
467 views

What are some metrics to be used to evaluate SaaS security?

What are some metrics to be used to evaluate a SaaS app's security? Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it ...