Critical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks
summary
Covers concrete SaaS attack patterns and detections: Salesforce and Clue breaches via OAUTH tokens abused to pull CRM tables, Snowflake exfiltration from dev laptops exposing unencrypted creds that hit ~165 confirmed victims, and npm ecosystem backdoors where initial scans find 4,400 malicious packages and an automated pipeline alerts impacted customers. Shows which log tiers actually contain IPs, user agents (example code 5238), what queries detect spikes, and that proactive scanning and hunts stop many incidents.
AI-written summary · about
chapters (9)
- 0:00SaaS security blind spots
- 1:47SaaS attack trends
- 5:15Importance of SaaS audit logs
- 15:10Salesforce intrusion via third-party app
- 22:37Snowflake credentials theft
- 26:30Threat modeling for SaaS apps
- 32:33Normalizing SaaS log data
- 36:28Improving SaaS security posture
- 41:22Q&A
related talks
29mMapping the SaaS Attack Surface
48mTwo Steps Forward for SaaS Adoption, One Step Back for Security
45mAnticipate and Defend Against Advanced Adversaries Targeting SaaS and IaaS
47mPain in the Apps — Three Attack Scenarios Attackers Are Using to PWN SaaS
40mBlind Spots: Two Cloud Threats You Didn’t Even Know You Had
34mHe Builds a SaaS Solution Without Caring About Security...
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
46mApplication security from start to finish