Can Saas Ever Be Secure?
summary
SaaS adoption accelerates and the real questions are concrete: who can access which data from where, how often a provider has had breaches, and whether contracts force timely notification (examples cited include 72 hour windows). Verification relies on artifacts not promises—ISO 27001 certificates, SOC 1/SOC 2 (SSAE16) reports, CSA STAR or Shared Assessments questionnaires, Safe Harbor/Privacy certifications. Look for always‑on auditing, encryption at rest and in transit, single‑code multi‑tenant designs, configurable controls, and contractual liability and incident response terms.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:48Trends
- 1:41KPMG Report
- 2:16Security Risks
- 4:13Outsourcing Business Processes
- 5:48International Transfers of Data
- 7:00Regulatory Compliance
- 12:07Audit Reports
- 16:11Benchmarking
- 17:11Sus Providers
- 22:23Changing Focus of IT
- 25:35Key Takeaways
- 27:37Summary
- 28:57Most important question
- 31:02Riskbased assessment
- 33:17Trust
- 36:40Multitenant SaaS
related talks
46mHow to Adapt to Security Changes in Cloud SaaS Transformation
48mTwo Steps Forward for SaaS Adoption, One Step Back for Security
01h 02mThe New Realities of SaaS: Why Building is Harder Than Ever
39mProtecting SaaS Users Against Phishing: How to Partner Up with Developers
45mAnticipate and Defend Against Advanced Adversaries Targeting SaaS and IaaS
36mSaaC – Security as a Culture, the Distributed Advocacy
46mCritical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks
30mTruth about running Cloud Security Assessments in 2021