7 Key Findings from the 2022 SaaS Security Survey Report

The Cloud Security Alliance (CSA) is a not-for-profit organization with a mission to widely promote best practices for ensuring cyber security in cloud computing and IT technologies. CSA also educates various stakeholders within these industries about security concerns in all other forms of computing. CSA’s membership is a broad coalition of industry practitioners, corporations, and professional associations. One of CSA’s primary goals is to conduct surveys that assess information security trends. These surveys provide information on organizations current maturity, opinions, interests, and actions regarding information security and technology. Adaptive Shield commissioned CSA to develop a survey and report to better understand the industry’s knowledge, attitudes, and opinions regarding SaaS security and related misconfigurations. Adaptive Shield financed the project and co-developed the questionnaire by participating with CSA research analysts. The survey was conducted online by CSA from January to February 2022 and received 340 responses from IT and security professionals from various organization sizes and locations.

Summary

Many recent breaches and data leaks have been tied back to misconfigurations, causing it to be a top concern for many organizations. Most research related to misconfigurations has focused strictly on the IaaS layers and ignores the SaaS stack entirely. Yet, SaaS security and misconfigurations are equally crucial to the organization’s overall security. For these reasons, CSA developed and distributed a survey to better understand the use of SaaS applications, timeline and tools for SaaS security assessments, a time frame for misconfiguration detection and remediation, and awareness of security tools for SaaS applications.

Purpose

The goal of this survey was to understand the current state of SaaS security and misconfigurations.

Key areas of interest include:

• Use of SaaS applications with organizations

• Methods, policies, and tools for assessing SaaS app security

• Timeline for detecting and remediating misconfigurations in SaaS app security

• Awareness of new SaaS security related products