Security in a SaaS environment
This article came across my inbox the other day. Martha (the author) doesn’t really have a security / idm background, according to my (quick, possibly faulty) skim of her LinkedIn profile, so I was interested in her takeaway on security and SaaS and the role of identity in SaaS.
Identity management does get a few mentions (must be a good article), but the main quote I thought worth repeating was:
All of the firms I talked with for this piece referenced Symantec’s research about rogue employees and lost laptops as the primary sources of data loss and theft. Working in the cloud removes the laptop issue and even the smartphone issue.
The wow factor for me (the rest of the article is pretty rushed) is this is the first time I’ve read about cloud computing reducing risk for an organisation, rather than increasing it.
Alas, Martha only hints about identity services in the cloud, and a pretty limited implementation:
User security is rooted in role-based access and identity management. Identity management is maintained in the firm’s LDAP directories. Permissions and denials are controlled by the firm’s administrator. The directories can be either inside the firm’s firewall, at the SaaS provider’s site, or in a DMZ.
Now, if only a large software vendor would release some sort of framework for identity services in the cloud. Should SaaS vendors be looking into this?