SHARE

Should Security Concerns Stall SaaS Adoption?

One of the first questions IT and business executives ask when they are considering a Software-as-a-Service (SaaS) solution is, “Is it secure?” This question usually has multiple meanings. IT and business executives want to ensure the privacy of their corporate data is protected. They also want to be sure they can regain control of their […]

Written By

Jeffrey Kaplan

Jun 17, 2009

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

One of the first questions IT and business executives ask when they are considering a Software-as-a-Service (SaaS) solution is, “Is it secure?”

This question usually has multiple meanings. IT and business executives want to ensure the privacy of their corporate data is protected. They also want to be sure they can regain control of their data if they are unhappy with their SaaS solution, or their SaaS vendor goes out of business or their services are seriously disrupted.

While these concerns are understandable, the reality is that companies have been entrusting their corporate data to third-parties for many years, whether it is for online banking, payroll or commerce purposes. Large-scale enterprises have even outsourced their entire data centers to third-parties.

Just as these services have proven to be secure, there have not been any serious security infractions reported among the rapidly growing assortment of SaaS solutions, while security problems continue to plague traditional data centers and legacy software installations.

The fact is that any SaaS company that wants to succeed and survive in an increasingly competitive market has to put stringent security measures in place to safeguard customer data, and must make it absolutely clear how customers can obtain their data on an as-needed basis.

In many cases, this means that the SaaS vendors are making far greater investments in security technologies, skills and certifications than most businesses can afford themselves.

They have implemented encryption capabilities, developed user access control mechanisms, and deployed automated patch management systems. They have instituted process management controls to prevent unauthorized users, partition user data, and ensure that their security is up to date against the latest threats.

These security measures far exceed what most small- and mid-size enterprises (SMEs) can put into place. They also go beyond the safeguards of many large-scale enterprises by providing integrated audit capabilities. And, the off-site hosting brings built-in disaster recovery and business continuity benefits.

As a result, the SaaS approach eliminates the security risks associated with lost laptops, inadequate activity logs or other vulnerabilities that have been commonplace in traditional corporate environments.

And as I mentioned in my piece about how SaaS changes the customer-vendor relationship, the ‘multitenant’ architecture that underlies the leading SaaS offerings actually enables every customer to get the same level of security as those with the highest security standards.

In contrast, legacy software was built to sit behind a firewall with limited access end-users or authorized third-parties. This has made traditional, on-premise software less useful not only for a mobile workforce, but also for a geographically dispersed customers and business partners.

Despite these traditional safeguards, corporate data continues to be vulnerable to internal and external threats.

The success of online banking, commerce and payroll services clearly shows that web-based solutions can be safe and secure. So, it is time for IT and business decision-makers to put aside their fundamental opposition to letting their data move beyond their firewall.

But Ask These Questions

Still, organizations should not entrust their data to any SaaS vendor without carefully evaluating their security capabilities.

Because the range of SaaS solutions is becoming as broad as the overall software industry, the spectrum of security capabilities and policies among the SaaS vendors will also vary widely.

Therefore, you should ask prospective SaaS companies:

• What kind of user access controls, back-up and recovery measures, and security vulnerability tests do they have in place?

• Do they have Statement on Auditing Standards (SAS) No. 70 Type-2 certifications verifying that they have adequate operational controls?

• What mechanisms are in place to permit customers to regain their data?

Finally, ask for a copy of their Service Level Agreement (SLA) which stipulates these protections.

Jeff Kaplan is Managing Director of THINKstrategies (www.thinkstrategies.com), an independent consulting firm focused on the business implications of the on-demand services movement. He is also the founder of the SaaS Showplace (www.saas-showplace.com). He can be reached at jkaplan@thinkstrategies.com.