Are Your Business Processes Secure? Protect Your Company in the As-a-Service Economy

1.Equipment Security

Equipment is one of the most overlooked layers of an as-a-service platform, although it’s often the most important (“Infrastructure as a Service”). While some providers have their own infrastructure, many make use of cloud storage provided by specialized vendors (Google, Microsoft, Amazon). However, this does not absolve them of the following obligations:

• Uptime and Availability – Either by contract or through an SLA, the SaaS provider must provide high availability of its services.
• Backups and Disaster Recovery – Backups and disaster recovery should be extensively covered, with the provider stating how many times a day or a week does a backup occur, but also what the recovery time is in case of a natural disaster.
• Data Localization (or Data Residency) – Having your data backed up in multiple data centers is not just necessary, but often a legal requirement.
• Stability and Portability – The key of maintaining both stability and ensuring portability (in case the SaaS provider can’t provide the service anymore) is using secure, but standard access to your hardware infrastructure, allowing quick and efficient intervention.

2. Data Security

Data security covers both the way the SaaS system handles data, but also the format of the data itself. While a part of it can be hardware dependent, data security should be built in the product.

• Information Security – Standards such as ISO 27001 for information security make sure your provider is able to securely manage both cloud-based or third party information storage.
• Data in Transit and Data at Rest Protection – Using an established standard such as TLS (Transport Layer Security) can help improve the privacy and speed of each data transfer. However, the tricky part about a TLS certificate is not acquiring it, but properly configuring it. Failing to do so might result in an unwanted security hole. Additionally, using secure encryption and digital certificates (such as those provided by the AS2 standard) can improve transport security even further, while cloud security can easily handle data at rest.
• End-to-End Encryption – Such an encryption system means that all user-server interactions are carried out securely. As SaaS Metrics recommends, an SSL certification should thoroughly cover this aspect.
• API Protection – Making sure access to the SaaS platform’s API is controlled can prevent unauthorized access to the company’s inner systems, but also speed up integration.
• Data Control and Vulnerability Testing – Access to every layer of data should be provided, while constant vulnerability testing should be performed in order to reveal the weak points in the way your company and your provider exchange data.

3.User Level Security

The human element is often the most vulnerable component in a company’s ecosystem. In fact, we’ve recently covered the damages of invoice fraud and the effect it can have on a company’s finance and employee morale. While training the users definitely helps, providing proactive security measures for human error is just as useful.

• User Credential Encryption – It’s vital that all platforms keys, certificates, and passwords are secured using a centralized, vault-type system.
• User Identity and Access Management – Identity management represents the identity confirmation of each user. For this, your provider should use an identity standard (such as Okta) or use a secure access point. Regarding access management, user privileges should be clearly differentiated and access should be easy to revoke, if necessary.
• User Logs Availability – Every file access and transfer should be constantly monitored and logged. In case of financial documents such as invoices, audit trails are actually be a legal requirement.
• Access from Anywhere – Remote access to the SaaS platform’s interface should be both possible and fully secure.

4.Incident Response

An incident response team should consist in people from both your SaaS provider and your company, which is why it is important that it respects a common set of principles.

• Availability – Incident response teams should be able to tackle both hardware and software components, but also business-related or account management issues. In some cases, multiple teams can be established, in order to ensure continuous monitoring.
• Visibility – System administrators should have full visibility into the user bases’ activity. This is why an internal reporting system should be in place. Additionally, a Business Analysis Planning and Monitoring system should also offer financial visibility into each process, not just a technical one.
• Transparency – Incidents should be clearly communicated, along with their cause and estimated resolve time. This would require the existence of a SLA, or Service Level Agreement, detailing incident prevention and response.
• Initiative – Users should have means of quickly reporting incidents and accessing support. Furthermore, they should be encouraged to do so.

5. Standards and Certifications

While not a vital prerequisite for choosing a SaaS provider, the availability of a set of standards and certifications is definitely something too look into. These standards can fall into multiple categories.

• Information Security Standards (such as the aformentioned ISO 27001) are highly useful, regardless of the SaaS provider’s domain of activity.
• Data Interchange Standards (such as ISO 20222) can be used to complete the information security ones.
• Document Storage Certifications are useful for providers that manage large quantities of sensitive data.
• Format Certifications are dependent on the SaaS provider’s domain of activity, but are nonetheless useful for companies looking to follow international legislation (such is the case with the European 2014/55/EU directive for electronic invoicing and its standards).
• Data Privacy Certifications – GDPR has long become a necessity and while privacy agreements are a must, an actual certification guarantees a provider’s commitment to preserving user privacy.