[이찬우 강사] Security plus saas security assessment_2021.04
0 likes302 views
This document outlines the 2021 SecurityPlus SaaS Security Assessment, emphasizing the importance of incorporating security throughout the software development life cycle (SDLC). It details a framework for preparing, assessing, following up, and evaluating SaaS security, including specific requirements for data protection, access control, and continuous improvement. Additionally, it stresses the need for stakeholders' involvement and periodic evaluations to ensure security measures are effectively implemented and maintained.
![15
“Must implement the requirements you have derived.”
F/up
2021 SecurityPlus
SaaS Security Assessment
[Data]
✓ Personal Information protection
✓ SSL/TLS Encryption
✓ Data and password Encryption
✓ Data Retention
✓ Tenant Restriction
✓ Sharing and Download permission disable
✓ Upload File Scanning
✓ Validation of file extension
Copyright 2021. Chanwoo Lee All rights reserved.](https://image.slidesharecdn.com/securityplussaassecurityassessment202104-210404112506/85/Security-plus-saas-security-assessment_2021-04-15-320.jpg)
![16
“Must implement the requirements you have derived.”
F/up
2021 SecurityPlus
SaaS Security Assessment
[Access]
✓ SSO/SAML Integration
✓ IP Restriction
✓ Multi-Factor Authentication
✓ Guest Access Control
✓ Session Timeout
✓ Concurrent-session Control
✓ Minimizing Pre-defined roles and permissions
Copyright 2021. Chanwoo Lee All rights reserved.](https://image.slidesharecdn.com/securityplussaassecurityassessment202104-210404112506/85/Security-plus-saas-security-assessment_2021-04-16-320.jpg)
![17
“Must implement the requirements you have derived.”
F/up
2021 SecurityPlus
SaaS Security Assessment
[Etc]
✓ Log management
✓ SIEM integration
✓ Management of API Key, Plug-in, Third-Party Program
✓ Application Configuration Analysis
Copyright 2021. Chanwoo Lee All rights reserved.
“Must discuss with stakeholders in advance.”](https://image.slidesharecdn.com/securityplussaassecurityassessment202104-210404112506/85/Security-plus-saas-security-assessment_2021-04-17-320.jpg)
[이찬우 강사] Security plus saas security assessment_2021.04
- 1. 2021 SecurityPlus SaaS Security Assessment (From a practical point of view) 이 찬 우
- 2. How to use cloud securely?
- 3. In short, Customer should consider security in SDLC.
- 4. 4 What’s wrong with this pictures?
- 5. 5 Some things don’t change over time.
- 6. Not Special.
- 7. Source Link : https://www.information-age.com/public-cloud-revenue-to-grow-6-3-in-2020-gartner-123490499/ The SaaS market is growing rapidly
- 8. Source Link : https://www.bmc.com/blogs/saas-growth-trends/ What are the biggest companies?
- 9. Source Link : https://snazlan.wordpress.com/2016/12/09/topic-0020-assessment-vs-evaluation/
- 10. 10 Preparation → Assessment → F/up → Evaluation
- 11. 11 “Can refer to various references for SaaS security assessment.” Preparation 2021 SecurityPlus SaaS Security Assessment ✓ KISA, Cloud Service Information Security Guide(SaaS) ✓ KISA, Cloud Vulnerability Analysis Guide ✓ SK Infosec, Cloud Security Guide ✓ CIS Benchmark for Cloud Services ✓ Vendor, Reference Architecture Guide for SaaS Copyright 2021. Chanwoo Lee All rights reserved. “Must develop our own framework.”
- 12. Source Link : https://www.bettercloud.com/monitor/saas-operations-management/ SaaS Management Reference Architecture
- 13. 13 “Can derive your requirements through a security assessment.” Assessment 2021 SecurityPlus SaaS Security Assessment ✓ Service : Business and background ✓ Data : Legal and Privacy ✓ Architecture : Design and Configuration ✓ Application : Vendor and Product ✓ Authority : Accounts and Authentication ✓ Security Control : Data Leakage and Malware ✓ Monitoring : Log feeding and Integration ✓ Stakeholder : Role and Responsibility Copyright 2021. Chanwoo Lee All rights reserved. “Must analyze various use cases.”
- 14. Source Link : https://securityboulevard.com/2019/04/penetration-testing-for-saas-companies/ SaaS Security Reference Architecture
- 15. 15 “Must implement the requirements you have derived.” F/up 2021 SecurityPlus SaaS Security Assessment [Data] ✓ Personal Information protection ✓ SSL/TLS Encryption ✓ Data and password Encryption ✓ Data Retention ✓ Tenant Restriction ✓ Sharing and Download permission disable ✓ Upload File Scanning ✓ Validation of file extension Copyright 2021. Chanwoo Lee All rights reserved.
- 16. 16 “Must implement the requirements you have derived.” F/up 2021 SecurityPlus SaaS Security Assessment [Access] ✓ SSO/SAML Integration ✓ IP Restriction ✓ Multi-Factor Authentication ✓ Guest Access Control ✓ Session Timeout ✓ Concurrent-session Control ✓ Minimizing Pre-defined roles and permissions Copyright 2021. Chanwoo Lee All rights reserved.
- 17. 17 “Must implement the requirements you have derived.” F/up 2021 SecurityPlus SaaS Security Assessment [Etc] ✓ Log management ✓ SIEM integration ✓ Management of API Key, Plug-in, Third-Party Program ✓ Application Configuration Analysis Copyright 2021. Chanwoo Lee All rights reserved. “Must discuss with stakeholders in advance.”
- 18. Source Link : https://www.hubspot.com/pricing/ SaaS Pricing Model(Subscription)
- 19. Source Link : https://www.atlassian.com/ko/software/jira Issue Tracking system(Ex. JIRA)
- 20. 20 “Must get visibility and evaluate periodically.” Evaluation 2021 SecurityPlus SaaS Security Assessment ✓ Is the Assessment process operating as designed? ✓ What are the ways to improve the Assessment process? ✓ Has the security level of our company increased through the Assessment process? ✓ Did you miss anything in the Assessment process? ✓ What are the problems you are facing while Assessment process? ✓ What can you create after solving those problems? Copyright 2021. Chanwoo Lee All rights reserved. “Must evaluate on a paper and evidence basis.”
- 21. Source Link : https://docs.servicenow.com/ Dashboard(Ex. ServiceNow)
- 22. Source Link : https://congruentagile.com/2020/03/16/less-sprint/ Review and Retrospective
- 23. Clear Detail
- 24. 24 Wrap-up Customer should consider security in SDLC. Customer Need to develop their own framework.
- 25. Changing people through technology Chanwoo Lee | Richard Blog blog.naver.com/jg706 Facebook www.facebook.com/jg706 Slideshare www.slideshare.net/jg706 Linkedin www.linkedin.com/in/jg706 Youtube www.youtube.com/channel/UC5Hs9p5_euXJbaf5E7Hx7Ag jg719411@nate.com | 010-4772-0130