AppOmni’s Aaron Costello on Uncovering Deeper SaaS Security Risks in Salesforce

Hey guys, thanks to Throw. We're here with Aaron Costello, who's head of SaaS threat research for App Omni. And we're talking about, well, there's been a spate of, uh, issues that have arisen, shall we say.

We don't know if there's been some actual breaches yet, but maybe there has, but Aaron probably knows better than we do. But we're gonna talk about is this whole area being overlooked from a security perspective. Aaron, welcome to the show.

Thank you so much for having me. It's great to be on. So just recently we saw that Salesforce fixed a lot of issues.

Some of them were fairly high, severe severity, at least in terms of vulnerabilities. But, um, I don't hear a lot about this issue. And so my question to you is, you know, is this just flying under the radar and it's a bigger threat than we realize?

Yeah, absolutely. So when we look at my research and it's tackling the suite of Salesforce industry cloud products, tens of of thousands of organizations are using these products, right? We look at our own internal telemetry.

We protect 25% of the Fortune 100 over at App Omni, and nearly one third of our customers are using one of the Salesforce industry clouds. So the potential blast radius for this research is, is quite big. Mm-hmm.

I don't always like to beat up on a particular vendor because I sometimes think of error for the grace of God goes everybody else. But is this problem endemic to all the SaaS platforms? So it's endemic to the Salesforce industry cloud suite of products specifically.

So Salesforce industry clouds, I encompass, I believe 11 individual. Um, we say verticals, uh, or products. So industry clouds encompass a platform for the public sector, uh, financial solutions, uh, communications and telecommunications and insurance, and also health.

So there are 11 individual products within that suite and each one of those products is affected. Alright. Um, who's in charge of this?

'cause the SaaS apps are usually bought by somebody in a business unit lead or maybe at the C-level somewhere, but, um, it's not clear to me that cybersecurity people are always involved and there's probably not a lot of processes in place for checking how things are configured. Yeah, absolutely. And that's something that we see that's quite endemic across, uh, the majority, the vast majority of, of SaaS customers.

It's really whose responsibility is this to configure security and, and use correctly. And that can vary from organization to organization. So in some cases it may be the responsibility of the, uh, platform administrator.

So these would be your kind of SaaS SME experts, uh, of Salesforce or whoever. Um, internally it could also be the responsibility of the individual security teams. These could be your standard, um, application security teams, for example.

But often they can vary from organization to organization. And that's part of the problem tackling these issues is finding who is really responsible within your organization for securing these things. Is there some way to holistically secure them because counting on mere mortals who are administrators of the Salesforce platform or whatever else it is to do the right thing, uh, is almost zero sum game, uh, the odds of winning that are low.

So is there some way to kind of put controls in place that don't make me dependent upon somebody who has no cybersecurity training to do the right thing? Yeah, absolutely. So when we look at, uh, my research as a whole, um, there was, or in 20 findings, right?

And 15 of those security risks are the responsibility of the customer to secure. And these are all things that can be secured from within the platform. So these are items such as enabling certain security guardrails like settings and configuration settings that may enforce a access control, for example, across the entire organization to, to lock it down or it could be, uh, to do with custom development.

So on these platforms, if things are being built in Salesforce industry cloud, um, ensuring that the, those components are built, um, adhering to development best practices is, is something that organizations need to, uh, need to be doing. Alright. Um, we talk a lot about shared responsibility in the age of the cloud and I think everybody nods their heads, but it's not clear to me everybody knows what exactly what's entailed or what's required there because well, we seem to get it wrong a lot.

Yeah, absolutely. That is, um, something that we still get, uh, queries about to this day from, from customers especially with respect to, to this research. Um, so generally speaking, once a organization purchases a product or a software, a south software switches Salesforce, the software is inherently secure out of the box.

So all of the configuration settings and the properties and the access controls are generally speaking completely fine and you are at no risk. But as organizations start to build on these platforms and add their own customizations, those customizations and those changes that they're making to that software or to the configuration of that software is their own responsibility. So typically what we like to say is if the, a security issued is a problem or a risk in the software itself, and so it affects all Salesforce customers out of the box on brand new deployed instances, that is the responsibility of the vendor of Salesforce to fix.

Whereas if the issue has arisen because of a change that was made by your organization to a configuration within the platform or through development on the platform, then that is the responsibility of your organization, the customer to fix Time is usually of the essence in these matters. And what you just described sound like it takes a long time to figure out who's responsible for what, whenever there's an incident or an issue. So is there some way to narrow that gap?

Well, really it's just establishing, and this is really the dream, it's establishing the security process from the very beginning. And as I'd mentioned earlier on this is this can differ from organization to organization. So for example, one organization, it may be a scenario in which the platform owner, the Salesforce expert, may be the one to take it on themselves to perform these audits, uh, either manually or through an automated tool like app Omni, um, to ensure that their access controls and configurations are secure because these individuals have that Salesforce knowledge.

And so they're familiar with the security concepts of the platforms. However, in other organizations, the security teams are the ones who, um, are responsible for resolving these issues and hunting for these issues on the platforms. And that's another viable solution, um, for responsibility because these are security minded individuals, they kind of know the general concept and risks and what to look for in the platforms.

The issue with that may be that they do not have the platform specific knowledge to tackle the problems effectively. So all in all, I would recommend that the security teams and the platform owners, these system administrators of the SaaS platforms work together to tackle these issues. Do you think that maybe someday soon we'll have an AI agent that will help us sort all this out?

Because it seems like a lot of this is just simply having enough bandwidth to consume all the configuration data and then validate it. Yeah, absolutely. Absolutely.

So we're already seeing a lot of, uh, LMS AI agents analyzing code for examples. Uh, for example, and that's not different when looking at security configurations also. So all of this that this data is stored on the platform, so if we're feeding an ai, an AI agent, a an image of what secure looks like and what good looks like, then that agent can be responsible for ensuring that the confi, the security configurations stay secure because it has that visibility into the platform.

So potentially we, we don't know something such as agent force on Salesforce maybe leveraged, um, in the future for ensuring the secure, the maintenance of of security controls on the platform. What's that one thing you see customers doing over and over again that just makes you shake your head a little bit and go, folks, we need to be a little bit better than that. Taking the fastest, quickest route to solve a problem is 99% of the time the reason that these security issues arise because it's the easiest solution.

So if they're building or writing some code to pull some data, it's very quick and easy to just say, Hey, pull this data and give it to the person. And they're not putting in security best practices when developing that code because then you need to start thinking about, okay, well are the end users using this code? Do they have the permissions?

Do I need to assign the permissions? Do I need to analyze the permissions? And while that's the best practice, naturally that takes longer.

So it's really a matter of trying to get a solution built in the quickest timeframe possible is leading to these kind of then an endemic of, of security issues on the SAS platforms. Mm-hmm. Do you think that the compliance regulations are stringent enough or are they still a little too loose and so everybody will say, yeah, I complied, but they're not really secure?

That's a great question. Generally speaking, what I've noticed is it's very difficult to apply a lot of these compliance frameworks like NIST to SAS products specifically because they were not built specifically for SaaS products. And so there isn't really a one size fits all solution to ensuring that your Salesforce instance, your ServiceNow instance, is compliant with SOC two or, or NIST CSF or any of these, these frameworks.

So personally I would really like to see, um, something like scuba. So SCUBA was recently mandated by um, CSA and it's effectively a framework, a government framework that government bodies in the US need to apply to their Microsoft instances. And it describes a whole manner of security controls that need to be in place.

And so I would really like to see that expanded on not just for the public sector, but also for the private sector. Yeah. Um, are there, I don't hear much about this, but are people and organizations being fine because of SaaS security issues or are the regulators just not even on this?

'cause there's so many other things they gotta worry about? That's a great question. I would imagine it's, it's the latter more than anything else.

Um, typically SaaS is a bit of a blind spot, which is strange considering your organization's most sensitive data is typically stored in the cloud on these SaaS platforms. But I think with the relatively recent upsurge in attacks over the past, uh, couple of years, we look at um, like midnight blizzard and more threat actors targeting SaaS platform specifically, I think the importance of of SaaS security and regulation of, of SaaS security is something that we'll see, um, implemented, uh, a bit more stringently over the next couple of years. All.

So ultimately, what's your best advice to folks who are in charge of this whole area? 'cause I don't think anybody deliberately gets up in the morning and says, let's not bother with securing these applications, but I get a feeling they're a little overwhelmed and just don't know where to get started. That's the the golden question really.

Um, I love to provide an answer that that could apply to all organizations of, of all shapes and, and, and sizes. But really starting from the ground up when it comes to even just procuring these SaaS applications is when I believe organizations need to do the, the most amount of due diligence. So when procuring a SaaS application, ensure that while it must fit your business use cases, it also is compliant with your own security policies internally.

So does the SaaS application, um, allow for various forms of MFA, are there adequate access control, um, solutions built in the platform? Are we able to ingest activity logging? Is that made available by the SaaS platform and can we have visibility into potential breaches and attacks?

So that's really step one in my opinion, ensuring that, uh, it's compliant from a security perspective to what your organization typically needs. And then from that point onwards, delegating the responsibility when it comes to security and maintaining the security of the platform. So maintaining what I was speaking about earlier on those configurations, um, delegating that to either the platform owner, whether it's the AppSec teams or if they're kind of working together more holistically, um, is another viable solution.

So delegating that responsibility in my opinion is step two, secure by default and building everything with security in mind. Step three. So apply the same stringent level of auditing of scrutiny from a security, security perspective to everything that you build on these SaaS platforms.

Imagine it's a custom solution that your organization is built because typically if an organization is building their own website or their own CRM, it goes through A-C-I-C-D DevSecOps process and is heavily scrutinized by the internal security teams. And I would love to see the same approach apply to these SaaS platforms. And then in addition to all of this, I won't sugarcoat it.

If you are a large enterprise organization, maintaining all of these security controls and all of these best practices manually is really not gonna be that feasible. If you are a very large organization that's heavily using a SaaS product like Salesforce. If you've got thousands of users logging in every single day, people building things consistently, manually, auditing permissions, access controls and configurations and ensuring that they stay up to date is just not very, very feasible.

Not all, all organizations will have the budget or the headcount to build an automated solution to maintain those security controls. So look into getting an SSPM tool. I am, I am biased naturally like App Omni, that will routinely and regularly assess those security controls and also provide you insight into the activity that's happening on, on your SaaS platform so that you can be both preventative from risks.

So identify risks and lock them down before attackers take advantage of them. And the worst case scenario, if there is a breach in progress, it can be retroactive and use an SSPM like app Omni to identify these attacks as they're happening and show them down. All right folks, you heard in here, Hey, there's a lot of SaaS platforms now being used by everybody and it's not gone unnoticed by the bad guys who have become a lot more adept at just stealing credentials and logging in rather than actually breaking in.

And well, the best place to log in is usually a SaaS application. Hey Aaron, thanks being on the show. Thank you so much, Mike.

I appreciate it. All right. And back to you guys in the studio.