Securing SaaS Platforms and Protecting Customer Data with Prismatic’s Buzz Hillestad

This is Textron tv. Hey guys, thanks for the throw. We're here with Buzz Hilstadt, who's information security officer and security architect for Prismatic.

And we're gonna be talking about the security of all these SaaS applications that we're using. Buzz, welcome the show. Thank you for having me.

We all use SaaS apps every day, and probably more so than ever, but following covid. But it seems like we're now trying to stitch all these things together into a workflow and, um, there's a lot of APIs that connect all those things and suddenly my dependencies have dependencies. What are the implications of all that from a security perspective?

You bet. Well, so from the SaaS vendor side, if they don't secure their platform, basically anybody on the planet with an internet connection can get into their customer's database, uh, their customer's data through their database. So it's very important for the SaaS vendors to secure that piece.

When you're hooking data together from one SaaS app to the next SaaS app, it's also very important to make sure that everything is secure in between that, where the data flows as well. And whose responsibility is that? 'cause a lot of people are exposing APIs and they're kind of leaving it to the end customer to go and kind of craft those workflows.

So who's in charge of kind of figuring out what is secure here? Yeah, uh, that's a good question. So, um, from the Sasa app vendors side, it's their responsibility and those customers really rely on that SaaS vendor to make sure that their data is secure, even when hooking up with another third party vendor.

So Prismatic, uh, for instance, uh, we're a third party vendor, we would, we would cause an integration between one SaaS app and another that data in transit. And if it a, it goes to rest at any point in that SaaS application or in that, uh, IPAs, it's our responsibility to make sure that we do good justice on that customer's data for the SaaS vendor and obviously for the, for the endpoint where they're trying to get that data to. So do I need to, I don't know, encrypt all that data as it's moving about or only when it's at rest or, um, how do I kind of get down to that granular level of protecting the data?

Yeah, so, uh, there's a, uh, image I like to refer to, to people that are listing, um, it's called the Merc Cumber Cube. And I don't know if a lot of people have probably heard of it, but essentially it's where you have security goals of confidentiality, integrity and availability all across those information states. Like we're talking about transmission storage and processing with the countermeasures of technology process and people in place.

So yeah, you need encryption. That's probably one of the biggest things, uh, from a standpoint of making sure that the, the data, uh, keeps its integrity, which is one of those security goals I was talking about. Um, basically besides encryption, you need to do data validation and sanitization at from end to end as well too.

And obviously there's logging and a lot of different things that happen, uh, in that, uh, process. When you're transferring that data from point A to point B In a lot of places, application security is still kind of the redheaded stepchild of security. And, uh, that child has an orphan called API I security, and yet these are the very APIs that we are looking for to connect all these things together.

So do we kinda need to maybe send everybody to API security school? Because I don't think we're paying much attention here, but the bad guys are. Yeah, uh, no doubt.

And, um, that's just, uh, unfortunately that's just gonna get worse for everybody. So we have, uh, society where we build things and say, Hey, we can do this, so we're gonna build it and we're gonna transfer that information. That's a possibility for us to do.

And so to back up and to say that, wait a second, maybe we shouldn't just build that just because it works, let's make sure that it works well and is built well and constructed properly for security. And that's probably what we need as a, as an entire society, is to step back and say, yeah, we built an API and that's great, you can connect to it, but we've seen things like API, uh, secret keys shared in code, um, on the code to actually connect API to API, uh, on, on things like GitHub and the, and, and, uh, storage places like that. So, um, API security's got a long ways to go.

And you see these also, um, attackers, they're really invested right now, especially like the big, um, the big, uh, um, uh, attacker, um, places out there that are, are doing most of the global, uh, cyber crime. They are really invested in, uh, ransomware and things like that. And they are attacking APIs as well.

They're al there's always like this base level of noise attacks that are happening all the time. And so when they turn their heads from ransomware to thi something like API integrations, uh, the world's gonna be in a bad spot if it doesn't, uh, fix a lot of things with APIs currently. And these attacks can be pretty subtle as I understand it, because they're not just say, um, easily detected because somebody changed the API, they're just kinda manipulating the business logic as it flows through the API to change an outcome in a way that no one might ever notice for a long time.

Yeah, that's, that's exactly true. Um, the, the attacks that happen to APIs are very subtle, as you mentioned. Uh, they can be even the, another door that's kind of open to this whole thing is a lot of, uh, IPAs vendors like us allow anybody on the planet that has an email address and you know, how easily those are, those are gotten, uh, to essentially run arbitrary code in their systems against any sort of API connection that they would want to try to integrate with.

So, uh, again, that, that onus is back on us as the IPAs vendors to make sure that we can, um, provide a secure platform for that to be done. Um, not only that, but I think that the security in general, uh, a lot of security organizations, they're really bent on, uh, basically, uh, being able to detect and respond to things. And that's kind of my background is, is incident response.

Um, but being able to detect it is so important, and that's the first step in incident response. You detect it, you contain it, and then you eradicate the issue. So without being able to detect it, and there's not a lot of tools that do that currently unless you're sitting there watching logs all day or have certain alerts configured in something like CloudTrail, uh, for AWS or, uh, other Azure technologies.

If you're not sitting there watching logs or have things to configure to, to detect those things, you're gonna miss it. Uh, like you say, they're super subtle, so detection is huge part of that, and I think that's where security organizations need to step up their game. Mm-Hmm.

It also seems to me as of late at least, that the bad guys are indeed targeting these SaaS platforms more aggressively that we saw one in the automotive sector that had an issue and, um, they apparently present a rather juicy target. Most of those SaaS application vendors have invested in security, but are we winning or losing that battle? Uh, I think as a, as a culture, human race, I feel like we're losing that battle right now.

Um, there, there are things that can be done. Uh, there are, you know, we, we need to create a culture of security, especially around our SaaS apps. I think, like, like I alluded to before, just because we can do something doesn't mean we should just do it without considerate proper considerations.

So, um, even though we are losing that battle, I'm optimistic, uh, that we can get ahead of the problem as a society if we, if we take proper precautions and really create that culture of security. I think maybe one of the fundamental flaws is we just all bought into this notion of multi-tenant platforms, and as good as that sounds from a cost perspective, if we're in a multi-tenant environment, then the security is equally applied to all the tenants. And that may not be a good thing.

So can we have our cake and eat it too and enjoy the benefits of multi-tenant, but maybe not have everybody's data be so, uh, commonly accessible in the same pool? Yeah. Uh, and I think there's a slider there.

Um, you know, you have a slider between functionality and security, right? And so, uh, companies like Microsoft, for instance, when you subscribe to their M 365 cloud, um, they present a situation where you are going to, uh, be able to look at the tenants and uh, and, and basically get your data in a tenant. And from a multi-tenant perspective, have a situation where, uh, you can see all the tenants and they have a certain level of security, but they're really, Microsoft is really more towards that slider of usability rather than security.

So being able to bring that slider back, they rely on the user of that tenant. So there's gotta be a lot more training with, uh, customers as when they come on as a user of a multi-tenant SaaS application to say, this is how you need to secure this off base. And even some customer service, uh, touches to where they pull 'em in and say, okay, we're gonna help you secure this to the level that you want it secured individually for you.

Um, again, a a lot of, uh, organizations, and I just use Microsoft as an example, have that slider towards the usability, um, standpoint and inching it back towards that security makes it less usable for some of their customers. So it really is an individual thing. And again, if you are working with an organization that doesn't provide you the, the customer success touches to say, this is how you secure it for your organization, then you need to have somebody on staff that can, uh, help you with that.

And those controls, Many organizations are probably using more SaaS apps than they realize. Um, and the question in my mind always becomes, should I, in the name of security consolidate those platforms or should I in the name of security on the assumption that smaller platforms that nobody knows much about aren't gonna be as targeted as much, have more platforms in the hopes that, uh, I'm not gonna be experiencing a single point of failure? Yeah, it kinda, it's, that's an interesting question because, uh, you have two different situations there.

Um, the, the single point of failure one is interesting because, um, I, I, I guess I, I probably swing more towards the, have more SaaS apps and have your data in different spots, and it really comes down to how you, how you do authentication and authorization for those. Um, if you use platforms that allow you to do single sign on to all those apps, I consider that a little bit of a security issue. Uh, unless you have those, um, properly authenticated and properly divided and have the seg, uh, segmentation and segregation probably done, that's hard for folks to do.

So using something like one password or something like that to access all these different SaaS applications is actually probably more of a security feature, um, than consolidating them into one spot for sure. Do you think that will a, see more regulations in this particular space and do we need them and who should design them? Because sometimes I feel like the folks in Washington don't always understand exactly what it is that they're being asked to make some judgments on.

Yeah, so I think you're referring to like NIST and ISO and, um, those types of, uh, uh, governmental led, uh, frameworks. Um, nist a cybersecurity framework I think was developed during the Obama administration, for instance. Um, Washington does have a little bit of a disconnect.

They try to get the experts at the time, but then when, uh, a security framework moves, um, from point A to point B, it needs to be able to change as the threats develop in the landscape. And without being able to change, it becomes, uh, stale and old. And we're seeing that with some of the old frameworks that basically look at, this is how you secure a land network.

This is how you secure authentication on the land. If you're going over the land network, this is how you secure authentication. Um, some of those frameworks are still stuck in that model, which doesn't really apply to the cloud security model at all.

So being able to look at things like the cloud security model and, uh, being able to look at those different models that are kind of privately held, not necessarily, uh, uh, privately, um, audited or anything like that, but definitely the ones that are with organizations where they crosswalk things back to NIST crosswalk, things back to iso, those are gonna be the ones that change fast enough based on the threat landscape and really help you be more secure rather than just give you regulation. And so from a regulation standpoint, who should do it? I think that we all need to pitch in and, and create these standards.

Um, my, one of my biggest gripes about security is everybody's like, let's create a standard that encompasses everything and it does for the most part, but then it gets stale or STA stagnant, and then it, it just becomes another standard rather than the all-encompassing standard that it was meant to be. So I really hope that we don't continue this, um, this, uh, uh, situation that we have where standards are continuously, um, uh, procre and put out there. And then we're just like, have customers that come in and say, are you, uh, compliant with this very specific standard?

Well, no, but we do this one and that doesn't fit their model or whatever. It's gonna make security and, uh, compliance super impossible for organizations to do if we don't have some sort of, um, uh, I guess, uh, uh, sanity check on the whole compliance model and framework piece. All right.

Well, let me ask you this then. Do you think someday AI may save us from our insanity? AI has a lot of very interesting potential and, and we could probably do a whole segment on just ai.

Um, but uh, I think that it does have potential to be able to be, uh, pretty interesting, especially when we get to the A GI standpoint. Um, you know, it's gonna take a lot of the, the heavy lifting off of those of us in security, it's going to make compliance with regulations, uh, potentially easier by saying, okay, here's our policy and procedure. This is exactly how you implement it.

Eventually it will be able to go in there and start implementing it in your infrastructure for you. Um, that's, that's exciting stuff. I think that the thing that, uh, scares me a little bit about that is that technology, if it's just held by a few companies, um, is going to essentially put a le a leash around everybody's neck.

So, um, AI's fantastic. We just make sure, we need to make sure it stays, uh, not only with companies, but also in an open source um, standpoint. All right, folks, you're here.

Well, we can't live without SaaS apps anymore, but we definitely need to figure out how to better secure them because otherwise we're gonna have more problems than we could possibly imagine. Hey Buzz, thanks for being on the show. Thanks for having me.

Alright, man, back to you guys in the studio.