AUTOMATING SECURITY FOR GREATER SaaS SUCCESS white paper - November 01, 2013
Table of Contents 1 The Need for Security in SaaS Applications 3 Security In Resource-Constrained Organizations 4 Automating Security for SaaS Success 7 Automating Security and Compliance Controls 10 Conclusion 11 Learn More 11 About CloudPassage Software-as-a-Service (SaaS) providers are enjoying considerable sales opportunity as organizations leverage SaaS products to streamline business information technology. However, customer security and compliance concerns can make or break a SaaS provider s success. To win customer trust and confidence, SaaS providers must integrate security into their products in a way that makes optimal use of their security team s time and resources. Automating security controls and compliance monitoring will allow limited IT resources to handle the ongoing security and compliance demands of complex, dynamic application SaaS hosting environments. This white paper discusses the need for security and compliance controls in SaaS businesses as well as opportunities to automate those controls for efficiency and consistency. The paper will also look at the characteristics of security solutions that are needed to enable faster, better, and more reliable SaaS hosting security and compliance. Automated, effective infrastructure security helps establish trust and assurance as core brand attributes for a SaaS provider while freeing security resources to focus on high-value areas. table of contents
The Need for Security in SaaS Applications With all of the benefits of the Software-as-a-Service (SaaS) application delivery model, such as lower upfront costs, simplified IT infrastructure, fast implementation, and painless updates, it would seem a simple decision for businesses to convert from on-premise applications to SaaS offerings. However, there are many IT decision makers that are uncomfortable with this transition. The main concern is security this is the #1 reason that many organizations do not adopt SaaS solutions, as shown in numerous survey results. 1 Some IT departments have avoided moving to the cloud altogether, while others are compelled to adopt SaaS solutions regardless of their concerns due to cost and competitive advantages. SaaS providers have to overcome security concerns and give potential customers the confidence to move to their solutions. For SaaS providers, security is a brand and customer trust issue. Security must be an integral part of a SaaS offering, including hosting infrastructure as well as application and customer data. Top 3 Drivers SaaS Adoption Top 3 Barriers 1. TCO Reduction 1. Security Concerns 2. Cost Variables 2. Integration Challenges 3. Industry-Specific Reason 3. Lack Of Management Figure 1: Top adoption drivers and barriers to SaaS solutions (re-creation of information provided in the Enterprise Cloud Adoption Survey 2013 by Cloud Connect and Everest Group Research) SaaS solutions must also address compliance. In The Future of Cloud Computing: 3rd Annual Survey 2013, 63 percent of respondents indicated that regulatory compliance / privacy is an inhibitor to SaaS adoption. 2 When using regulated data in SaaS applications, organizations demand that the SaaS provider comply with security regulations that vary by industry, and in some cases multiple regulations simultaneously. 1 Examples of surveys with results showing security as the #1 inhibitor to SaaS adoption: 1 The Future of Cloud Computing: 3rd Annual Survey 2013, North Bridge Venture Partners in conjunction with GigaOM Research and supported by 57 collaborating companies, slide 45. http://www.northbridge.com/2013-cloud-computing-survey 1 Enterprise Cloud Adoption Survey 2013, Cloud Connect and Everest Group Research, March 2013, page 16. http://www.everestgrp.com/wp-content/uploads/2013/03/2013-enterprise-cloud-adoption-survey.pdf 1
Some examples include the following: Payment Card Information Data Security Standard (PCI DSS) Federal Financial Institutions Examination Council Guidelines (FFIEC Guidelines) Sarbanes Oxley Act (SOX) Such regulations generally stipulate a minimum information security standard that must be applied to the transmission, processing and storage of any data in scope of the regulation. When a SaaS application has any possibility of transmitting, processing, or storing regulated data, the provider must be able to protect this information as required by data security regulations and provide its customers with ongoing validation of this compliance for auditing purposes. There is significant sales opportunity for SaaS providers that integrate effective security and compliance into their offering. On the other hand, not addressing security and compliance in SaaS offerings will slow down or even kill sales opportunities. At stake is a SaaS provider s share of a large and growing market: SaaS is now used by almost two-thirds of organizations, a fifteen percent growth from 2012. 3 According to a Gartner survey, investment in SaaS solutions is expected to continue to increase across all regions, with 77 percent of respondents indicating that they plan to increase their SaaS spending through 2015. 4 Providers who include security and compliance with their SaaS applications and effectively demonstrate these capabilities will be more competitive and will be able to shorten sales cycles by removing the security and compliance purchasing objections from the sales process. This is particularly true for large enterprise buyers of SaaS solutions; the larger the enterprise, the more complex the compliance requirements that are passed on to the SaaS provider. Ensuring that enterprises can meet their security and compliance needs will increase SaaS solution sales. Unfortunately, most organizations don t have enough information security management and engineering personnel. SaaS providers are no different. Smart use of resources through automation of mundane, detail-oriented tasks is paramount to effective and efficient achievement of customerdemanded security and compliance. 2 The Future of Cloud Computing: 3rd Annual Survey 2013, North Bridge Venture Partners in conjunction with GigaOM Research and supported by 57 collaborating companies, slide 48. http://www.northbridge.com/2013-cloud-computing-survey 3 The Future of Cloud Computing: 3rd Annual Survey 2013, North Bridge Venture Partners in conjunction with GigaOM Research and supported by 57 collaborating companies, slide 13. http://www.northbridge.com/2013-cloud-computing-survey 4 Gartner Survey Shows 71 Percent Using SaaS for Less Than 3 Years APM Digest, November 30, 2012. http://apmdigest.com/gartner-survey-shows- 71-percent-using-saas-for-less-than-3-years 2
Security In Resource-Constrained Organizations When security is done well, it is a great business benefit to SaaS providers. It helps establish customer confidence in the provider, removes sales obstructions, improves customer retention, and drives an aura of trustworthiness that is invaluable when marketing and selling SaaS solutions. But SaaS providers often have the challenge of limited security and compliance resources. The skill set of security and compliance staff is in high demand, and a SaaS provider can never have enough personnel to cover the complex security and compliance needs of a SaaS environment. Here are a few of the issues that SaaS security teams face: Managing risks in agile models such as cloud or software-defined data center infrastructure, which are now the norm in SaaS businesses and which create dynamic, changeable environments that must be constantly and effectively monitored Fulfilling the regulatory compliance demands of their SaaS customers, which often includes addressing several compliance issues concurrently (e.g. PCI DSS, HIPAA, FFIEC) Meeting the demands of multiple product business units in their large software enterprises each with their own technology development team and disparate application and hosting environments Successfully navigating these issues requires wise use of security staff and resources. In addition to ensuring that security and compliance controls are properly deployed, it is critical to leverage tools for control management and data collection that automate these functions at a very deep level. Application hosting infrastructure is a prime candidate for such automation. Each individual infrastructure system has thousands of points that require correct configuration, vulnerability assessment, and ongoing monitoring for integrity and compliance. Given the rate of change associated with these environments especially highly dynamic, software-defined cloud infrastructures automation is an absolute must, as manual security and compliance efforts are simply not feasible. When considering where a SaaS company s security resources are best applied, consolidating controls and automating mundane tasks allows security teams to focus on higher-value areas. Instead of worrying about details like minute configuration settings and synchronizing firewall rules across hundreds or thousands of devices, infrastructure security automation allows security teams to concentrate on issues like application security and data privacy. 3
Automating Security for SaaS Success Not all security solutions are alike. If a solution is not designed to address the characteristics of an application s hosting infrastructure, it can backfire and create more work and problems for the security team than it should have solved. Many SaaS offerings are deployed on private, public, and hybrid cloud infrastructures, where legacy security strategies and products work poorly, if at all. Traditional security approaches depend on static elements such as hardware, fixed network perimeters, and physical location. Cloud architectures, of course, strive to eliminate these static elements in favor of rapidly changed, dynamic infrastructure deployment and operation. Some key characteristics of cloud infrastructure include: On-demand deployment and scaling of infrastructure resources, usually without change control Rapid, automated infrastructure and code changes to meet changing user and application conditions Massive horizontal scalability and geographic distribution of application resources These environments create incredible rate of change and their underlying infrastructures, especially those hosted across disparate cloud environments, create great complexity. Legacy security solutions designed for relatively static behind the firewall environments simply cannot support the needs of fast-moving cloud hosting environments. To ensure that security supports and does not detract from a SaaS product, infrastructure security must incorporate 3 key attributes: Automated: Transparent, automated security provisioning should be part of the infrastructure stack implemented and updated in real time as cloud environments grow and change. Runs Anywhere: The same control and management implementation should be operable on any environment, regardless of physical location, virtualization platform, or public cloud provider used. Scalable: Security control capacity should automatically grow and contract to meet the changing demands of applications and underlying infrastructure. Automated Security and Compliance Controls Operation of contemporary SaaS products is driven by agile methodologies and create a high rate of change. Underlying server instances can be created, cloned, moved, deactivated and reactivated all nearly instantly as SaaS application needs grow and change. Security must be applied to these resources to run a trustworthy, secure, and compliant SaaS offering. 4
Unfortunately, change is the natural enemy of security and compliance. Without automation, the SaaS provider faces several risks to achieving customer assurance demands: If the security is based on manual processes, points of error, vulnerabilities, and noncompliance are likely to be created. Manual security processes also defeat the agile nature of the SaaS infrastructure, slowing down the ability to create, move, and reactivate server instances. Few companies have sufficient security staff resources to support manual security processes at a large scale. Routine tasks such as security control provisioning and compliance monitoring should be automated to reduce staff overhead, eliminate manual processing errors, and enable safe use of cloud infrastructure. Automated Security Automated Security is a key effective protection in SaaS environments. The entire security platform must be designed to automate security functions and support dynamic SaaS hosting infrastructure. The less operational overhead needed due to automation, the more the SaaS company s limited technology and security resources can focus on high-value projects, and not lose precious time on routine, mundane issues. Automation for SaaS infrastructure security is absolutely essential to gain customer confidence through more effective security and compliance, and to optimize both staff and infrastructure resources. Security that Runs Anywhere SaaS providers often use multiple hosting environments, each with different security requirements and inherent security capabilities. For example, product development and pilots are often hosted using public cloud providers like Amazon Web Services (AWS) or Rackspace. As SaaS products reach maturity and begin to scale, providers often migrate these products to private data centers. Alternatively, they might switch to a hybrid cloud approach, continuing to use public clouds to host functions such as big data analytics or front-end portals, which often require infrastructure that scales up and down with demand. 5
SaaS providers therefore need security that works anywhere to enable flexibility in hosting infrastructure. An effective infrastructure security solution should deliver portability across any private or public cloud platform and be centrally managed, without being limited by the mix of cloud infrastructures. Portability of security controls also prevents disruption in the SaaS offering as cloud deployments change and ensures security consistency across different cloud environments. This approach prevents IT teams from managing separate security tools and policies in different cloud environments. When security can run anywhere, it also speeds migrations when SaaS providers change their cloud infrastructure. Scalable Security SaaS providers need the ability to scale hosting compute power up and down on demand. This is especially true for SaaS providers who serve consumer or seasonal businesses that have more significant spikes in application usage. Elasticity is one of the fundamental characteristics of cloud infrastructure, yielding both cost efficiencies and business agility. Security solutions must also be scalable in order to enable cloud application scalability. Security tools must automatically provision the appropriate security controls and maintain appropriate threat and compliance monitoring as infrastructure environments scale up or down. If a security solution requires manual intervention, the benefits of cloud scalability are lost. Key Attributes of Successful Infrastructure Security Automation Automated: The level of automation achieved will drive the operational overhead needed to conduct security operations and the ease of compliance reporting to SaaS customers. Runs Anywhere: The portability of security determines the flexibility SaaS providers have with there back-end SaaS infrastructure and the complexity of adding new public or private clouds to support growth. Scalable: The scalability of selected security controls will determine future limitations on application growth. 6
Automating Security & Compliance with CloudPassage Halo CloudPassage built the Halo security platform from the ground up specifically to help security teams address protection and compliance in cloud hosting infrastructure. Halo provides automated security that enables SaaS providers to realize the business benefits of cloud and software-defined data center infrastructure, including IT automation, self-service provisioning, scalability, optimized resources, and cost savings. With Halo, SaaS providers get all the security they need to protect their SaaS infrastructure against the latest cyber threats. The Halo platform delivers configuration security monitoring, software vulnerability assessment, file integrity monitoring, dynamic firewall automation, twofactor authentication, server account management, and event logging and monitoring all centrally managed through a single console. Halo Platform 1010101 0101010 Configuration Security Monitoring Software Vulnerability Assessment File Integrity Monitoring Dynamic Firewall Monitoring Multi-factor Authentication Server Account Management Security Event Alerting REST API Integrations Figure 2: CloudPassage Halo consolidates critical controls and delivers defense in depth With Halo s unique architecture that was purpose-built for cloud security and compliance, SaaS providers can fully realize the promise of cloud computing while giving their customers the confidence to use their solutions. Halo Architecture The Halo platform consists of three components: 1. The Halo Daemon is a lightweight (~6 MB), secure software connector that is installed on cloud instances, virtual machines, or bare metal servers. It collects data using cloud-aware protocols, provides information to the Halo Grid, and enforces compliance based on pre-configured or customized security policies. 2. The Halo Grid is a cloud-based, elastic security analytics engine hosted by CloudPassage that provides analytics, storage, and reporting of important security factors based on data collected by 7
the Halo Daemons. The Halo Portal is the single pane of glass used to manage all Halo product capabilities across all servers cloud, virtual, and traditional hardware systems, wherever they are hosted. 3. Halo s grid computing architecture delivers multiple security capabilities with minimal impact to servers. The Grid does the heavy lifting for the Daemons to preserve virtual guest resources and performance. Halo also provides extensive API capabilities to allow integration with cloud management and IT automation tools, such as RightScale, Puppet, and Chef, and with event management tools, exporting data to SIEM, Log Management, or GRC tools. Halo Runs Anywhere Almost all SaaS hosting infrastructure includes a mix of computing platforms. Halo can secure SaaS hosting infrastructure in private data centers, public clouds, and hybrid infrastructure, as well as virtual and bare metal servers. It deploys as a single solution that works across multiple cloud platforms and providers including: CloudPassage Halo Cloud Services www db HALO HALO Any Public Cloud www HALO db HALO User Portal www HALO db HALO Policies, Common DS, Reports Windows Server Hyper-V Security Analytics Compute Grid REST API Gateway Private Cloud Virtualized or bare-metal data center Figure 3: CloudPassage Halo architectural overview 8
By working on any cloud or virtual platform, Halo enables consistent security across these heterogeneous computing environments. SaaS providers get the control they need to create consistent server security policies and the visibility to assess their true assurance posture across all infrastructure devices. Together, these capabilities enable superior security and allow SaaS providers to demonstrate compliance with regulations, giving customers assurance that they will meet compliance requirements. Automation and Portability Halo makes security and compliance easy to implement with transparent, automated security provisioning as part of the stack, implemented in real time as cloud servers are created or cloned. Halo s group-based management framework ensures the right policies are assigned based on the type of server deployed. And out-of-the-box security policy templates are provided for common regulations and numerous security best practices. As a SaaS solution, Halo deploys quickly and easily with no security hardware or software required. It is the only security product on the market to work in any virtual and cloud environment. Halo does not require changing network architectures, data center firewall configurations, or server and application traffic routing. Because no hardware procurement or deployment is required, Halo deploys very rapidly, often to thousands of servers within just hours. Halo allows SaaS providers to secure all of their cloud infrastructure with a purpose-built architecture that enables them to achieve the promise of cloud computing and deliver increased Return on Investment (ROI) across their cloud environments. Halo uses metered usage-based billing that maps directly to hourly infrastructure usage, ensuring that security and compliance cost reflects actual use. This hourly utility model allows SaaS providers to more accurately incorporate the costs of security and compliance into their business models. SaaS providers have taken different journeys to offering SaaS applications and each has its own customer focus. For example, software companies moving from shipped or downloaded products to SaaS subscriptions have the new challenge of protecting customer data in their SaaS environment. And SaaS providers serving enterprise markets have greater customer demands for compliance with industry standards and regulations. But regardless of the differences between providers, CloudPassage understands that security and compliance are major success factors that SaaS product and technology teams must manage. With Halo, SaaS providers get automated security that delivers the visibility, control, and assurance they need to enable their SaaS business. 9
Conclusion SaaS is unquestionably the new model for software delivery to both consumers and businesses. Speed to market, recurring revenue, and lower customer acquisition costs are just a few of the vendor benefits motivating companies to offer SaaS solutions, forever changing the software industry. And SaaS solutions offer customer benefits as well, such as fast implementation, ease of deployment and maintenance, and lower upfront costs. But these benefits alone are not enough to make a SaaS solution successful. Security and compliance are critical to a profitable SaaS offering. Concern over cloud security is still a top inhibitor to SaaS adoption. But when security is done well, it enhances the SaaS application brand, making the SaaS provider more respected and competitive. When security is done right, it not only provides the essential protection against cyber threats, it also supports cloud operations to allow SaaS providers to realize the benefits of their cloud environments. Traditional security solutions were not designed for cloud environments and their need for manual configuration and review defeats the benefits that are achieved through cloud infrastructure. CloudPassage Halo was purpose-built to protect cloud environments. Halo provides a broad set of security capabilities critical to protecting application, database, and analytics servers and meeting compliance regulations. And these security capabilities are delivered with automation, portability, and scalability to support the dynamic nature of cloud infrastructure. Showing a Halo deployment to customers and prospects is often a dramatic and convincing display of deep commitment to real-world protection and achieving regulatory compliance. With CloudPassage Halo, SaaS providers give prospects the confidence to adopt their SaaS solution, knowing their sensitive data will remain secure and support will be provided for their compliance audits. Protecting customer data with Halo is a fast, economical approach to demonstrating serious commitment to security and compliance. CloudPassage has deployed Halo at some of the largest SaaS enterprises in the world. The benefits seen in these deployments have been consistent and immediate. Competitive SaaS offerings demand product development agility and scalability to absorb growth quickly. Halo s built-in automation, portability, and scalability means security does not slow down progress and can grow along with a SaaS vendor s business. 10
Learn More Halo is an easily deployed SaaS solution that takes less than ten minutes to get up and running and can extend protection to your cloud, virtual, and bare metal servers in just a matter of hours. Visit our webpage on security and compliance for SaaS solutions: cloudpassage.com/saas Or try Halo free for 30 days: cloudpassage.com/halo About CloudPassage CloudPassage is the leading cloud infrastructure security provider and creator of Halo, the industry s only security and compliance platform purpose-built for virtualized and cloud infrastructure environments. Halo operates seamlessly across public, private and hybrid clouds as well as traditional hardware devices. Industry-leading companies trust Halo to protect their cloud and software-defined datacenter environments. Headquartered in San Francisco, CA, CloudPassage is backed by Benchmark Capital, Tenaya Capital, Shasta Ventures, and other leading investors. CloudPassage and Halo are registered trademarks of CloudPassage, Inc. 11