Eliminating SaaS Shadow IT is Now Available via a Self-Service Product, Free of Charge

Jan 28, 2023The Hacker News

The use of software as a service (SaaS) is experiencing rapid
growth and shows no signs of slowing down. Its decentralized and
easy-to-use nature is beneficial for increasing employee
productivity, but it also poses many security and IT challenges.
Keeping track of all the SaaS applications that have been granted
access to an organization’s data is a difficult task. Understanding
the risks that SaaS applications pose is just as important, but it
can be challenging to secure what cannot be seen.

Many organizations have implemented access management solutions,
but these are limited in visibility to only pre-approved
applications. The average medium-sized organization has hundreds,
and sometimes thousands, of SaaS applications that have been
adopted by employees who needed a quick and easy solution or found
a free version, completely bypassing IT and security. This leads to
a significant risk as many of these applications do not have the
necessary security and/or compliance standards and yet, they have
permissions into the organization.

Democratizing SaaS Discovery

The risks associated with SaaS Shadow IT have become more
prevalent in recent years due to the widespread use of SaaS within
organizations. However, many of the security solutions that were
available in the past focused on making security teams aware of the
problem, rather than providing in-product or automated remediation
capabilities. Indeed, the first step in addressing SaaS-related
risks is to have a clear understanding of the SaaS stack in use
within the organization. This information should be easily
accessible and just as simple to navigate as the SaaS applications
themselves.

To help security teams gain proper visibility and understanding
of the risks associated with the growing use of SaaS, Wing Security
(Wing) has decided to offer its SaaS Discovery tool as a free,
self-service product, as can be seen here^[2]. The company aims to
provide security teams with a comprehensive view and better
understanding of the SaaS applications used within their
organization, regardless of their size or the size of their
budget.

What is included in the Wing Security Free
edition?

• Quick and easy self onboarding.
• Friendly dashboard view of the SaaS applications being used
  within the organization, 3rd party applications included.
• Risky applications are flagged within the system
• Details of which compliances each SaaS application meets, how
  they’re connected to the organization, the permissions they’ve been
  granted, and which users are using them (for the first 100
  applications).
• Wing Security’s reputation score for each SaaS application
  expressed as “shields” with 0 to 3 shields.
• Classification and tagging options.

Wing Security Free edition.

Non-Intrusive Discovery: No agent, no
proxy

Understanding that modern security solutions should not be
intrusive in any way is at the core of Wing Security’s new
offering. To map out an organization’s use of SaaS applications,
Wing connects to major, IT-approved SaaS applications using APIs.
These are applications that are commonly used in almost every
environment, such as Google, Office 365, Salesforce, GitHub, and
Slack, to name a few.

Wing is then able to map out all the SaaS applications that are
connected to these applications and the ones connected to them.
SaaS applications are interconnected in a giant mesh, creating a
“shadow network” of connections. This shadow network is used by
Wing to map out applications, but it can also be a security concern
as it can be used for lateral movement within the organization. In
its full enterprise offering, Wing also maps out all the users who
use these applications, the data that resides in and between these
applications, and provides near-real-time security alerts when an
application in use is compromised.

Wing Security ‘Connects’ to SaaS applications through APIs

What’s required from the users?

Keeping in tune with Wing Security’s non-intrusive Discovery,
the Wing Security Free edition requires very basic permissions
which can be granted by the organization’s super admin.

Most of the required permissions are read-only. There is one
permission within Google that requires a ‘manage’ access, asked in
order for Wing to provide visibility into the tokens that users
issued to 3rd party apps. Wing Security mentions on the relevant product
page^[3] that keeping the
customers’ data safe is a priority and provides the compliances
they have in place for data security.

What counts as ‘SaaS’?

While the term SaaS traditionally stood for
Software as a
Service, not all SaaS these days is always paid
for as use of the word ‘Service’ might imply.
There are 3 types of common SaaS used these days:

• Widely used enterprise SaaS such as Stack, Dropbox, Google,
  Microsoft, that mainly consist of paid users.
• Niche-use, somewhat lesser known SaaS that target specific
  industries, such as Figma or Canva for design, Outreach for sales,
  Github for engineers. Wing for SaaS Security. These SaaS users can
  include both paid and non-paid users.
• Completely free apps used by individuals, probably without
  anyone else knowing about it. Also includes apps that were signed
  up for their free trials and forgotten about for whatever
  reason.

While these are the 3 main types of SaaS applications, they are
more like markers on a spectrum. SaaS applications regularly move
up and down this spectrum as the companies grow and evolve. But as
long as these applications are logged into using the organization’s
email, they’ll be discovered by Wing Security Free Discovery.

What is further available with Wing Security’s paid
version?

Wing Security’s paid version is called the Wing Security
Enterprise edition, which includes everything from the Free
edition, as well as:

• Deeper SaaS discovery which includes discovery of all browser
  extensions and any kind of locally installed or in-house developed
  SaaS applications
• Monitoring for any sensitive data being shared on SaaS
  applications. For example: AWS keys shared on public slack
  channels.
• Manage user related risks such as excessive permissions, user
  inconsistencies, or abnormal usage.
• Real-time threat intelligence alerts and actionable updates in
  the event any SaaS apps being used within the organization are
  party to a breach or cyberattack.
• Remediation tools. Many of the issues discovered by Wing
  Security can be resolved with just a few clicks within Wing’s
  easy-to-use interface, without having to deal with solving it
  manually.
• Built-in Automation tools. Some SaaS security issues can be
  wide reaching, with thousands of instances of the same issue
  repeatedly found. Manually attempting to fix the issue could take
  years! Wing’s built-in automation tools make it possible to solve
  such cases in minutes, with just a few clicks. With long term
  protection activated by setting up a policy which Wing Security
  then helps invoke, as new instances of the same issue are likely to
  appear again in the future.
• End-user engagement. A nice added detail within the Wing
  interface is that the automation can be set up to include keeping
  the end users in the loop. Either by simply informing them of the
  issue and how it was fixed, or by letting them click ‘Approve’ to
  let the issue be solved by the automation. In the event users
  ignore or miss the message, a default is in place to automatically
  ‘Approve’ the task after a set amount of time.

In summary, Wing Security’s new tool addresses the growing use
of SaaS and the security and IT challenges it poses, by tracking
the SaaS applications that have been granted access to an
organization’s data. The free edition includes a quick and easy
self-onboarding process, a friendly dashboard view of the SaaS
applications in use, risky applications notice, compliance and
permissions information, and a reputation score for each
application. The tool uses a non-intrusive method, connecting to
major IT-approved SaaS applications using APIs, to map out an
organization’s use of SaaS applications without causing any
disruption.

For more information on Wing Security’s new Free SaaS Discovery
solution, click here^[4].