Cloud or SaaS for Cyber Security

In this article, we talk you through these key areas and discuss the measures involved in making sure your activity is as secure as possible.

What is cloud computing?

What was once considered to be somewhat of a phenomenon back when it was introduced in 2006, cloud computing is now mainstream. It essentially involves delivering computing services, including servers, storage, databases, networking, software, analytics and intelligence via the internet or ‘the cloud.’

While they may be closely interlinked, the cloud and Software as a Service (SaaS) aren’t the same thing, although it can be easy to assume that they are. (For more on the main differences between the two, keep reading). 

As for understanding Cloud or SaaS for Cyber Security and how the cloud operates, here are some examples of what it’s made up of:

• Virtual computers/servers
• Data storage capacity
• Communications and messaging capacity
• Network capacity
• Development environments

What is Software as a Service?

SaaS is a software delivery model, or application, that operates within the cloud. However, it isn’t the cloud. SaaS is available as a full-blown application or it can exist as a component of something else. However, it’s important to clarify here that it’s not used to build applications and it doesn’t exist within servers and data storage.

Instead, SaaS applications work by operating within the vendor’s data centre. Generally speaking, to use SaaS, you have to log into the vendor’s website in order to use it. Examples of well-known SaaS applications include:

• Buffer
• Dropbox 
• HubSpot 
• Microsoft 365 (Cloud-based)
• Slack
• Amazon Web Services
• Salesforce
• G Suite 

The difference between SaaS and cloud computing 

As we’ve just highlighted, while they may be classed as being the same thing, and there are some correlations between the two, SaaS and cloud computing aren’t the same.

SaaS is a component of cloud computing, which is made up of three main components; SaaS (as we’ve just mentioned), Infrastructure as a Service (IaaS) and Platform as a Service (PaaS).

To put it simply, SaaS is the application layer, i.e. any form of software you can run that’s not on your premises. Most SaaS products are run via a web browser or similar and hosted in the cloud. SaaS isn’t a plugin and does not sit on your devices. 

In comparison, cloud computing runs in the cloud and enables companies to access multiple applications online via SaaS. Needing an internet connection to properly run the service is a key indicator that the application is cloud-based.

To clarify things even further, cloud computing is used by more technical users – e.g. software developers, application vendors and corporate IT departments. It’s not aimed at or used by people who simply use computer applications.

Cloud and SaaS cybersecurity 

For all the benefits, for instance, more agile and scalable internal infrastructures and enhanced collaboration, there are some risks to using cloud computing and SaaS. This is due to the fact that both solutions are at risk of being affected by cybercrime, and with cybercrime on the rise, so too are the risks of security attacks taking place.

Cloud computing and SaaS cybercrime-related risk concerns tend to stem from compromised network security, including data leakage, service outages, ransomware and unauthorised internal access. At the end of the day, sharing and accessing critical information in the cloud has its advantages, but it can also make networks less secure and more susceptible to cyberattacks. (For more on the different types of cybersecurity breaches, including the financial impact, read ‘The real cost of cybersecurity breaches.’)

Furthermore, when it comes to cloud computing, there can sometimes be confusion over whose responsibility it is to safeguard data. While some cloud vendors may promote their desire to maintain user safety, it can be easy to assume they are providing the relevant in-cloud security, which isn’t always the case. These uncertainties can cause confusion over whether vendors or CISOs should implement security measures, opening up vulnerabilities in the meantime. 

However, for all the risks, there are measures CISOs can take to secure their individual cloud services. These include implementing the latest cloud security measures, such as Cloud Security Posture Management (CSPM) & Cloud Access Security Brokers (CASBs), to name a few. Not only do they enable companies to access and manage their data, they can be used to authenticate devices, audit users and ensure adherence to compliance standards.

Meanwhile, when it comes to SaaS, security measures are implemented by the provider. They are responsible for securing the platform, network, applications, operating system and physical infrastructure. They are not responsible for securing customer data or user access. The level of security varies from provider-to-provider.

Should a CISO choose SAAS or Cloud?

When it comes to being cybersecure, neither cloud computing or SaaS is more or less secure than on-premises security due to the fact that human mistakes will always occur. In fact, 95% of cybersecurity breaches are reportedly caused by human error.

However, for all the risks, there are numerous cybersecurity practices and procedures that have been specifically designed to help reduce the risk of SaaS and cloud computing activities being intercepted by cyber hackers.

SaaS or cloud: Risks exist 

There are cybersecurity-related risks when it comes to using both SaaS and cloud computing to do your everyday work. The main thing is that you are aware of them and the fact there are cybersecurity solutions out there to help protect you and your business from the threat of cyberattacks.

Are your SaaS and cloud computing services as cybersecure as they possibly can be? To find out, contact us on 01252 917000 or enquiries@bluefort.com. Alternatively, you complete our short contact form.