SaaS: Sell assets and Soul?

SaaS: Sell assets and Soul?

Speakers: Jason Rumengan, Senior Consultant

Conference: CrikeyCon

YouTube: https://www.youtube.com/watch?v=Esjnn1iWptI

Overview

In his CrikeyCon talk, "SaaS: Sell assets and Soul?", Jason Rumengan, a Senior Consultant specializing in cybersecurity assurance and risk management, delivers a crucial message for organizations grappling with the pervasive adoption of Software as a Service (SaaS) platforms. Rumengan opens with a cautionary tale of an unnamed organization that entrusted its most critical business processes and sensitive data to a SaaS provider, only to discover significant security gaps, including a complete lack of security event monitoring. This alarming scenario, where a hacker could have exfiltrated data undetected, underscores the talk's central premise: without proper oversight, SaaS can quickly transform into "Selling Assets and Soul."

The presentation serves as a vital guide for organizations to navigate the complexities of third-party risk in the cloud era. Rumengan argues that while SaaS offers undeniable benefits in terms of cost-effectiveness and ease of use, it fundamentally shifts the burden of control, placing an immense amount of trust in external vendors. His talk is particularly relevant in an environment where cloud adoption is no longer a nascent trend but a ubiquitous reality, often driven by business needs without adequate security consideration.

The core objective of Rumengan's talk is to empower businesses with actionable strategies to prevent similar catastrophic oversights. He meticulously outlines a structured approach to Third-Party Risk Management (TPRM) tailored for SaaS, covering everything from initial risk assessments and vendor due diligence to contractual negotiations, continuous monitoring, and effective offboarding strategies. This comprehensive framework is essential for any organization aiming to leverage the benefits of SaaS while rigorously protecting its invaluable information assets and maintaining its operational integrity.

Background

▶ Watch: SAS: Selling Assets and Soul - a cautionary tale (2:00)

The widespread adoption of cloud computing has fundamentally reshaped how organizations acquire and manage their IT infrastructure and applications. As Rumengan notes, this shift, though perhaps "5 to 10 years late" for some, has seen businesses transition from capital expenditures (CAPEX) on physical servers to operational expenditures (OPEX) on cloud services. This model offers agility, scalability, and reduced overhead, making it incredibly attractive. Within the cloud spectrum, Infrastructure as a Service (IaaS) provides raw compute and storage, Platform as a Service (PaaS) offers an operating system and development environment, but Software as a Service (SaaS) stands out as the most popular and ubiquitous. SaaS applications, accessible simply via a web browser, eliminate the need for organizations to manage underlying infrastructure, operating systems, or even the application itself, offering unparalleled ease of use.

However, this convenience comes at a significant cost to control, a concept best illustrated by the shared responsibility model. While the business side often perceives the light blue portions of this matrix (representing vendor responsibilities) as "not my problem anymore," technical professionals understand the profound implications. For SaaS, the vendor is responsible for almost everything, from the physical infrastructure to the application layer. This means organizations are entirely entrusting their data to the vendor, relying on their controls and practices. Rumengan emphasizes that while much is offloaded, critical responsibilities remain with the client. These include identity and access management (IAM) (e.g., user provisioning, strong authentication), endpoint security (securing devices accessing the SaaS platform), and privacy and data management (understanding what data is placed in the cloud and its associated risks). Failure to manage these client-side responsibilities, such as a stolen credential leading to unauthorized access, remains the client's problem, not the vendor's.

The inherent loss of direct control over core security functions within a SaaS environment creates a critical need for robust third-party risk management. Traditional cybersecurity frameworks like ISO 27001 and the new NIST Cybersecurity Framework, alongside regulatory bodies such as the Australian Prudential Regulation Authority (APRA) with its CPS234, increasingly highlight third-party risk as a paramount concern. The problem exists because the business imperative to adopt convenient and cost-effective SaaS solutions often outpaces the security team's ability to adequately assess, contractually bind, and continuously monitor these external entities, leaving organizations vulnerable to the very risks they sought to mitigate by moving to the cloud.

Key Findings

▶ Watch: Third-party risk management framework for trustworthy vendors (6:00)

The central finding of Jason Rumengan's talk is that the pervasive adoption of SaaS without stringent Third-Party Risk Management (TPRM) fundamentally transforms Software as a Service (SaaS) into "Selling Assets and Soul." This dramatic redefinition highlights the severe consequences organizations face when they fail to adequately vet and govern their SaaS providers, potentially leading to the compromise of sensitive data (assets) and irreversible damage to reputation and operational capability (soul).

The talk outlines a critical framework for mitigating this risk, emphasizing that effective TPRM for SaaS is not a one-time activity but a continuous lifecycle process. Key findings and contributions include:

1. The Criticality of a Structured Risk Assessment: Organizations must first understand why they are using a SaaS platform and what kind of data they are entrusting to it. This involves assessing the software's purpose (critical vs. non-critical business process), classifying data based on Confidentiality, Integrity, and Availability (CIA) impacts, and identifying relevant compliance requirements (e.g., Privacy Act for personal information, health information regulations). This assessment dictates the necessary control requirements for the vendor.

1. Navigating the "Risk Appetite" and Control Over-Engineering: Rumengan introduces the concept of risk appetite, stressing the importance of aligning security controls with an organization's willingness to take risks. Over-engineering controls can lead to an inability to find suitable vendors, while under-engineering leaves the organization exposed. Critically, he notes, "You don't have to mitigate a risk you don't take," suggesting that for extremely high-risk scenarios, alternative deployment models (on-premises, PaaS, IaaS with more client control) might be preferable.

1. Prioritizing Independent Assurance in Vendor Due Diligence: The talk identifies a hierarchy of assurance for vetting vendor security:

• Highest Assurance: Independent audits (e.g., ISO 27001 certification, SOC 2 report). These provide objective, third-party validation.
• Medium Assurance: Vendor security whitepapers or glossy marketing materials, which, while self-attested, provide written commitments.
• Lowest Assurance: Direct inquiries/phone calls, which are prone to ad-hoc responses and offer minimal accountability.

1. Contractual Agreements as the Cornerstone of Accountability: Rumengan underscores that the End User License Agreement (EULA) and other contracts are legal documents that must be thoroughly reviewed, ideally with legal counsel. Key contractual elements include:

• Data Management and Sovereignty: Clear ownership of data and explicit commitments regarding data location (e.g., "won't leave Australia").
• Adherence to Standards: Requiring vendors to maintain specific certifications (ISO 27001, SOC 2).
• Specific Controls: Mandating incident response plans, disaster recovery (DR) capabilities, and service level agreements (SLAs) (e.g., 99.9% uptime).
• Assurance and Remedies: Provisions for ongoing audits and compensation (e.g., service credits) if commitments are not met.
• Offboarding: Explicit clauses for data destruction, anonymization, and export upon contract termination.

1. Continuous Monitoring is Non-Negotiable: Risk management is not a "once-off" event. Vendors' security postures can change, new regulations emerge, and data value evolves. Regular monitoring (e.g., annually or biannually) is crucial, again leveraging independent assurance documentation where possible.

1. Proactive Internal Engagement and Documentation: Beyond external vendor management, organizations must document their TPRM processes, engage internal stakeholders (procurement, finance, business units), record risk assessments and vendor details, and provide training. This ensures that security considerations are embedded early in the software acquisition lifecycle and that internal teams are supported in making secure choices.

In essence, Rumengan's talk provides a comprehensive blueprint for organizations to reclaim control and build resilience in an increasingly SaaS-dependent world, moving beyond blind trust to informed, managed risk.

Technical Deep Dive

▶ Watch: Continuous monitoring and incident response planning (18:00)

Jason Rumengan's talk delves into a methodical, multi-faceted approach to managing the security risks associated with Software as a Service (SaaS) platforms. This technical deep dive outlines the critical steps an organization must take, from initial assessment to ongoing management and eventual offboarding.

The process begins with a thorough risk assessment to understand the implications of using a particular SaaS solution. This involves identifying the software's purpose—whether it supports a critical business process (e.g., an organization's "lifeblood") or a less sensitive function (e.g., a marketing tool). The purpose directly influences the type and sensitivity of data that will be processed. Data is then analyzed against the triumvirate of Confidentiality, Integrity, and Availability (CIA). For instance, public marketing material might have low confidentiality risk but high availability risk, while a certification register might have low confidentiality risk but high integrity risk if entries can be altered. Organizations must also identify specific compliance requirements driven by legal mandates, such as the Privacy Act for personal information or regulations for health data. These factors collectively determine the specific control requirements that the SaaS vendor must meet, which may be more stringent than internal controls.

A crucial concept introduced is risk appetite—the level of risk an organization is willing to accept. This helps avoid both "overcooking" controls (demanding an unachievable level of security, potentially finding no suitable vendors) and "undercooking" them (accepting inadequate security). The talk also highlights the strategic option of risk avoidance: if a SaaS platform's inherent risks are too high, an organization might opt for an on-premises solution or a PaaS or IaaS model, where they retain greater control over security configurations.

Once control requirements are defined, the next step is vendor due diligence to ascertain a potential vendor's security posture. Rumengan outlines a hierarchy of assurance:

1. Independent Audit Reports: The highest level of assurance comes from third-party certifications like ISO 27001 or SOC 2. These provide objective, validated evidence of a vendor's security controls.
2. Vendor Security Whitepapers: These are self-attested documents detailing the vendor's security practices. While better than nothing, they lack independent verification.
3. Direct Inquiries: Simply calling the vendor with security questions provides the lowest assurance, as responses can be ad-hoc and lack formal commitment. The choice of assurance level depends directly on the sensitivity of the data and the associated risk.

The contractual agreement is presented as the backbone of vendor accountability. Rumengan stresses the importance of engaging legal teams to review End User License Agreements (EULAs) and other contracts, rather than simply accepting default terms. Key clauses to scrutinize include:

• Data Management and Sovereignty: Who legally owns the data (it should remain with the client) and where it will be stored and processed (e.g., "won't leave Australia" for certain sensitive data). This also addresses concerns about data being fed into Generative AI models without explicit consent or opt-out options.
• Industry Standards: Mandating that the vendor maintains certifications like ISO 27001.
• Specific Controls: Explicitly detailing requirements for incident response plans, disaster recovery (DR) capabilities (e.g., failover mechanisms, guaranteed service level agreements (SLAs) like 99.9% uptime), and security event monitoring. The talk also mentions the Security of Critical Infrastructure (SOCII) Act in Australia, which may impose specific requirements for vendors handling critical infrastructure data, including foreign ownership, control, or influence (SOCI).
• Assurance Mechanisms: How the client can verify ongoing compliance (e.g., right to audit, review of independent reports).
• Remedies: What compensation (e.g., service credits) is provided if the vendor fails to meet contractual obligations.
• Support: Defined channels and hours for technical support.

Beyond initial procurement, ongoing monitoring is crucial. This is not a "set it and forget it" process. Rumengan advises regular monitoring (e.g., annually or biannually), especially if data value changes or new regulations emerge. Monitoring methods mirror initial due diligence: commissioning audits, reviewing updated independent assurance documentation, or simply requesting attestations (which offer the lowest assurance).

Finally, the talk addresses managing incidents and offboarding. For incidents, organizations must ensure vendors have robust incident response and DR processes. The client's own plan should, at minimum, include vendor contact details and interim paper-based processes, acknowledging that direct intervention in a SaaS environment is impractical. If a vendor's security posture deteriorates or contractual obligations are breached, organizations can pursue amicable discussions, invoke contractual remedies (like service credits), or implement compensating controls. These client-side controls might involve tokenization, masking, or hashing sensitive data before it even reaches the vendor, effectively giving them "dummy" data. As a last resort, organizations must be prepared to leave the vendor. Offboarding clauses should dictate clear data destruction or anonymization, and ensure data exportability for migration to a new platform. This prevents vendors from retaining or misusing sensitive client data post-contract.

This technical deep dive provides a structured, comprehensive approach to embedding security into the entire lifecycle of SaaS adoption, emphasizing proactive risk management and strong contractual governance.

Demo / Proof of Concept

▶ Watch: Securely offboarding vendors and managing data export (22:00)

This talk, "SaaS: Sell assets and Soul?", is an advisory and educational presentation focused on strategic Third-Party Risk Management (TPRM) and contractual considerations for Software as a Service (SaaS). As such, it does not include a live demonstration or a technical proof of concept of any exploits or tools. Instead, Jason Rumengan's presentation leverages real-world examples and a structured framework to illustrate the principles of securing SaaS environments. The "proof" of his concepts lies in the logical progression of risk management steps and the detailed articulation of what organizations should be doing to prevent the cautionary tales he describes.

Defensive Implications

▶ Watch: Practical next steps for implementing vendor risk management (26:00)

The defensive implications of Jason Rumengan's talk are profound, offering a comprehensive strategy for organizations to protect their assets and reputation in a world increasingly reliant on Software as a Service (SaaS). The core message is clear: proactive, continuous Third-Party Risk Management (TPRM) is not optional but essential.

1. Proactive Risk Assessment and Control Definition: Defenders must embed a rigorous risk assessment process at the very outset of any SaaS adoption. This includes:

• Data Classification: Understand the sensitivity of data being processed (e.g., personal information, health records) and its impact on Confidentiality, Integrity, and Availability (CIA).
• Compliance Mapping: Identify all relevant legal and regulatory obligations (e.g., Privacy Act, APRA CPS234, SOCII Act) that dictate control requirements.
• Risk Appetite Alignment: Ensure the chosen SaaS solution's security posture aligns with the organization's acceptable level of risk, avoiding both over- and under-engineering of controls. For highly sensitive data, consider alternatives to SaaS (PaaS, IaaS, on-premises) if the risk is deemed too great.

2. Robust Vendor Due Diligence: Prioritize independent validation of vendor security claims.

• Demand Independent Audits: Always seek ISO 27001 certification or SOC 2 reports as the highest form of assurance. If not available, understand the increased risk.
• Scrutinize Whitepapers: Review vendor security whitepapers for detailed control descriptions, but recognize they are self-attested.
• Avoid Ad-hoc Inquiries: While direct questions are necessary, do not rely solely on verbal assurances.

3. Comprehensive Contractual Governance: The contract is the primary defensive mechanism.

• Engage Legal Counsel: Never "TLDDR" (too long, didn't read) End User License Agreements (EULAs). Work closely with legal teams to negotiate and understand all terms.
• Define Data Ownership and Sovereignty: Ensure contracts explicitly state client ownership of data and define geographic storage/processing locations, especially for data with sovereignty requirements (e.g., "won't leave Australia").
• Mandate Specific Controls and Standards: Include clauses requiring incident response plans, disaster recovery (DR) capabilities (including service level agreements (SLAs) like 99.9% uptime), regular security event monitoring, and adherence to certifications like ISO 27001.
• Establish Assurance and Remedies: Define how the organization can verify ongoing compliance (e.g., right to audit, review of assurance reports) and what compensation (e.g., service credits) is due for non-compliance.
• Plan for Offboarding: Crucially, specify data destruction, anonymization, and export procedures upon contract termination to prevent data retention or misuse.

4. Continuous Monitoring and Adaptability: Security is not static.

• Regular Reviews: Implement annual or biannual reviews of vendor security postures, especially when data value changes or new regulations are introduced.
• Review Assurance Documentation: Continuously review updated independent audit reports (e.g., annual SOC 2 renewals) to track changes in vendor controls.
• Incident Response Integration: Ensure the organization's own incident response plan includes clear procedures for contacting SaaS vendors and establishing interim processes (e.g., paper-based workflows) during outages, acknowledging the limited direct control over SaaS infrastructure.

5. Implementing Compensating Controls: When direct vendor control is lacking or trust is compromised.

• Data Protection at Source: Employ tokenization, masking, or hashing to desensitize or anonymize highly sensitive data before it is sent to the SaaS provider, giving them only "dummy" or obfuscated information. This significantly reduces the impact of a vendor breach.

6. Internal Process Fortification: Beyond external vendor management, internal processes are key to defense.

• Document TPRM Processes: Formalize and document all steps for SaaS vendor assessment, selection, and management to ensure consistency and knowledge transfer.
• Cross-Functional Engagement: Collaborate with procurement, finance, and business units to integrate security requirements early in the software acquisition lifecycle.
• Record Keeping: Maintain a comprehensive register of all SaaS vendors, the data entrusted to them, and associated risk assessments.
• Training and Awareness: Educate internal teams on the importance of SaaS security, the TPRM process, and how to engage the security team for support, fostering a culture where security is a shared responsibility.
• Proactive Review of Existing Vendors: Conduct an immediate review of all current SaaS vendors to identify any "suspicious" providers requiring closer scrutiny.

By meticulously implementing these defensive strategies, organizations can transform the inherent risks of SaaS into manageable challenges, safeguarding their assets and soul from potential compromise.

Key Takeaways

• SaaS is "Selling Assets and Soul" without proper Third-Party Risk Management (TPRM). The convenience of SaaS offloads control, making robust vendor oversight essential to protect sensitive data and organizational integrity.
• Data Sensitivity Determines Control Requirements. A thorough risk assessment, classifying data by Confidentiality, Integrity, and Availability (CIA) and accounting for compliance, dictates the specific security controls a SaaS vendor must have.
• Contracts Are Your Primary Defense. Never skip reading End User License Agreements (EULAs). Work with legal to ensure contracts explicitly cover data ownership, sovereignty, adherence to standards (e.g., ISO 27001, SOC 2), incident response, disaster recovery, SLAs, assurance mechanisms, and offboarding procedures.
• Risk Management is Continuous, Not a One-Off Event. Vendor security postures, data value, and regulations evolve. Implement regular monitoring (e.g., annual reviews) using independent assurance documentation to ensure ongoing compliance and address changes.
• Prepare for the Worst-Case Scenario. Have clear plans for responding to vendor incidents (including client-side interim processes) and for managing departures, ensuring data destruction, anonymization, or export. Consider compensating controls like tokenization for highly sensitive data.
• Embed Security Throughout the Organization. Document TPRM processes, engage cross-functional teams (procurement, finance), record all vendor assessments, and provide ongoing training to ensure security is a shared responsibility, preventing costly breaches.

About the Speaker(s)

Jason Rumengan is a Senior Consultant specializing in cybersecurity assurance, advisory, and risk management. His work primarily focuses on the government and public sector, where he helps organizations understand and implement cybersecurity controls. Rumengan describes his role as someone who understands how to "tinker and tailor and deal with cyber security controls," recognizing what they should be. He humorously notes that he's "probably not naughty enough" to be a penetration tester, indicating a focus on defensive and governance aspects of cybersecurity. His expertise lies in translating complex security requirements into actionable strategies for organizations, particularly in managing the risks associated with cloud adoption and third-party vendors.