What is SSPM? Explaining the security features that support SaaS usage and how it differs from CSPM

SSPM (SaaS Security Posture Management) is a security solution that monitors and evaluates the security settings of SaaS applications used in cloud environments and guides them to the correct settings.

The main functions are

Some examples include:

By introducing SSPM, you can not only continuously prevent cloud configuration errors, but also expect benefits such as reducing operational burden by centralizing SaaS management and reducing the workload for compliance management .

A similar service to SSPM is “CSPM.”
The difference between SSPM and CSPM is the “target of evaluation,” with SSPM evaluating “SaaS” and CSPM evaluating “IaaS/PaaS . “

・SaaS app examples: Google Workspace, Microsoft 365, etc.
・IaaS/Paas app examples: AWS, Azure, Google Cloud Platform, etc.

Like SSPM, there is also a security solution for cloud services called “CASB.”

The two services have different functions and purposes. SSPM specializes in preventing incidents caused by improper SaaS configurations , while CASB specializes in detecting risky behavior of employees using the cloud after the fact .

This article provides a clear explanation of the overview of SSPM and the benefits of its implementation.

What is SSPM?

SSPM is a security solution for monitoring, evaluating, and managing security settings in SaaS (Software as a Service) . The role of SSPM is to identify security issues in SaaS settings that could lead to unauthorized access or information leaks , and to encourage administrators to take appropriate measures.

SaaS is a type of cloud service that allows you to use services online without having to download software or applications to your PC or device.

Some of the most popular SaaS services include:

▼Representative examples of SaaS:
Microsoft 365,
Salesforce,
Google Workspace
, Zoom
, Slack

For example, applications such as Teams, Sharepoint, and OneDrive, which are commonly used in business, are part of the “Microsoft 365” service, which is a SaaS service.

SaaS is now an indispensable tool for businesses due to its convenience: it can be used from any device, anywhere, as long as there is an internet connection.

However, SaaS poses a variety of security risks.

What are the security risks when using SaaS?

Examples of security risks when using SaaS include the following:

Incorrect access permissions

Ideally, access permissions should be set so that each employee can access only the information they need.

If access permissions are not set appropriately and anyone is able to view important information or manage the system, it increases the risk of information leaks and unauthorized access.

In addition, changes to SaaS specifications can change access permission settings, which can make it possible for access from outside the company without you realizing it.

Poor account management

When using SaaS, it is common to create an account for each employee who will use it.

Therefore, when an employee transfers or leaves the company, any accounts that are no longer in use should be deleted promptly.

This is because if the accounts and privileges of employees who have been transferred or left the company are left untouched, there is a risk of information leaks.

In fact, according to the IPA’s “2020 Survey on the Current State of Trade Secret Management in Companies,” the most common route for trade secrets to be leaked was by employees who left their jobs mid-career , which increased from the previous survey to 36.3%.

By using the “SSPM” tool, you can review the security settings of the SaaS your company uses and check whether they comply with the security policies established by your organization and are maintained in a secure state, thereby avoiding the risks mentioned above.

Background of the need for SSPM

The main reasons why SSPM is needed as part of a company’s security measures are:

Examples include:

The SaaS market size is expanding year by year

With the spread of cloud services, the domestic usage rate of SaaS is steadily increasing.

According to a survey by IDC, due to factors such as the impact of COVID-19, there is a growing shift from traditional on-premise environments to the cloud, which is promoting diversification of working styles.

As a result, Japan’s public cloud service market is growing sustainably and is predicted to reach 4 trillion yen by 2026.

The SaaS market is also expanding year by year, and according to a survey of companies that provide SaaS marketing platforms, the domestic SaaS market is expected to grow at an average annual rate of approximately 13% , reaching a market size of approximately 1.12 trillion yen by 2024 .

While the convenience of cloud computing and SaaS continues to grow, malicious attackers are targeting vulnerabilities in the cloud, resulting in an increase in security incidents caused by the cloud.

In the past, there have been cases where companies and local governments have experienced information leaks due to misconfigurations in SaaS.

In January 2021, it was discovered that personal information at 38 local governments and domestic companies had been exposed to external access due to improper configuration of SaaS . The National Center of Incident Readiness and Strategy for Cybersecurity (NISC) has issued a warning to several major infrastructure providers.

The cause of the information leaks in all cases was a “misconfiguration of the scope of disclosure” by the local governments and companies using the services , and this incident once again highlights the “importance of security settings” for cloud services.

To mitigate the risk of information leakage due to cloud service settings, it is effective to use configuration assessment tools such as SSPM and CSPM . It is also important to have a professional diagnostician manually check the correct settings.It may also be effective to take a “cloud security assessment.”

Cloud security assessments have the advantage that even companies without the knowledge or resources can use them with confidence , as they can leave the detailed configuration review to knowledgeable vendors .

The difference between SSPM and CSPM

A service similar to SSPM is “CSPM.”

CSPM (Cloud Security Posture Management), like SSPM, is a security solution that identifies problems in cloud service configurations and prompts administrators to take appropriate action.

The difference between SSPM and CSPM is simply the ” object of assessment .” SSPM assesses SaaS configurations , while CSPM assesses the configuration of the entire cloud infrastructure, including IaaS/PaaS .

As mentioned above, the basic purposes and functions of CSPM and SSPM are similar, and the choice of which to use depends on whether the service being evaluated is “SaaS” or “IaaS/PaaS.”

The difference between SSPM and CASB

Similar to SSPM, there is also a cloud service security solution called a ” Cloud Access Security Broker ( CASB ).” A CASB is a solution that visualizes, controls, and centrally manages employee use of cloud services.

While both SSPM and CASB are cloud security solutions, they differ in scope and functionality.

While SSPM targets SaaS , CASB targets all cloud services, including not only SaaS but also IaaS and PaaS .

A key feature of SSPM is visibility into SaaS misconfigurations, allowing proactive measures to be taken to prevent incidents. CASBs have the ability to detect risky employee behavior in the cloud , and some can even prevent those behaviors.

Depending on their cloud security requirements, businesses should consider which option to choose, or whether to use a combination of both.

Key Features of SSPM

SSPM has three main functions:

1. Evaluating SaaS “security risks”

SSPM assesses SaaS configurations based on the security policies established by the organization.

By detecting misconfigurations and compliance violations in SaaS , you can quickly nip incidents that lead to risks such as unauthorized access and information leaks in the bud.

It is also possible to check whether the current settings comply with the security policies and regulatory requirements that have been pre-established by the organization, enabling companies to comply with security policies and maintain a secure cloud environment.

2. Visualizing security risks

SSPM visualizes security risks in SaaS environments, allowing administrators to understand security settings and risk status at a glance . This allows administrators to immediately check where there are deficiencies in their cloud settings and take appropriate measures.

3. Automatic “regular monitoring” and “analysis”

SSPM regularly monitors SaaS environments, allowing for early detection of new risks. The tool automatically monitors settings, reducing the workload of administrators and enabling more efficient security operations.

In addition, by analyzing the collected data and identifying trends in security risks and compliance violations, it is possible to predict and take measures against risks that may occur in the future.

Benefits of SSPM

By implementing SSPM, you can expect the following benefits:

1. Continuously prevent cloud configuration errors

The first benefit is the ability to continuously monitor and address cloud misconfigurations. SSPM has the ability to automatically monitor SaaS security settings and activity.

SSPM regularly inspects SaaS settings and reports any misconfigurations or risks, allowing you to use cloud services in a “continuous” and safe state. If a problem is detected, it will notify the administrator with a warning or alert.

2. Centralize SaaS management and reduce operational burden

The second benefit is that SSPM allows you to centrally manage security settings and activities for different SaaS.

Information collected from multiple SaaS platforms can be viewed on a single dashboard, enabling administrators to manage security in an integrated and efficient manner.

3. Reduces the amount of work required for compliance management

The third benefit is that it allows you to efficiently check whether your cloud service settings are in compliance.

SSPM monitors SaaS configurations based on pre-defined security policies. Through automated compliance checks, administrators can reduce the amount of work required to manually check rules and review configurations.

Some products can even automatically generate compliance reports, reducing the time and effort required for audits and compliance reporting.

Key points to consider when implementing SSPM

If you are considering introducing an SSPM product, be sure to check the following points in advance.

・Types of SaaS supported
・Response after evaluation
・Support system and update frequency
・Compliance with your company’s security policy

Supported SaaS types

The SaaS that can be evaluated varies depending on the SSPM product.

To avoid introducing an SSPM product only to find that it is not compatible with the SaaS your company uses, be sure to check the types of SaaS it supports.

Post-evaluation response

SSPM products only detect security risks in SaaS and suggest countermeasures, but it is the SaaS administrator who actually takes action, such as changing settings.

Therefore

Choosing a system that has features that help you respond to risks, such as the above, will make operation easier.

Support system and update frequency

Having a support system in place is also very important.

To ensure a smooth response, we recommend products that offer support in Japanese, if possible.

Additionally, SSPM products that are regularly updated will ensure that your monitoring is in line with the latest standards.

Compliance with company security policies

SSPM assesses SaaS configurations based on the security policies established by the organization.

Therefore

Check whether the evaluation can be conducted in accordance with the security policies and regulatory requirements that have been agreed upon in advance by your organization, such as whether the system can address the following:

SSPM implementation flow

We will introduce SSPM in the following six steps.

1. Understanding the security status of the SaaS used in your company and identifying needs and requirements

First, evaluate the SaaS your company uses to identify potential vulnerabilities.
At the same time, clarify the legal, regulatory, and compliance requirements that each company or organization must adhere to.

2. Select an SSPM

Compare multiple SSPM solutions and choose one that best suits your company’s size and security needs. Consider the tool’s features, supported SaaS, scope of application, customizability, and support system.

If possible, we recommend trying out the free version to see how it works.

3. Formulate an implementation plan

Create an implementation plan by considering specific schedules, tasks, and division of roles for each person in charge. Also, schedule employee notifications and training.

There will be some implementation costs involved, so be sure to clarify your budget as well.

4. Introduction of SSPM

We will deploy the selected SSPM in your company’s production environment, including various settings, configurations, and integration with existing SaaS.

Verify that it works correctly and that the diagnostic items are being investigated as expected.

5. Education for personnel

We provide training to personnel on how to use the SSPM solution and how to interpret security events. Through this training, personnel will learn how to use SSPM to check and respond to security settings.

In addition to educating the responsible parties, it is also important to encourage all employees to comply with the established “Security Policy for Cloud Usage.”

6. Operation and continuous improvement

We will continuously implement and improve the operation of SSPM through regular monitoring and analysis of diagnostic results.

Adjust settings and policies accordingly based on user feedback and new security requirements.

For SaaS environment configuration diagnosis, we also recommend the professional “Cloud Security Diagnosis”

Like SSPM, there is a service called “Cloud Security Diagnostics” that checks the configuration status of cloud environments.

Cloud security assessment is a service that regularly evaluates the settings and security status of the entire cloud environment, including SaaS, and identifies potential vulnerabilities and configuration errors, and makes improvements.

The difference between SSPM and Cloud Security Assessment

The main difference between SSPM and Cloud Security Assessment is whether the configuration status of the cloud environment is checked automatically or manually .

In the case of SSPM, the integration settings are configured in advance and the settings are mainly checked automatically, but when it comes to preparations for operation and implementation, your company will need to configure what items to check.

In contrast, cloud security assessments are characterized by the fact that security experts perform checks “manually.”

Unlike a one-off “cloud security assessment” that is requested from a vendor, SSPM excels in terms of “sustainability” in that it can continuously detect settings once implemented .

▼Comparison between SSPM and Cloud Security Assessment

However, in terms of flexibility, such as always being able to check the latest diagnostic items and being able to respond to changes in the specifications of various cloud services, manually performed cloud security diagnostics are preferable.

Another advantage of SSPM, which requires a certain level of knowledge and experience to operate, is that it can be used by anyone regardless of their knowledge or experience, as the entire investigation can be left to experts.

If you have someone in-house who is knowledgeable about security and can operate the system in-house, you should consider SSPM . If you have little knowledge of cloud computing or security in-house and would like to outsource to a professional , you should consider using a cloud security diagnosis. It is a good idea to consider the appropriate service depending on your company’s environment and objectives.

summary

In this article, we have explained the overview and functions of “SSPM.”

Security measures for cloud services are now an unavoidable issue for companies and organizations. We hope that you will use the CSPM and cloud assessments introduced in this article as a reference to build a cloud environment where you can work with peace of mind.

We also conducted a “Survey on Cloud Security” targeting 1,000 information systems managers at small and medium-sized enterprises.

We have compiled this information in a report, so please use it as a reference for your company’s cloud security measures.