Name: Navigating the SaaS Threat Landscape: What You Need to Know to Protect Your Business
Uploaded: 2025-04-01T17:15:35.806Z
Duration: 35 min 32 s
Description: Navigating the SaaS Threat Landscape: What You Need to Know to Protect Your Business

Transcript for "Navigating the SaaS Threat Landscape: What You Need to Know to Protect Your Business": Hello, everyone, and thank you for joining us today, whether you're joining us, in your morning time, your afternoon time, maybe even your evening time. We know we have a lot of folks joining from all over the world. We're excited to jump in today, talking about navigating the SaaS threat landscape. So with that, I will get us kicked off. We have a lot to cover today, so we're going to jump right in, and make sure that we will leave time at the end to answer questions. So a couple of notes to get us started. We will record and share this out at the end, so do not fret. You will receive an email likely tomorrow with that recording. Couple of other items are included in the docs tab over to the right hand side. So if you need to grab the presentation slides from today or you wanna grab any of the supporting materials, please go forth and do so. And then also, as I mentioned, there is the q and a box. So please do go ahead and use that. Ask your questions away. If we have time at the end, we will make sure absolutely to address them. With that, I'm gonna introduce you to our speakers. We have two amazing speakers today. So Liz Tippett is joining us. She is the director of product marketing here at LastPass. And Stephanie Schneider, excuse me, is the cyber threat intel Analyst, and she is joining us from the Time team here at LastPass as well. With that, I'm going to go ahead and kick it off over to Liz to get us started. Thanks so much, Courtney. Hey, everybody. Welcome. Just a quick agenda slide here for you. Today, I'm gonna kick us off with some key terminology just to make sure we are all set on some of the terms that you're going to hear us use today. I will walk you through the state of SaaS and introduce some of the risks that we are seeing, with businesses. And then I'm gonna turn it over to Stephanie who is going to walk you through some of the through some of the real world challenges, and then I will take it back over to close you out with some exciting updates that we have here at LastPass. So with that, let's start off with, again, just a quick review. We'll do some defining and aligning here to make sure that we are all level set on the terms that we're gonna use, and we all understand the context of the terms, that you're hear that you'll hear us use today. So let's start off with the basics. What is an application? Some of you may already know this, but for those of you who might not, an application is just a tool, usually software, that helps you do specific things, like sending messages, managing projects, organizing information. A good rule of thumb we like to say is if it has a login, it's an application, whether that's Spotify for listening to music, Venmo for sending money to your friends, or if you're using business tools like Slack, Salesforce, or Microsoft 365. Whether it's for personal or work use, most of us are using applications every single day often without even realizing how much we actually rely on them. So with that, let's start off with a quick poll. How many applications do you think are being used across your organization today? Alright. The poll is now open, so I'm gonna wait and see, how many of you guys are using potentially hundreds of these applications. Oh, okay. Okay. Oh, wow. Alright. We have, a lot more than than I realized here. Wow. A lot of you are using a lot of applications, which is really good because that is exactly what we're here to talk about today. Okay. Alright. Looks like a lot of you said that you're using well over 50 applications. Alright. Alright. We're gonna go ahead and close that poll now. Thanks for that participation. Good to know. Alright. So now that we're familiar with the term application, and whether or not we think we might or might not have a good understanding of, how many our businesses are using, it seems like there's a lot out there. Here are a couple more terms that you might not be as familiar with that you're gonna hear Stephanie and I talk about. So let's start off with software as a service or SaaS as you're gonna hear us call it. So SaaS is the cloud based model where software is delivered over the Internet. So users like you and I don't have to install anything locally. Everything is managed by the software provider, including general updates and security updates. Now when companies start to rapidly adopt more of these tools, they often experience what we call SaaS sprawl, which just means that different teams are bringing in applications independently, which can lead to poor IT oversight and security gaps that stem from shadow IT. What is shadow IT? Well, that's when employees use unauthorized tools, whether, like I said, if that's for collaboration or sending messages, or using them for storage or productivity without IT's approval, which can really increase security risks to your organization. A newer challenge that we're seeing emerge from shadow IT is shadow AI, which is the use of unsanctioned AI powered apps where employees can sometimes share sensitive company data into AI tools, while they're bypassing those security controls. You're probably familiar with a lot of these tools. There's ChatGPT, there's Copilot, there's Bar, there's Claude. So many of them out there. And what all these challenges do is they expand an organization's SaaS attack surface, which just means that all of the entry points that a threat actor can exploit, like user accounts, misconfigured app settings, or expose API, and use them for nefarious reasons. So now that we're all familiar with the terms, we've all level set it, let's get into the overall problem of SaaS and what it means for businesses like yours. Let's first talk about why companies are leveraging SaaS in the first place. Well, the first reason is because SaaS tools are cost effective. They're also super easy to download immediately, which means teams don't have to deal with long software installations. And for those companies who might not have as robust of an IT or security team, those companies can actually get automatic updates and security patches without IT intervention. So overall, companies use SaaS apps because they're relatively cheap, they're easy to deploy, and they don't have to maintain them from an IT standpoint. Let's talk about why employees are using SaaS tools, which is probably something we we all can relate to. So employees are constantly looking for tools that, are going to enhance their productivity, help them collaborate with their teams better. This is especially important as most of us are remote or hybrid or just distributed in general. And they can also integrate them with other tools that they're already using to make their lives easier. But the problem is is that these tools are too easy to access and download. Employees are getting access to them via free trials. They're downloading free versions, and IT and business leaders just can't keep up because this is all happening beyond their line of sight. So they're losing critical visibility of what apps are being used across their organization, how they're being accessed, and what information is potentially being shared. But the key thing that I want you to keep in mind here is that employees aren't doing this maliciously. They're not purposely seeking out applications to knowingly expose themselves or their organizations to risk. They're just looking for tools to do their jobs better like we all do, and a lot of them are looking, to to bypass the lengthy process of going through IT to request access because that's, again, something we can all relate to. If the process is too cumbersome to get what you need, you're probably going to look for shortcuts. But as they do this without IT oversight, they're inadvertently exposing themselves, their orgs, and even their customers to risk. And the SaaS this rapid SaaS adoption that we're seeing and that we're talking about is not going to slow down anytime soon. From 02/2017 to 02/2023, adoption rates actually increased by 33% year over year. By the end of this year, SaaS growth is expected to reach about $400,000,000,000. And even more shocking, it's expected to grow to $1,000,000,000,000 by 2030. So SaaS usage is definitely not going anywhere anytime soon. And Gartner actually predicts that by 2027, the majority of us, about 75%, are going to use tools that are not approved by IT. So we're gonna kick it off with another fun poll. Now that we all know what an application is, what shadow IT is, how many of you think that you have been guilty either in this role or a previous role of using shadow IT? So we're gonna open it up now. Don't worry. All of this is anonymous, so don't feel like you you can't answer truthfully. It's totally fine. We can't see anything but the data. Okay. Alright. Alright. We have some some honest people out there. Don't worry. We're all we're all probably guilty of it, and we don't even know it. So wow. Okay. Alright. It looks like the consensus is that we're all we're all using shadow IT. Well, again, that's I mean, it's not a good thing, but it's a good thing that we're talking about it because that's exactly why we're here today. Alright. We're gonna go ahead and close that poll. We'll get back to it. Alright. Now that we've talked about this this rapid SaaS growth that we're seeing, we've we've talked about shadow IT, let's talk about the risks that come along with this rapid adoption. So while we all know SaaS applications make our lives, our employees' lives, easier, it also makes IT's life a lot harder as many of these employees, like I said, are accessing and using these tools without IT oversight, which brings us to the first risk, shadow IT and shadow AI. When IT or business leaders don't have the oversight of how these tools are being accessed or what information is being stored or shared across them, that exposes the entire organization to security risks like unauthorized access, data breaches, and really expensive compliance violations. On the financial side, these costs can these costs of these apps can actually run them up. Just look at these these stats that we have here. Small businesses pay for an average of a 34 apps that go unused, while larger organizations can actually pay for an average of about 473 that go unused. That can equate to thousands or potentially millions of dollars depending on the size of your business that are that's just wasted on tools that aren't even being used. And, look, again, I wanna reiterate that employees are not doing this maliciously. They're experimenting. They're trialing. They're researching products that can help them do their jobs better, but they're bypassing these critical security controls to do it without the understanding of the domino effect that it can actually cause. So with that, I'm gonna turn it over to Stephanie who is going to actually walk you through some of these challenges that we're seeing out there in the real world. Awesome. Thanks so much, Liz, and hello, everyone. I'm Stephanie Schneider from our time team. And, our time team, is really, you know, a cyber threat intelligence program, and we look at both internal and external threats to both our customers and monitoring the threat landscape, so that we can, you know, identify new and emerging threats and get ahead of them. So, like Liz said, threat actors can exploit both legitimate SaaS apps that have been approved by companies, you know, finding vulnerabilities in those to get into systems. They can also go after shadow IT or unapproved apps that employees use. Oftentimes, you know, they're just trying to do yeah. Make their jobs easier, find shortcuts, work more efficiently. You know, there's been such a boom of, like, you know, AI apps. A lot of those haven't been sanctioned by companies, but employees may still be using those, to do their job better. So in many cases, there's a lot of well intentioned purposes to improve efficiency. But this also introduces vulnerabilities across several fronts that, again, Liz did a great job of going through. So to illustrate some of the points that, Liz just covered, let's dive into this deeper. We'll take a closer look at a couple of recent case studies. So, many of you are probably familiar with Snowflake. This is a cloud service provider that was one of the biggest data breaches of 2024. We don't really know the full impact of the number of companies that were affected by this breach yet because additional public victims have continued to come out and be named even months after the breach occurred. This is a really good example of a legitimate approved SaaS app that led to a significant breach, and it also involves issues like exposed credentials for your company and third party risk and exposures. So in May, a threat actor began advertising data from Ticketmaster and Santander for sale on a cybercrime forum. They claimed that they had breached Snowflake. And what actually happened was that hackers exploited stolen credentials and weak security configurations to access customer accounts. They didn't go, you know, find in a vulnerability and exploit that within Snowflake's platform itself. So a lot of companies turned out got popped with info stealers. They didn't know it. And so that information was out there on the dark web. And about 80% or so of the compromised accounts that belonged to Snowflake customers already had prior credential exposure. And info stealers, by the way, have had a massive uptake over the last few years. They're, you know, really potent because they're quiet, they're widespread, and they've been responsible for a lot of, you know, major breaches that we've seen over the last, year or so. So Snowflake wasn't enforcing MFA, and a lot of their customers just had a simple name and password. So, the Snowflake credentials that were found in the Infosteeler malware credential dumps hadn't been rotated or updated. They remain valid, and so the threat actor could, basically plug them in and go. They didn't have that extra layer of protection from MFA. The latest number that we've seen is about 165 companies, with credentials related to the Snowflake Beach. So just kind of talking through, you know, this the kill chain and, just really briefly, showing how threat actors, conducted this attack. So first, you know, like I mentioned, they found the exposed credentials online. Oftentimes, you know, these credentials that are out there and they cost as little as $10, to purchase, and then the threat actor can, you know, can use can leverage that, credential to conduct an attack. And that's exactly what happened here. So and then to get into their systems, like I mentioned, they simply, logged into the accounts without that layer of MFA. And then after they gained access, they identified available data using a custom utility and a publicly available data management utility, to, you know, find information that they wanted and then were able to, you know, compress that data into a zip file and exfiltrate it out of the system. So a few key takeaways here. You know, this incident really highlights the importance of really robust identity and access controls in SaaS environments and also the need for customers to take proactive measures to secure their SaaS applications. You know, in SaaS environments, both the provider like Snowflake here and the customers share responsibility for security. So while the provider secures the platform infrastructure, customers are also responsible for securing their data and applications and access controls. So this incident really highlights that customers have to take those proactive measures like enforcing multifactor authentication, securing credentials in order to protect their data. And, you know, going back to that, lack of MFA, the affected accounts did not have m MFA. So they were really just kind of low hanging fruit for the threat actors to go after, the successful authentication for the threat threat threat actor only required that valid username and password, and then they were able to easily access those targeted accounts. Kind of going back to the root cause, the core issue here was the exposed legitimate credentials. A lot of these were old in many cases. They were available for years, and, you know, we're still valid. So in the in this case, the companies were popped with an info sealer that stole login credentials of Snowflake's customers users through those infected devices and then could access, the data stored on the platform. So, you know, we really need a solution to both manage passwords while also monitoring for exposure on the dark web via info stealers or other means, however that gets out there. And then also, you know, monitoring for third party vendor issues and addressing business connections to them quickly. For instance, and, you know, responding and rapidly changing credentials in the event of a credential stuffing campaign like this one. This Snowflake breach also had a domino effect, you know, where the initial compromise led to multiple subsequent breaches. And and, you know, we saw, other kind of companies being affected by this, including Ticketmaster, Advance Auto Parts, Santander Bank, LendingTree, and more. Another really interesting, compromised entity was AT and T, that suffered a massive breach because of this. And this, AT and T breach was the first time in The US where we've seen a breach announcement being postponed specifically due to national security protections. Protections. They were concerned, of the national security information, that could be leaked from the AT and T breach because, you know, if you know someone's number, you can do telephony analysis on that and connect a whole bunch of other malicious attacks. So, so, yeah, it had pretty significant, wide reaching consequences. And this incident in this way mirrors the Okta breach, which we'll talk about in just, a moment where, you know, the attackers leverage stolen credentials to infiltrate, those other various organizations. Which brings us to our second case study, which is the Okta breach in 2023. So Okta suffered a really a series of breaches over the last few years, due to social engineering attacks or credential theft. So the I wanted to highlight this particular attack. It's interesting because the threat actor who specifically, went after them here target SaaS apps, and then it also had the downstream impact on some of Okta's customers similar to Snowflake. So in late twenty twenty three, a scattered Spider launched a social engineering attack that targeted, you know, Okta support case management system, and we're able to gain access to Okta's customer data. Now Scattered Spider, you may be familiar with them. They were in the news, you know, for the last couple of years. They're really known for social engineering attacks. They can talk their way into networks. They're behind some of the biggest attacks over the last few years, and they still publish a lot of data. Also, interestingly, it they tend to be, you know, adolescents, you know, teenagers. And, so they're not particularly sophisticated, but they're really effective at, you know, conducting the social engineering attacks. Also, like I mentioned, they target software as a service platforms like Okta as well as ServiceNow, Zendesk, and VMware, Workspace ONE by deploying phishing pages that closely mimic single sign on portals or SSO portals. You know, they use, phishing attacks, SIM swapping, you know, other methods to phish people, within an organization once they've broken into the employee database basis. So in this case, the attacker managed to gain unauthorized access to Okta's customer support system by using, again, stolen login credentials. In this case, though, they got these credentials from, an employee's compromised personal Google account. And this allowed the the attacker to really hijack a service account within Okta system, and then they were ultimately able to pivot to target downstream customers. We saw, spiders, scattered spider perform a series of high profile attacks against MGM resort, Caesars, one password, CloudFlare, and others. So this is really part of a larger campaign, where hackers compromised administrative accounts and then tried to manipulate those authentication flows and establish a secondary identity provider to really impersonate users within the affected organization. This had pretty significant impact as well. Hackers were able to gain access to the files of a 34 different customers and downloaded a report with the names and email addresses of all customers who had used Okta support in the past, from 2019 to 2020, as as well as, Okta, employees' data. And this information was used to launch phishing other follow on targeted attacks. You know, in one instance, Cloudflare said that the Okta breach actually led to a nation state hacker gaining unauthorized access to Cloudflare's, Altasian servers. So, yeah, so this this larger attack, you know, is is really interesting because, we saw them using social engineering to really get access to these super admin roles in Okta customer tenants. And once they established the access, they then leveraged, they were then able to leverage their compromise of highly privileged Okta, accounts to then abuse, identity features and could comp because you could really impersonate, users within the compromised organization. So, taking a look at the attack kill chain here and walking through this. So, like I mentioned, an employee's, Gmail account was initially compromised with an info stealer. It turns out they had logged into their personal Gmail on their work laptop and then saved their work credentials in Chrome. And as we know, you know, saving credentials, like, in plain text, like, straight to the browser is, is not a secure way to, ensure that your credentials, are protected. Then malware was installed on the work laptop, which was then used to gain access to Okta support system through Okta's SSO. And then once the threat actors were inside, they were able to move laterally and used the Okta SSO dashboard to access other systems including Microsoft three sixty five and Microsoft Azure AD. So this was really interesting. Right? Because the group registered their own MFA tokens, so they were able to add, a federated identity provider to the victim's SSO tenant and then activated, the automatic account linking. So this allowed them to really maintain access and then also escalate their privileges. So the threat actor gained access to the files containing the session tokens, which could then really used to be, to conduct session hijacking attacks, which potentially impacted, cloud infrastructure. And then looking at what they were able to accomplish, like, once they were in Okta systems, they were they appeared to really target the downstream customers by compromising those admin accounts, trying to manipulate authentication flows. In one reported instance, hackers tried to attack CloudFlare system using an authentication token compromised at Okta. So there are a few key takeaways from this breach. You know, first and foremost, it shows that no business organization is 100 safe from malicious attacks, and highlights that a product like Okta's identity and access management software could potentially allow hackers to, launch supply chain attacks and have significant downstream impact. Cloud infrastructure has also become a really appealing target for attackers. We've seen, you know, companies move over to the cloud and threat actors are paying attention to that. So they're moving over too and having to figure out how to move laterally once they get their foot in the door. So they're becoming better at, at targeting these systems. And spider Scattered Spider is one of the the more effective groups that we see doing this. And the Okta data breach kind of, you know, two things really, stand out. One is that, you know, shadow IT was a big component of this and that kind of the blurring the line between those personal and work accounts of the employee's account that was initially compromised. And then also, you know, the social engineering, you know, element to this once the attackers got into the system and we're looking at those downstream victims. Again, Scatter Spider is really great at conducting, social engineering attacks. You know, and this kind of this is a social engineering is is a way that attackers can, you know, don't have to have those, advanced technical capabilities to get into the systems. They can just kinda talk their way in and, create a convincing enough scenario, that allows them to bypass maybe those other security measures. So, it does highlight that oftentimes, the human element is the weakest link in security. And, you know, similar to the Snowflake as well, the compromise of Okta led to multiple subsequent breaches. So it really just shows the potential damage and follow on effects of, SaaS app compromise. So, you know, this kind of begs the question, what can we do to protect ourselves, and defend against these SaaS threats? There's a couple of basic things. One is that strong IT policies prevent, the down that prevent the download and use of nonapproved technologies are critical. Also, network monitoring for the use of shadow IT so that you know, you know, what your attack surface is. You don't have those blind spots. This monitoring can be done via logs, endpoint agents, or even using password managers that can provide insight into, you know, unauthorized accounts. Also, having that open door IT culture really allows for, good discussions between users and IT departments, you know, regarding the need for if if there is a need for external applications or tools, and and really, you know, just making sure that, that that is approved by the technology team and, you know, any risks, are taken into consideration. And lastly, SaaS monitoring, really helps reduce the threats by providing that real time visibility into, you know, what are the SaaS applications being used, enabling, you know, detection and remediation of any security incidents and then strengthening overall security posture. So these types of monitoring tools really provide a, comprehensive view of the SaaS application that are being used and then, you know, including user activity, configuration settings, security events, things like that. With that, I will hand it back over to Liz. Okay. Let me get my sharing here. Alright. Thank you so much, Stephanie. Now that you've heard a few of our best practices that Stephanie, recommended that you can implement to help combat the risk from SaaS, Let's talk about what we're doing here at LastPass to help. So in May, we are launching our new SaaS monitoring tool, to help put businesses like yours, all back in control of your SaaS ecosystem. SaaS monitoring leverages our browser extension to automatically discover and aggregate usage data from the work applications that your employees might be using across the organization. Now from a security perspective, SaaS monitoring is going to help you tackle shadow IT, shadow AI, and SaaS for all by providing insights into what applications users are logging into. So you'll know if they're using an app that's not been sanctioned by IT or by your admin, also how they're logging into them, like if they're using strong passwords, SSO, passkeys, and if security best practices and policies are being followed. From a financial perspective, SaaS monitoring also is going to help you identify opportunities to save money on tools that might be redundant. So for example, you know, if you have five project management tools being used across, you know, five or six different teams, and you really only need one, or if there are employees who have downloaded an app and just aren't using it. SaaS monitoring is gonna give you the data to understand which of those tools haven't been used or logged into in thirty days or more so you can eliminate those from your tech stack, and avoid paying for licenses that just aren't even being used. Beyond that, SaaS monitoring is also gonna be a great tool for those admins who onboard and offboard employees. So you can make sure that if and when an employee leaves the org, they don't still have access to a critical business tool that they shouldn't. And lastly, for those of you who might work in highly regulated industries like FinServ or health care, or maybe serve customers who require stringent compliance standards, you'll have that visibility to meet those regulations and pass those audits and ensure sensitive data isn't being shared or stored in an app that it shouldn't be, overall ensuring that you're maintaining whatever contractual agreements you've entered into. I do wanna just, confirm that SaaS monitoring is currently in closed beta right now for our current LastPass customers through April 15. So if you are a current customer and you're interested in learning more or you wanna try it out, for the next two weeks, just, if you could, be sure to email us @sasmonitoringbetaatlastpass.com. We will follow-up with instructions on how to get you access and get you onboarded. The deadline to opt in is April 3, so please make sure you send us an email before then so we can get you all set up. And it looks like we are right at the top, of the half hour, so I'm gonna turn it back over to Courtney Courtney to close this out, and wrap it up. Thank you so much, Liz. I actually am hopeful. Maybe I know we are right at the at the bottom of the hour, technically. And so I'm gonna actually take we got a couple of great questions that came in. So I'm a couple of these are actually gonna go to Stephanie. So hopefully, we can do a quick little q and a here before we wrap up. Stephanie, for you, one of the questions, given the lessons from Okta breach, what best practices should LastPass users and administrators follow to prevent similar security risks, particularly around social engineering? Yeah. That's a that's a really great question. I, you know, I think there's there's a lot of takeaways, but I would kind of boil it down to, you know, one, having, like, you know, really encouraging employees to be, aware of the threat that social engineering poses. And, you know, I think having that, like, security minded approach, first and foremost, is so key in preventing, you know, those follow on type of attacks that we saw with the social engineering. And then yeah. Like, you know, I think also, you know, ensuring that employees also understand the importance of keeping, you know, those those work and personal accounts, for instance, separate and and making sure that they understand, like, there is these are the these are the threats. This is why, you know, we implement these security policies. We don't just, like you know, security teams aren't just making, these up and trying to make, you know, employees' lives harder. That's really, the policy those policies are are put in place, for a reason to to protect their employees and, and having that kind of understanding and educational, component, I think, is really key. Fantastic. Thank you. And one last question before we wrap up. For the Okta instant, did they not have MFA on their credentials? Would this have prevented the credential harvesting from the user's personal Chrome password manager? That is a great question. I will have to look into that and, follow-up on that one. Sounds great. Okay. I there's a couple of other questions in the question box side of it, and we are just very much, out of time. So we will make sure to follow-up, especially for folks who are asking a couple of other great questions. So just know in the next couple of days, we'll make sure to send out, some of the questions along with answers on those. So, with that, I want to truly thank everyone today for joining us. Thank you to Liz and Stephanie. What a phenomenal presentation. We really appreciate all of your great knowledge sharing with us. So with that, I thank you so much. Have a wonderful day, and thank you.