Software as a Service (SaaS) Data Security

Questions for your SaaS provider

Do you know what questions to ask SaaS providers about data security? Does any data you are uploading to your SaaS provider include personally-identifiable information (PII)? Are you in an industry with data security mandate for which compliance extends to SaaS applications?

Do you control encryption keys?

Even if your SaaS provider has assured you that they are encrypting your data, here are a few critical questions you still need to ask:

• Is there a unique encryption key per customer?
• Do you have key management procedures? Is there risk of key loss?
• Can I control the keys to my data?

These questions represent security best practices. See the Cloud Security Alliance Cloud Controls Matrix.

Data Compliance in SaaS Environments

It’s easy to forget that you are ultimately responsible for ensuring compliance with data privacy and protection mandates, regardless of data location. So when you consider SaaS solutions, make sure your SaaS provider offers the same controls you employ in your own data centers. If your SaaS provider can't, find one who can.

Vormetric Transparent Encryption from Thales

Vormetric Transparent Encryption allows SaaS providers to extend their service offerings to include data-at-rest encryption, and meet your data protection requirements. Vormetric Transparent Encryption enables data-at-rest encryption, privileged user access control and the collection of security intelligence logs without re-engineering applications, databases or infrastructure. Read the TeenSafe success story.

CipherTrust Cloud Key Manager

SaaS providers have a responsibility to protect customer data with encryption. Further, SaaS providers should follow industry best practices and enable customers to control encryption keys for their data. SaaS providers offering Bring Your Own Key Services can enable you to utilize the CipherTrust Cloud Key Manager to fulfill critical key-governance mandates. Ask your SaaS provider to let you control the encryption keys for your data.

Industry Best Practice Resources for learning about SaaS data security

Don't just take our word regarding best practices for cloud, in particular SaaS, data security and key management. Join the Cloud Security Alliance LinkedIn Group. Give your SaaS providers the Cloud Security Alliance Consensus Assessment Initiative Questionnaire so that you can consistently compare SaaS provider security offerings.

Gain Peace of Mind

Selecting the right SaaS providers, those who protect and give you control of your data, gives you the assurance you need to sleep well at night and bring confidence to compliance meetings.

Ensure Compliance Extends to SaaS Cloud Offerings

You are the SaaS buyer. You have choices. Use the Consensus Assessment Initiative Questionnaire to identify and select only the SaaS providers that offer the tools to ensure that compliance mandates for your data extends to SaaS clouds.

Gain Control

Whether it's Vormetric Transparent Encryption with comprehensive key management or Key Management as a Service, your SaaS providers can partner with Thales to ensure that you are in control of your data in SaaS clouds.