Ransomware attacks target SaaS data

According to a recent study, ransomware attacks frequently target and successfully attack SaaS data, and SaaS data is not as well protected as on-premises or cloud data.

Most businesses have moved many critical applications away from on-premises data centers and now rely on SaaS providers for software such as CRM, office productivity suites, and even ERP. Even though large organizations require these SaaS platforms and the data they contain to run even day-to-day operations, this data is less secure than on-premises data because many in IT still expect the SaaS vendor to provide adequate security protections.

Major SaaS providers devote significant human and financial resources to ensuring the security of their infrastructure. However, under the shared responsibility model that nearly all SaaS vendors follow, while the provider ensures that the infrastructure is secure, the customer is responsible for the data. If there is a gap, it creates a huge vulnerability because opportunistic cybercriminals are following the data into SaaS services, devising increasingly sophisticated and effective ways to target it.

Hackers are after SaaS data and stealing it successfully

In a recent worldwide survey of enterprise data decision-makers conducted by Odaseva, 51% of respondents reported having been the target of a ransomware attack that sought to encrypt their SaaS data, and 52% of these attacks were successful. Furthermore, cybercriminals had greater success encrypting SaaS data than an endpoint, cloud, or on-premises data.

Worse, only half of the organizations could fully recover from a ransomware attack encrypted in a SaaS service, far less than they could from a ransomware attack on data in other environments. For example, more than eight in ten (81%) recovered completely from on-premises data attacks. This is not surprising given that only 28% said they were "very confident" they could recover all of their SaaS data following a successful ransomware attack. Only 43% said they were backing up all of their SaaS data. After all, data can only be recovered if it is backed up.

Defending against ransomware attacks targeting SaaS data

Backing up SaaS data is a more complicated and distinct operation than protecting on-premises data. The main distinction is that IT has little control over the infrastructure on which SaaS data is stored. IT completely relies on the provider's APIs to access SaaS data, a limited resource. Providers set daily API call limits to prevent a single customer from abusing them and degrading performance for others in multi-tenant architectures. Furthermore, there are numerous APIs to choose from, each with its capabilities, benefits, and drawbacks. It's a delicate balancing act but backing up SaaS data is a must — it's the final line of defense against ransomware attacks.

IT has three basic options for backup solutions for SaaS data. While trying to create a solution on their own gives them much control and flexibility, enterprise organizations are likely to need more in-house know-how to create a dependable, secure SaaS backup solution that can meet their recovery point and time objectives. Even if an organization does have the expertise, justifying the time and expense if a market solution already exists will be difficult.

Some market solutions are free but typically designed for simple data structures with low volumes. Furthermore, they rarely provide support and can be difficult to implement. A market SaaS backup solution from a vendor with specific SaaS platform expertise is usually the best option, as it provides strong protection while freeing up internal resources for other projects.

In addition to a solid SaaS backup solution, IT should ensure secure access to SaaS data. As previously stated, providers prioritize security, so an attack on SaaS data by compromising the SaaS infrastructure is unlikely. Cybercriminals instead take advantage of compromised or stolen credentials, malware, or API leaks. Using a username and password to gain access creates a single point of failure; best practice calls for strong multi-factor authentication.

Organizations must take it seriously and implement systems to protect their data from ransomware attacks and create comprehensive backups that can be recovered in a timely manner if a ransomware attack is successful. In a digital world reliant on SaaS applications, the consequences of failing to do so can be disastrous.