The security risks associated with third-party SaaS providers

September 2024 Information Security, Security Services & Risk Management


Ethan Searle.

According to a Thales 2023 cloud security study, enterprises use, on average, 97 SaaS apps as they increasingly switch away from legacy in-house applications.

“Thales says while the benefits of SaaS are manifold, enterprise SaaS consumers require comprehensive security, often based on compliance mandates, for their sensitive data stored in SaaS clouds,” says Ethan Searle, Business Development Director, LanDynamix. “SMEs are no different, and whether they know it or not, they require comprehensive security measures for their sensitive data stored in SaaS clouds.”

SaaS apps are here to stay, and with good reason – they live in the cloud and can be accessed via a stable internet connection, removing the technology burden from the shoulders of the SME. It translates into your own in-house IT team without employing an expensive technician.

One site notes the significant benefits of SaaS for small businesses and declares without it, they will not survive the competition. “Possibly quite true, but one thing is certain; introducing an array of SaaS platforms into your SME’s operations without the knowledge or ability to manage the cybersecurity implications is immensely risky,” confirms Searle.

Forbes reports that the top security risks of using third-party SaaS providers include authenticated access, data leaks, and control of data backup, with SaaS providers processing the customer data of hundreds and thousands of organisations. “You do not have to be a rocket scientist to work out that this will make them a significant target for cybercriminals.”

“SaaS applications are certainly very convenient and offer much to the market. However, the risks are immense and need to be managed. This is where a skilled managed services provider (MSP) comes into the picture with the necessary skills and depth of knowledge to protect your business against potentially deadly breaches. MSP’s remove the heavy lifting from your technology implementations; they can ensure your SaaS applications are integrated into your network for authenticated access.”

The shared responsibility model

Searle says it is important to remember that if Microsoft 365, Salesforce, or Google Workspace data is lost, it is your responsibility to recover it – not the vendor’s. “This is the shared responsibility model between SaaS vendors and their customers, like your organisation, that puts the burden of protection squarely on your shoulders. Again, this is where an MSP can add immense value by backing up IP and sensitive information into an agnostic system that ensures that SaaS weak links do not damage your business’ positioning and inevitably your reputation.”

Stuck between a rock and a hard place

He notes that this is exactly where the average SME is with regards to SaaS applications. “Firstly, you cannot live without them, but secondly, they are the most likely source of illicit entry into your systems for malicious reasons. If you are bringing a third-party SaaS provider on board, there are several things you can do, beginning with a due diligence of the supplier.”

“You would also be wise to stay on top of what SaaS providers your employees are using. You can achieve this via regular audits, monitoring and implementing strict security policies that link access into your business’ authentication mechanisms, such as Active Directory. You must also consider deploying agnostic backup solutions for data protection, not forgetting to factor in the possibility of supply chain attacks.

“You can do all these things, but if you want to show good business sense, you will stick to the essentials of running your business, get a top MSP on board, and let them take away these issues and run with them. These activities are core to an MSP’s ongoing success in business. The aim is to provide you with the time and head space (not cluttered by security and tech worries) to focus on running your business, while highly specialised IT professionals keep it operational and safe,” concludes Searle.

For more information, contact LanDynamix, 0861 225 553, [email protected], www.landynamix.co.za


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Managed security solutions for organisations of all sizes
Information Security News & Events
Cyber attackers have become significantly more sophisticated and determined, targeting businesses of all sizes. PwC’s Global Digital Trust Insights Survey 2025 Africa and South Africa highlights the urgent need for organisations to implement robust cyber risk mitigation strategies.

Read more...
From the Editor's desk: The good, the bad, and the victims
Technews Publishing News & Events
When the Internet first arrived, everyone was expecting amazing things from it, well, everyone who knew what it was and how it worked. We had the dotcom boom and bust, and it’s fair to say that if we ...

Read more...
Data resilience at VeeamON
Technews Publishing SMART Security Solutions Infrastructure Information Security
SMART Security Solutions attended the VeeamON Tour in Johannesburg in August to learn more about data resilience and Veeam’s initiatives to enhance data protection, both on-site and in the cloud.

Read more...
Identity, Security & Access Alliance focuses on intelligence and integration
SMART Security Solutions Ideco Biometrics BoomGate Systems Bosch Building Technologies Technews Publishing Integrated Solutions Surveillance Access Control & Identity Management
The Identity, Security & Access Alliance (ISAA) hosted several launch events in Johannesburg in August, showcasing the participating companies’ technical solutions with a primary focus on the solutions made possible by integrating high-quality systems to deliver comprehensive solutions.

Read more...
Get the AI fundamentals right
Technews Publishing SMART Security Solutions Leaderware Editor's Choice Surveillance AI & Data Analytics
Much of the marketing for CCTV AI detection implies the client can just drop the AI into their existing systems and operations, and they will be detecting all criminals and be far more efficient when doing it.

Read more...
The role of drones in farm protection
Agriculture (Industry) Security Services & Risk Management
Laurence Palmer reminds us of the role drones play in agricultural security and offers a free security risk assessment template for downloading (link at the end of the article).

Read more...
SMART Surveillance Conference in Johannesburg
Arteco Global Africa Technews Publishing SMART Security Solutions Axis Communications SA neaMetrics Editor's Choice Surveillance Security Services & Risk Management Logistics (Industry) AI & Data Analytics
SMART Security Solutions hosted its annual SMART Surveillance Conference in Johannesburg in July, welcoming several guests, sponsors, and speakers for an informative and enjoyable day examining the evolution of the surveillance market.

Read more...
Troye exposes the Entra ID backup blind spot
Information Security Infrastructure
If you trust Microsoft to protect your identity, think again. Many organisations naively believe that Microsoft’s shared responsibility model covers Microsoft Entra?ID – formerly Azure AD – but it does not.

Read more...
Secure data protection without hardware lock-in
Infrastructure Information Security News & Events
New Veeam Software Appliance empowers IT teams to achieve instant protection with Veeam’s fully preconfigured, software-only appliance, delivering enterprise-ready simplified deployment and operational efficiency, robust cyber resilience.

Read more...
Check Point launches open, vendor-neutral MDR services
Information Security News & Events Products & Solutions
New Check Point MDR 360° and MXDR 360° offerings deliver 24/7 managed continuous threat monitoring protection across endpoints, cloud and network environments with built-in identity threat detection and 160+ integrations across hybrid, multi-vendor environments.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.