Questions tagged [saas]
Software as a service (SaaS) is a licensing model where software is sold as a cloud service.
26 questions
0
votes
1
answer
168
views
Is it safe to use gitlab.com SaaS for deploying internet server?
I don't mean to install a GitLab instance here, I'm talking about storing code on gitlab.com that contains server configuration, code run on the servers, and so on.
I guess that if the code falls into ...
- 101
0
votes
1
answer
227
views
Does splitting auth SSO and MFA parts, between client and service companies have any issues?
My company provides a single SaaS product for corporate clients.
For one client we are implementing SSO with them as authentication provider (via Azure AD/SAML for now, but the library we are using is ...
- 51
0
votes
0
answers
558
views
Best way to encrypt client side data for SaaS inside the web
I am planning a SaaS-solution, where my clients store and save sensitive data on my servers.
Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
- 101
1
vote
2
answers
1k
views
How to make SaaS application accessible only on intranet?
We are a SaaS-based product but one of the client requirement is to make our application accessible only on their intranet. Is that even possible?
- 303
0
votes
2
answers
257
views
allowing users to add custom html/js code and show it only under another domain
I have a web app where I allow users to create a one-page portfolio using drag and drop, also I allow them to add custom HTML freely (basically any html or js code)
I'm aware that I shouldn't allow ...
- 129
0
votes
1
answer
667
views
Is it possible to use Kerberos for SSO in a SaaS application?
If I have a webapplication in my internal Microsoft Windows network I'm aware that I can use the kerberos protocol to make a Single Sign on (SSO) into this application with the web browser.
Is it a ...
- 103
3
votes
1
answer
1k
views
ISO 27001 compliance for application or hosting?
I received a question as follows: Does the vendor solution need to have the ISO 27001 certification for the application itself, or just for the hosting of the platform?
In my understanding, ISO 27001 ...
- 39
2
votes
0
answers
250
views
Patch management for production servers
I'm trying to implement an automated patching program at a small SaaS provider.
When a customer signs up for our software, we provision them a Linux VM in our primary datacenter.
Each customer also ...
- 17
4
votes
1
answer
588
views
Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?
Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
- 43
2
votes
2
answers
242
views
TCP Traffic, SSL or extra Tunnel
I have a situation where we (as a SaaS vendor) are migrating one of our clients away from their local premise to our public SaaS.
However as a security concern they want to route all their TCP ...
- 23
5
votes
4
answers
1k
views
Public API security: authentication vs. rate limiting etc
We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
- 778
1
vote
0
answers
118
views
Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?
SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand"
are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
2
votes
2
answers
452
views
What to do about vulnerability in a SaaS product I buy?
I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems.
Two months ago, I ...
1
vote
2
answers
3k
views
do we need VPN for SaaS cloud applications?
If we need to connect to the corporate network from home, we need to have the VPN connection. However, what if for accessing SaaS applications like Google Doc, Salesforce, etc, do we need still need ...
- 11
0
votes
1
answer
1k
views
PCI compliance of a SaaS provider
We (merchant) will be using a SaaS to sell learning modules and accept credit card payments through a redirect to a service provider that will process the credit card payments. The SaaS will be hosted ...
