SaaS, Cloud Application, and Security

Software As a service (SaaS) has been around for many years in the market. In recent years, it has been very prevalent in using this service with the notion of putting applications on cloud.

SaaS can be useful for general purpose applications (e.g. Dropbox, OneDrive). If a company can use a standard out of the box application with some minor configuration, SaaS will fit them well as it is relatively competitively priced as it is a shared application. All new features will be dependent on the vendor’s roadmap. All maintenance, patches will be well taken care by vendors.

For systems which are critical to its main company operation, it is unlikely SaaS will take place unless it can be customized to fit the business needs. Most vendors who allow customization will make the company pay more in their future yearly maintenance as those customized plug in or components are taken into account as the over application will still need to be patched and upgraded constantly. It is still considered SaaS with customized option.

It is important for a company to deliberate on dedicated and experienced resources, onsite or offsite to ensure the agreed turnaround time for any change request, bug fixes, and the necessary SLAs. A minimum of two resources is needed and it will depend on the criticality and the complexity of the system.

All applications should consider adhering to the OWASP application security risks, CERT secure coding standards, with proper code analysis and application security testing tool (e.g. Check Marx, Veracode). It may be difficult to adhere to secure coding standards for most software as it may have certain legacy components in them. However, it is important to understand their server architecture, including their middleware to sieve through the vulnerabilities that can be at hand.

There are companies who may want to consider to move its on-premise solution to cloud hosting, instead of the traditional rack hosting options. Cost, Tier X, SOC X are important consideration factors. Cloud hosting may not be a cost effective option as hosting in Singapore is still much higher than other places around the globe.

For SaaS vendors, most are likely to have a negotiated bulk discount deal which give them an edge to compete better.