SaaS Security Checklist
Governance and Compliance
Access Control
- Identify user roles and responsibilities.
- Assign access rights based on job necessity.
- Limit permissions to only what is required.
- Regularly audit and adjust permissions as needed.
- Require minimum password length (e.g., 12 characters).
- Mandate a mix of uppercase, lowercase, numbers, and symbols.
- Implement password expiration and renewal policies.
- Educate users on avoiding common password pitfalls.
- Select an MFA method (e.g., SMS, authenticator app).
- Require MFA for all users accessing sensitive data.
- Educate users on the importance of MFA.
- Regularly test and update MFA systems.
- Schedule periodic access reviews (e.g., quarterly).
- Involve managers in access approval processes.
- Revoke access for inactive or departing users.
- Document changes and maintain an access log.
Data Security
Application Security
Network Security
- Install and configure firewalls to filter traffic.
- Deploy IDS/IPS to monitor for malicious activities.
- Regularly update firewall and IDS/IPS rulesets.
- Conduct routine audits of firewall configurations.
- Create VLANs to isolate sensitive data.
- Apply access control lists (ACLs) on network devices.
- Restrict communication between segments as needed.
- Regularly review and adjust network segmentation.
- Implement network monitoring solutions to analyze traffic.
- Set up alerts for unusual patterns or spikes.
- Log and review network traffic regularly.
- Investigate anomalies promptly to identify threats.
- Choose a strong VPN protocol (e.g., OpenVPN).
- Require multi-factor authentication for VPN access.
- Encrypt VPN traffic to protect data in transit.
- Regularly review and update VPN access permissions.
- Establish a patch management policy.
- Schedule regular updates for network devices.
- Test patches in a staging environment before deployment.
- Document all applied patches and updates.
- Schedule regular vulnerability scans for the network.
- Engage third-party services for penetration testing.
- Prioritize and remediate identified vulnerabilities.
- Document findings and improvements made.
- Change default credentials and settings.
- Disable unused ports and services.
- Apply security best practices for device configurations.
- Regularly audit configurations for compliance.
- Implement TLS for all web traffic.
- Use secure protocols for data transmission (e.g., SFTP).
- Encrypt sensitive data before transmission.
- Regularly review encryption standards and practices.
- Define user roles and associated access levels.
- Implement role-based access controls (RBAC).
- Regularly review access permissions.
- Enforce least privilege access principles.
- Deploy SIEM solutions for centralized monitoring.
- Set alerts for suspicious activities.
- Review logs and alerts regularly.
- Respond promptly to detected incidents.
- Create visual representations of network architecture.
- Update diagrams as network changes occur.
- Include details on device configurations and connections.
- Ensure diagrams are accessible and secure.
- Choose a logging solution that supports all devices.
- Configure devices to send logs to the centralized system.
- Regularly review and analyze logs for anomalies.
- Retain logs according to compliance requirements.
- Subscribe to reputable threat intelligence sources.
- Integrate feeds into security tools for automation.
- Regularly review and act on threat intelligence.
- Share relevant information with the security team.
- Develop training materials focused on network security.
- Schedule regular training sessions for all employees.
- Test employees on their knowledge through simulations.
- Update training based on emerging threats.
Use in Manifestly