February 28, 2023 Third Party App Access Presents Major Security Risks

SaaS-to-SaaS access significantly expands an organization’s attack surface and grants access to valuable company resources and data.

Employees are frequently granting thousands of third-party apps with access to the two most dominant workspaces, Microsoft 365 (M365) and Google Workspace without oversight or control managed by security teams. That’s according to new research by Adaptive Shield, the leading SaaS security company, in its SaaS-to-SaaS Access Report.

The research says that while these SaaS-to-SaaS connections provide enhanced features that boost workflow efficiency, companies are unable to quantify the risks that they present to the business. They also give permission for apps to read, update, create, delete, or otherwise engage with corporate and personal data.

Companies with 10,000 SaaS users on average, have 2,033 applications connected to M365, and 6,710 applications connected to Google Workspace. While the risk level for permissions varies from one app to the next, Adaptive Shield researchers found that 39% of apps connected to M365 and 11% to Google Workspace have ‘high-risk’ permission access.

Additional details include:

• In Google Workspace, the top three high-risk permission sets (78%) request the ability to see, edit, create, and delete any or all Google Drive files, emails, and docs.
• In the Microsoft 365 ecosystem, the two most common high-risk scopes grant the app the ability to read, create, update, and delete data. Together, they make up 27% of all high-risk scopes being granted.

“The simple app-to-app connectivity that makes SaaS apps vital productivity tools also makes them significantly dangerous,” said Maor Bin, CEO of Adaptive Shield. “While it’s unrealistic to expect businesses to curb their reliance on SaaS apps, they cannot allow this adoption to go unchecked. To eliminate these risks, companies must develop policies for integrating apps, prioritize employee training, and deploy monitoring solutions that help over-taxed security teams identify and eliminate high-risk permission sets before it’s too late.”

While these challenges are most prominent in M365 and Google Workspace, they are not exclusive to these apps. As part of this effort, Adaptive Shield also examined the business-critical apps, Slack and Salesforce. The research shows that organizations have an average 222 SaaS-to-SaaS apps for Slack and another 41 apps for Salesforce.

A final area of research are app categories that are connected most frequently. For example, email applications are far and away the number one connected category, followed by apps related to file and document management, communications and meetings, and calendars and scheduling.

The full report is available now and can be reviewed at 2023 SaaS-to-SaaS Access Report: Uncovering the Risks & Realities of Third-Party Connected Apps.

Subscribe to Industry Today