Information Security Blog

Super Slick SaaS Service Shares Information Security Secrets

As a marketing person at an information assurance firm I spend a lot of my time looking at both of these issues. I have recently noticed that “ahead of the curve” organizations are increasingly using their information security posture as a marketing tool. I thought the approach taken by a SaaS company that we were reviewing on behalf of a customer was intriguing.

The page I landed on was specific to the company’s security.

SaaS Service Security Measures

The SAAS company had a page that promoted its security controls. As s a company serving over one million customers, they have a lot at risk – especially as the Poneman Institute estimates that the average data breach costs about $202 per name in a data breach notification case.

I really like the company’s open/transparent approach of a simple bulleted list of key security controls in place:

The SaaS company implemented physical security controls: biometric scanners at their 24/7 monitored data centers.
The SaaS company office is secured by keycard access, and is monitored with infrared cameras.
They also have their policies documented in case of a disaster.
As part of their Data Loss Prevention plan, databases are segmented by accounts.
Customer data is backed up offsite.
Passwords for customer accounts are encrypted.
Login pages and the SaaS application are encrypted with SSL.
Login pages have been tested to hold up against a brute force attack.
Not only does the SaaS company perform Social Engineering tests, but they also train new employees about Social Engineering and the use of Social Media.
The SaaS company performs regular security penetration tests. Additionally, they are using different vendors for multiple opinions. They are performing Vulnerability Assessment and Penetration Tests against their:

Network
Databases
Application

Perhaps the most interesting control is that they require any new employees to read “The Art of Deception”, by Kevin Mitnick.

While their data center isn’t ISO 27001 Certified, I am glad to also read that they have ISO 17799 based policies and procedures as part of their SAS-70. While you may be doing all of the “right things” (e.g., a Vulnerability Assessment, Penetration Test or Social Engineering) you are likely not getting the maximum marketing benefit of doing so if you are not communicating your activities and controls in an open and honest fashion on your website.