Are you getting ready for the upcoming Black Hat USA 2024 event, an internationally recognized cybersecurity event providing the most technical and relevant information security research, now in its 27th year. The event is quickly approaching, taking place August 3-8, 2024, returning to the Mandalay Bay Convention Center in Las Vegas, NV with a 6-day program.
Ahead of the show, VMblog received an exclusive interview with Chris Simmons, Head of Strategy at Savvy Security, a cybersecurity pioneer that eliminates identity-related security incidents involving software-as-a-service (SaaS) applications. Make sure to add them to your MUST SEE list.
VMblog: Before we get into it, can you give us a quick overview of the company? What should folks know?
Chris Simmons: Savvy delivers a modern identity-first SaaS security solution to detect and monitor what applications are being used and how users access them – even the SaaS apps other solutions overlook. Savvy’s multi-layered approach uses email, IDP, and browser integrations to maximize detection and create a real-time, comprehensive inventory of every SaaS identity, app, and risk. Savvy identifies the most perilous toxic combinations of risk factors – blending user behavior with business context – to pinpoint issues that lead to a likely breach (ex: privileged accounts with compromised passwords that also lack MFA). Savvy’s automation playbooks and just-in-time security guardrails guide users at scale toward proper hygiene to neutralize threats efficiently, allowing security teams to concentrate on other crucial security aspects. Savvy is the only solution that covers all user actions across all SaaS apps, including app signup, GenAI queries, credentials submission, access to sensitive resources, and data sharing.
VMblog: What are some of the key takeaways of your solution that Black Hat attendees should be aware of?
Simmons: Savvy strives to be the go-to provider for SaaS-identity security, offering comprehensive protection that is both effective and innovative. We go beyond traditional security measures by actively interacting with end users to reduce risk, offering real-time recommendations at the critical moment of decision, and empowering users to take proactive steps to adhere to cyber hygiene principles like using strong passwords, thinking before you click on a suspicious link, and turning MFA on all your SaaS apps. Savvy provides timely notifications and personalized recommendations, giving customers a clear advantage in protecting sensitive information.
Customers begin reaping benefits on day one with comprehensive visibility into their SaaS app footprint, along with reduced incidents of data breaches, downtime, and financial penalties resulting from regulatory non-compliance and security incidents.
VMblog: The market is a crowded space. What is it about your company and technology that sets you apart from the competition? What are your differentiators?
Simmons: Despite significant investments in SSO, MFA, IGA, and PAM, most organizations still have identity security challenges, especially regarding SaaS. Gaining comprehensive visibility into all SaaS usage remains the most difficult. To truly enhance security posture, organizations must address the blind spots and weaknesses that these solutions don’t cover. With Savvy, this is possible.
One thing Savvy does particularly well is identifying the combinations of toxic risk factors that lie at the intersection of identity and access management, user behavior and business context. Savvy is the only solution that can accurately make correlations to discover and remediate the most egregious identity risks in real time. An example would be employees with administrative access to applications containing sensitive data reusing passwords across unmanaged SaaS applications or bypassing security controls like SSO or MFA. Savvy provides essential visibility into both managed and shadow SaaS applications along with business context and automation capabilities to identify and mitigate the toxic combinations of risk that lead to security incidents.
VMblog: What is your message to Black Hat attendees coming out to the show this year? If they take back one message about your company, what should it be?
Simmons: Identity security is undoubtedly one of the most important objectives for security leaders right now. Recent research from Google shows that systems with weak or no credentials were the top initial access vector, accounting for 47% of cloud environment attacks during the first six months of the year. This is evidenced in recent events – the widely reported on Change Healthcare breach and ongoing compromise of Snowflake customers. As cloud and SaaS footprints expand, it becomes far more difficult to manage and secure identities.
Savvy is modern identity security built for the way we adopt and consume technology. Organizations gain comprehensive visibility into their SaaS environments along with the ability to analyze and understand their SaaS landscape and operational practices thoroughly. With Savvy, customers can take charge of SaaS security to improve their overall security posture by addressing security gaps and vulnerabilities before attackers can exploit them.
VMblog: Black Hat attendees are known for being security professionals at the forefront of the industry. What specific challenges do you anticipate they’ll be facing, and how will your solutions help them overcome those challenges?
Simmons: Despite significant investment in identity and access management tools, poor identity hygiene remains a huge problem for organizations. Our research has revealed that 35% of known SaaS apps – those that are onboarded and managed by the IT team – have risky identity-related attributes like the continued use of direct login versus SSO or weak, reused, or compromised credentials. The situation is even worse when we analyze SaaS apps not managed by IT. In that cohort, over 60% of apps had risky properties.
This year’s Dropbox Sign incident is an excellent example of how far-reaching the impact of SaaS compromise can be. Dropbox is a pervasive application used by both businesses and individuals so the theft of credentials created a massive problem. In addition to the many companies that rely on this platform for daily activities, there were most certainly instances where employees were using Dropbox Sign without the knowledge of IT. So almost any company could have been at risk.
Enterprises must focus on improving basic security hygiene. This has become ever more challenging in the age of SaaS, where the growth in the number of SaaS apps being adopted and the trend of decentralized app onboarding by business owners (versus IT admins) make security oversight difficult.
Savvy helps companies regain lost visibility and control over new SaaS apps and the shadow identities that are associated with them. The platform continuously monitors and analyzes identities, user activities, and business context to pinpoint the combinations of risk that lead to security incidents. Savvy automates the remediation of misused and risky identities, such as reused, compromised, or weak credentials. It also detects if SSO and MFA are being used on an identity and can guide the user to enable those options if configured. Enforcing these basic hygiene standards effectively prevents some of the most common types of attacks we see today, like credential stuffing and password spraying.
VMblog: Is your company launching anything new at the show? Without giving too much away, can you give us a sneak peek?
Simmons: Something we’ll be showcasing is our patent-pending zero-touch integrations for more than 300 commonly used SaaS apps. This approach eliminates the need for manual server-side configuration steps to integrate and manage SaaS apps.
Security teams are heavily burdened with integrating and managing SaaS tools. Savvy’s Zero-Touch Integrations empower businesses to seamlessly integrate and configure all of their SaaS apps, sanctioned or unsanctioned, without manual setup or technical expertise. Companies immediately gain comprehensive visibility into apps, identities, privileges, security hygiene, and more to maintain consistent security controls and compliance standards across their entire SaaS ecosystem.
VMblog: What are some of the top priorities security leaders should be considering for 2024?
Simmons: Identity security remains an ongoing challenge for companies. According to IBM X-Force, one-third of all cyberattacks in 2023 started with the compromise of valid account credentials. There are already countless examples this year of how poor identity hygiene – again, consider the impact on Snowflake customers who had not enabled multi-factor authentication – has led to significant events with devastating impact. When you consider Savvy’s own research, which shows that 60% of SaaS apps have risky credentials (like multi-factor authentication not being enabled), it’s easy to see why SaaS apps and identities are a prime target for threat actors. But IT and security do not always know where these risky identities are.
Revisiting the DropBox Sign incident, we have a pertinent example. As discussed, the application is used pervasively by both individuals and companies. When looking to mitigate the impact, the challenge for large organizations was not merely addressing the compromised credentials, but at a larger scale determining how and where those credentials were being reused across apps that held sensitive corporate data. That is why solutions like Savvy are so important. The ability to surface these toxic accounts and remediate issues at scale matters when it’s a race against time to prevent identity-based attacks.
The DropBox Sign breach is just a taste of what’s to come as SaaS and decentralized IT become the norm in business. Organizations have, on average, at least four times more SaaS apps than what is centrally managed by an internal IT department. Identities need to be managed without causing friction between security priorities and business initiatives, but for companies without automated tooling like Savvy, this is a nearly impossible task.
VMblog: There is a lot of discussion in the industry about the different elements of security, with the human component being an important one to address. How does Savvy help companies with the human element of security?
Simmons: Employees can be an organization’s strongest security asset or greatest security weakness. Flawed decisions by employees introduce massive risk. This issue is not new, but it’s become much more complicated as the ways we work and consume technology have evolved. It’s virtually impossible for enterprises to be aware of every app in use by its employees, much less manage and secure them, but limiting use of SaaS is to limit productivity and innovation.
As a result, companies are left scrambling to figure out how to grant employees autonomy – over the apps they use and the actions they take – safely. This is where Savvy thrives. We offer greater visibility into the SaaS applications being used by employees, including those that are not centrally managed by IT, so that security teams can see just how wide their SaaS sprawl is, identify toxic risk in SaaS, and automate fixes at scale. But beyond that, we address the human side of the equation by providing just-in-time guardrails that keep employees from engaging in those risky behaviors to begin with.
When individuals are presented with a roadblock, such as a security control, they are inclined to just work around it to save time. With Savvy, they can work through it efficiently, maintaining productivity for the organization while avoiding toxic risk behaviors. Savvy empowers employees to practice cyber hygiene without compromising workflow. The tech offers guidance rather than stringent controls, so employees can get their jobs done and keep the organization safe while doing so.
VMblog: Looking ahead, what excites you most about the future of cybersecurity, and how do you see your company playing a role in shaping it?
Simmons: SaaS has become foundational to business due to its ease of implementation, scalability, and low cost of entry. However, managing security within these environments is complex and challenging, as these platforms hold vast amounts of sensitive data and are accessed from numerous devices and locations. Rapid and decentralized adoption of SaaS applications, combined with security teams’ limited visibility and control over them, has led attackers to target SaaS identities as the primary way to access sensitive corporate data. As high-profile breaches are increasingly traced back to inadequate identity hygiene, understanding and mitigating these risks has never been more critical.
Our team is excited to be innovating in a space that has such a significant impact on companies across industries. Savvy’s mission is to empower businesses and individuals to safeguard their digital identities with innovative, user-centric solutions. Through its relentless focus on this mission, the team has developed effective, differentiated technology that meets and exceeds industry standards for SaaS identity security. We plan to build on this foundation, working closely with customers and design partners, to bring to market new capabilities and solutions that effectively solve important problems and are impactful within the market as needs continuously evolve.
##
