HOW TO SECURE THE SAAS APPS OF THE FUTURE

Summary from the TLDR InfoSec newsletter

This post introduces the identity problems that modern SaaS apps face and the more complex ways that attackers hunt for access. It lays out SSO, user provisioning (via SCIM), and programmatic access to logs as requirements for modern SaaS apps. It also proposes proof-of-possession, continuous access evaluation profiles, and universal logout for SaaS apps of the future.