Does SaaS Stand for Software as a Security Lapse? - Twenty-Four Seven Security

« Top Tips for Working Securely From Home | Main | Six Must Have Security Tools (and They're Free) »

May 21, 2008
Does SaaS Stand for Software as a Security Lapse?

Found an interesting blog over at ZDNet over some of the security weaknesses showing up on various Web 2.0 applications...in this case it was the Zoho Writer tool, the browser based word processing software, that, when the author wanted to quickly retrieve one of her works on her Zoho page, she did a search (imagine all the tiresome reading we'd have to do without keyword search), and not only did the intended document show up, but so did 7 other documents created by people she didn't know.

Obviously, it's a problem when documents are popping up all wily-nilly when searching someone else's stuff (I mean, what if the document had private data on it). This essentially highlights a growing weakness for Web 2.0 in that, while it's no surprise that many SaaS applications have undiscovered weaknesses and vulnerabilities (which is why applications should be security tested before they're launched onto the web), what is a surprise is that many of these vulnerabilities remain undisclosed.

The author of the piece quickly informated Zoho of the problem, and they quickly fixed it, but when the author then checked to Zoho blog for any mention of the vulnerability, it was never brought up. Now I'm sure anyone whose ever been involved in a small company is well aware that you should never advertise your shortcomings, the problem with Web applications is that unmentioned vulnerabilities can only amplify the problem.

The problem is, this is essentially become standard operating procedure with SaaS applications (as Google and Microsoft routinely fix big bugs without any notification). And as it's their application running on their servers, it's pretty easy to see why they don't think they need to tell anyone. But as someone who is in the role of anyone, I sure would like to know the risks I don't even know I'm taking.

To read the full article from ZDNet, click here.