Cloud and SaaS, what is the point?

In the world of software offerings, the Cloud is gaining ground thanks to its ease of use and the focus on providing value-added services by simplifying many of the technical aspects for the customer. But what exactly do we mean by Cloud. But is it a good idea? What are the impacts on data security?

What are Cloud and SaaS?

If we refer to the Definition given by Wikipedia, Cloud (or Cloud Computing) is the exploitation of the computing power or storage of remote computer servers through a network, generally the Internet. In reality, and as the article states, the Cloud rather covers commercial offer terminology that is segmented at several levels according to the associated service offer.

There are in fact 3 levels of services that one is likely to buy from a supplier (knowing that this supplier can also buy a lower level service from another provider)

• IaaS : Infrastructure as a Service
• PaaS : Platform as a Service
• SaaS : Software as a Service

Depending on the type of service, here is the distribution of responsibilities between the customer and the supplier:

IaaS : purchase from a supplier of machines (virtual most of the time) on which you can install the operating systems and the desired applications. This service is similar to traditional accommodation services.

PaaS : located just above the IaaS services, the operating system and infrastructure tools are under the responsibility of the provider.

SaaS : the supplier provides the customer with an application that he can use directly without having to configure anything. This application can be made available via the internet but also via a private network or any other suitable means of connection.

What can the cloud bring?

No material investment

(IaaS, PaaS, SaaS)

The first advantage of the cloud is that there is no need to buy and maintain computer hardware other than that used for internal routing as well as office equipment. This represents a saving on investments to be implemented as part of a project, but also in terms of the human resources required to manage these infrastructures.

Hardware redundancy

(IaaS, PaaS, SaaS)

Since server virtualization, data storage and infrastructures are managed by the service provider on a very large number of machines, a high level of redundancy can be ensured and thus makes most hardware failures completely transparent to the user. This makes it possible to reach a level of application availability that is much higher than what can be achieved with own infrastructures.

Servers that are always up to date and maintained by experts

(PaaS, SaaS)

The operating system of the machines as well as the supervision of the infrastructure are under the responsibility of the supplier. Therefore, the customer does not have to worry about these tasks, which require specialized skills and are often time consuming. In the context of PaaS or SaaS, these tasks are carried out by experts in the field, which ensures that the best practices in terms of security are implemented. It is one of the essential foundations for guaranteeing the security of the data processed and the availability of infrastructures.

Great flexibility in the sizing of resources

(PaaS, SaaS)

One of the main strengths of the cloud is the ability to adjust resources quickly and dynamically according to application needs. This concerns both computing power, memory but also storage space. Different mechanisms make it possible to simply play on these different levers in order to offer great comfort and flexibility to application users at the best cost.
Let's take the example of an application that would require significant calculations once a day for 1 hour. In the case of an infrastructure of its own, it would be necessary to size it for these calculations and the rest of the time it would be very oversized. With a Cloud infrastructure, it is possible to mobilize, and therefore pay, computing power for only one hour per day for this need.

Business applications that are always up to date

(SaaS)

In the context of SaaS, the supplier delivers directly to its customer the applications that it maintains and updates in an industrialized manner. This leads him to do it frequently and reactively. This guarantees the customer to have a scalable and flexible application both in terms of new functionalities, bug fixing or urgent troubleshooting.

What are the impacts of SaaS on data security and confidentiality?

Separation of stored data

Since infrastructures are no longer under the responsibility of the application user, it is necessary to guarantee the latter that their data will not be accessible by third parties. Here are the various elements to ensure a very high level of data confidentiality:

• Systematic encryption of stored data. Cloud storage technologies allow data to be encrypted on the fly without losing performance.
• System partitioning through the use of dedicated server instances for a client and/or dedicated databases. In this context, the servers that run the application and/or the databases only see customer data pass through, which ensures total partitioning with respect to other customers.
• Access to secure server instances for teams in charge of application maintenance: use of best practices in terms of secure access (cloud host's proprietary systems, authentication certificates, IP filtering, SSL encryption, SSL encryption, strong multi-factor identification...)

Integrity of stored data

On this point too, the Cloud makes it possible to achieve a very high level of security. Data can be backed up regularly and transparently with best practices:

• Incremental backups allowing you to return to a specific point in time.
• Backups in parallel on different hardware and geographical locations to protect against hardware failures.
• Encryption of backups.

In the event of data loss, which is unlikely due to system redundancy, it is possible to put applications back into service as soon as possible thanks to these backups.

On the other hand, as the service is provided in SaaS, the data stored at the provider is safe from attack by cryptoware, malware and other viruses that could infect the customer's network.

Protection of access to applications

One of the potential ways to access customer data in a fraudulent manner is by accessing their applications. To avoid this type of attack, several solutions (which can be combined) exist:

• Access to the application by login and password secured by SSL encryption.
• Server-side identification certificates.
• Client-side identification certificates.
• Use of strong multi-factor identification.
• Use of dynamic passwords.
• Filtering by IP address of machines authorized to connect to the application.
• Use of a virtual private network (VPN).

Data protection in transit

Because of its architecture, data coming from and going to the Cloud will transit on public networks. It is essential to ensure that no third party will be able to access data in transit.

• For easy access to applications from the Internet, it is possible to set up an encrypted connection (SSL) with a certificate, which guarantees that the data in transit is encrypted and makes it possible to identify the service provider with certainty.
• In the case of access from a limited number of points, it is possible to set up a private connection (generally a virtual private network — VPN) that guarantees the security of the connection. Data can also be encrypted using this secure connection.

What are the impacts of SaaS on data control over time?

Since the data is no longer stored with the customer but with the service provider, it is important for the customer to ensure the possibility of recovering their data, whether it is:

• To disengage and be able to adopt another application solution (SaaS or not).
• For its own use.

It is obvious that the data belongs to the customer, however it is a point of vigilance that must be negotiated with the SaaS service provider.

Data reversibility

Reversibility is the ability to go back to the fact that data is stored with the provider. The supplier must undertake to make his customer's data available at his request through a format readable by the latter. The contract for the provision of the SaaS service must include a reversibility clause in order to guarantee this right to the customer.

How do you get the best quality of service with SaaS?

As the calculation and storage infrastructures are no longer managed by the application user, the latter will have to devote themselves only to correctly sizing access to the SaaS platform in order to guarantee the best quality of connection and therefore of service.

Internet access sizing and redundancy

Since access to the platform is a critical point, the user will have to ensure that the access of his site to the Internet is sufficiently robust, in particular:

• Use of internet access with a level of quality of service (QoS) and speed adequate for use.
• Redundancy of access on different technologies (fiber, XDSL...) and different suppliers.
• On-site routing infrastructures configured to transparently support redundancy and to ensure the necessary flow reservation for SaaS applications.

Up-to-date user stations

Since SaaS solutions are most of the time provided through web applications, it is important to have user workstations using a browser recommended by the provider and updated regularly. Depending on the type of SaaS application, it will also be necessary to update the modules necessary for the proper functioning of the application.

In conclusion

A SaaS offer allows its user to:

• Focus on the use of applications.
• Offload the management of infrastructures, systems and applications.
• Benefit from the best level of security, reliability and availability.
• Optimize the cost/user experience ratio thanks to great agility on resources.
• Have simple and secure access to your applications from any location.
• Reduce investments in equipment, licenses and reduce their management costs.
• Be much less exposed to obsolescence problems.

Points of vigilance before implementing a SaaS solution:

• The security policy implemented by the supplier.
• Encryption measures implemented between the supplier and the customer.
• The quality of application access controls.
• The data backup rules put in place by the provider.
• The reversibility clause of the contract.
• The quality of the network access infrastructures in place at the customer.

Authors: Marouane Hassani and Mathieu Cura

‍