Cloud SaaS Security Analytics Without Direct Application Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions for cloud-based SaaS applications lack comprehensive visibility and monitoring, especially for unfederated applications, leading to gaps in cybersecurity-related insights due to limited access and visibility across multiple SaaS applications.
Innovation Solution
A method that leverages identity provider (IDP) and single sign-on (SSO) data to generate analytics without accessing the SaaS applications, using a centralized analytics compute device to collect, standardize, and enrich data from various IDPs and SSOs, incorporating browser extensions for unfederated applications, and applying machine learning to provide a comprehensive view of SaaS risk exposure and user activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access to SaaS applications is restricted for privacy reasons, then user privacy is protected, but cybersecurity visibility across SaaS applications is reduced
Solution Approach 1:
The patent introduces an intermediary system that collects cybersecurity data from IDP/SSO services as a mediator between user authentication and cybersecurity monitoring. This intermediary aggregates data from multiple SaaS applications without requiring direct access to the applications themselves, enabling security visibility while maintaining privacy restrictions. The intermediary processes authentication events, user activities, and security parameters to provide comprehensive cybersecurity insights across all SaaS applications.
2Difficulty of detecting and measuring
If comprehensive monitoring of multiple SaaS applications is implemented, then cybersecurity visibility is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal cybersecurity monitoring system that handles multiple SaaS applications through a single integrated platform. The system uses standardized protocols to collect data from various IDP/SSO services, providing multi-functionality in monitoring, analyzing, and visualizing security events across different applications. This universal approach consolidates what would otherwise require multiple separate monitoring systems into one unified solution, reducing overall system complexity while maintaining comprehensive visibility.
3Measurement precision
If direct access to SaaS applications is granted for analysis, then cybersecurity analytics quality is improved, but access control requirements are relaxed
Solution Approach 1:
The patent extracts cybersecurity data from the authentication and access control layers (IDP/SSO services) rather than requiring direct access to SaaS applications. By taking out security-relevant information from the perimeter authentication services, the system can perform comprehensive cybersecurity analytics without bypassing or relaxing access controls. This extraction approach maintains strict access control while still enabling high-quality security analysis through the collected authentication and activity data.
Data Source
AI summary
In an embodiment, a method includes receiving, via a processor, identity provider (IDP)/single sign on (SSO) data that is associated with an IDP and an SSO entity. The IDP and the SSO entity manage access to a plurality of cloud-based applications for a plurality of user compute devices for a plurality of users. The method further includes generating, via the processor and without accessing the plurality of cloud-based applications, analytics based on the IDP/SSO data. The method further includes causing, via the processor, an action based on the analytics.