SaaS Inter-Service Visibility via Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increased interoperability between SaaS services poses challenges for security teams in protecting organizations against cyber threats, as it becomes difficult to detect and mitigate anomalous communications between services, especially when shadow services are hidden from security teams.
Innovation Solution
A method and system for securing SaaS platforms by providing inter-service visibility, which involves identifying connected services through log data and API calls, creating baselines for communications patterns, detecting anomalous communications, and performing mitigation actions such as generating alerts or blocking communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security teams limit what can be installed on user devices and require prior approval for any new installations, then security protection is improved, but user productivity and service adoption deteriorate due to friction
Solution Approach 1:
The system performs preliminary actions by establishing baselines for normal service communications before threats occur. Log data is collected and analyzed in advance to create expected communication patterns, enabling the system to proactively detect deviations that indicate security threats without requiring reactive user actions or installation approvals.
Solution Approach 2:
The system implements continuous feedback loops by monitoring service communications in real-time, comparing actual communications against established baselines, and automatically responding to anomalies. This automated feedback mechanism enables security protection without user intervention, maintaining both security and productivity.
2Reliability
If security teams require prior approval for software installations, then control over sanctioned services is improved, but shadow services hidden from security teams increase
Solution Approach 1:
The system applies universal monitoring across all service communications regardless of approval status. The baseline comparison mechanism works uniformly for both sanctioned and unsanctioned services, enabling the system to detect threats from shadow services without requiring explicit knowledge of their existence or user approval actions.
Solution Approach 2:
The system enables self-service security monitoring by automatically detecting and responding to threats without requiring user reporting or security team investigation. The automated anomaly detection and response mechanisms handle shadow services independently, eliminating the information loss that occurs when users hide unauthorized installations.
3Reliability
If security teams block all inter-service communications to prevent threats, then security protection is improved, but service interoperability and productivity deteriorate
Solution Approach 1:
The system applies different security measures to different communication patterns based on their specific characteristics. Sanctioned services with established baselines receive permissive treatment, while anomalous communications trigger security responses. This localized approach protects against threats while maintaining necessary interoperability for legitimate services.
Solution Approach 2:
The security system dynamically adjusts its behavior based on real-time communication patterns. Rather than static blocking, the system continuously compares actual communications against baselines and adapts its response accordingly. This dynamic approach enables security protection that automatically accommodates legitimate service interoperability while blocking threats.
Data Source
AI summary
A system and method for securing software as a service (SaaS) platforms by providing inter-service visibility. A method includes identifying, based on log data of a first service, a second service connected to the first service, wherein each of the first service and the second service is a set of functions for performing a respective task, wherein the second service is called by the first service; identifying a plurality of patterns in communications between the first service and the second service in the log data of the first service; creating, based on the identified plurality of patterns, a baseline for communications between the first service and the second service; detecting an anomalous communication between the first service and the second service, wherein the anomalous communication deviates from the baseline; and performing a mitigation action with respect to the detected anomalous communication.