Software As A Service security. Is IT security compliance the answer?

Software as a Service, also known as SaaS, has become an IT buzz word in recent years, but the industry is not without its critics. SaaS is a form of software distribution where applications are hosted off site by a third party vendor and available to customers over the internet. The question on the minds of many professionals is just how secure the SaaS model really is.

For better or worse, few could argue that SaaS has not already revolutionised the way that most companies and consumers do business. As a result, SaaS entrepreneurs are flocking to the market to cash in while the industry is hot. Here in Australia, local companies are opening businesses nearly every month with the promise of efficient and custom designed software on the SaaS model. By the end of 2009 alone, the Australian market for the new SaaS industry has been predicted to be worth nearly $11 billion dollars by the IDC.

However, many security experts have sounded alarms that most SaaS vendors are rushing services to the market before adopting information security standards. These security concerns have had a chilling affect on the burgeoning SaaS market, as business owners and IT professionals alike are reluctant to open their networks and systems to a potentially disastrous loss of client data through a security breach. Thankfully, SaaS vendors have heard the concerns of security experts and customers, and the industry is currently rushing to adopt a standard that will ensure that SaaS products have been properly designed to reduce the risk of security breaches.

Before entrepreneurs rush into the SaaS market, it is critical that they address potential security concerns in all stages of developing their software and services. However, it seems likely that nothing short of the adoption of industry wide security standards will apease the understandable concerns of wary customers. ISO 27001 is the most relevant international standard to date, and some of the largest SaaS companies have begun adopting this existing standard in the interim.

As of yet, most SaaS vendors have been slow to adopt the ISO 27001 certification, as there are concerns as to whether this particular standard would truly attract new customers. Businesses such as Salesforce.com have already become certified, and security experts point out that becoming certified is at least a step in the right direction.

However, it is important to note that simply achieving ISO 27001 certification is unlikely to resolve the ongoing security concerns of SaaS customers. The world of IT security is continually evolving, and keeping up with the latest security concerns must become an ongoing practice for all SaaS vendors.

Hopefully a standard will be developed that is specifically designed for the SaaS industry. In the meantime, SaaS vendors can start proving that they take their customers security very seriously by achieving ISO 27001 certification and staying abreast with the latest relevant security developments.