Full of SaaS and TOTALLY SECURE

The talk opens with an analogy: a security team responsible for a building where staff can add doors at will, with no reliable record of the new entrances. The speaker argues that SaaS adoption works the same way. Teams buy and connect applications outside IT, so most organizations cannot produce an accurate inventory of their apps, their users' activity, or their attack surface. Several statistics on shadow IT spending and on employees willing to bypass security guidance frame the problem.

The speaker groups the usual responses into three approaches: ignoring the problem, enabling fast adoption, or locking everything down. Ignoring it invites compromise, and blocking tends to backfire. A behavioral study with Duke University found that punitive or blocking messages drove resentment and workarounds, while a friendly question about why someone adopted a tool earned more cooperation. Incidents discussed include a 2021 Electronic Arts breach that began with stolen Slack session cookies, a 2023 CircleCI breach driven by stolen session tokens, and a Survey Monkey compromise used to send phishing surveys. The talk also covers vendor subprocessors and why smaller firms struggle to recover from breaches.

The recommended path starts with discovery and visibility, followed by automating the research on each app and asking users about new tools through identity provider workflows. Continuous curation should be a named responsibility rather than a one-time project. The speaker closes by urging security teams to help people adopt tools responsibly instead of acting as the department of no.