TNS
VOXPOP
Where are you using WebAssembly?
Wasm promises to let developers build once and run anywhere. Are you using it yet?
At work, for production apps
0%
At work, but not for production apps
0%
I don’t use WebAssembly but expect to when the technology matures
0%
I have no plans to use WebAssembly
0%
No plans and I get mad whenever I see the buzzword
0%
Security / Software Development / Software Testing

5 Steps to Secure Your SaaS Sandbox

Prevent threat actors from accessing data through underprotected testing instances.
Mar 13th, 2023 11:22am by
Featued image for: 5 Steps to Secure Your SaaS Sandbox

Sandboxes are an important piece of any company’s tech stack, even those companies that aren’t involved in software development. Companies that use SaaS applications, for example, use a sandbox environment to customize an application to meet the needs of users.

This happens in one of two ways. With new SaaS applications, app owners and administrators take the out-of-the-box app and create layouts, rename fields and develop workflows that will best suit existing processes. They may also test third-party app integrations to find one that provides additional functionality. While working in the sandbox environment, they often connect real or synthetic data to the application to ensure that the app functions as expected.

With existing SaaS applications, administrators and app owners will duplicate the existing app instance to make improvements or changes to the core application. Using a copy of live data, they can adjust screens, add functionality and reimagine workflows to develop better processes.

The sandbox environment isn’t connected to the production environment. Changes made within the sandbox don’t affect production until administrators implement those changes into the live instance.

Because the sandbox environment is only being used by a small number of employees, they frequently overlook security considerations. They don’t realize the data within can be compromised.

Learn how Adaptive Shield can help you automate the security for your SaaS sandbox.

SaaS Sandbox Risks

A large private hospital built a demo site to test its new appointment-setting system. A researcher using network-scanning software came across the site and entered Admin for the username and password. The credentials worked, providing the researcher with access to data from 50,000 patient records.

Test sites that use real data or are connected to live production databases create an extremely high-risk environment. Often lacking rudimentary security features beyond an easy-to-remember username and password, the data can easily be downloaded by threat actors and then held for ransom or published. When connected to a live production database, threat actors can encrypt the data, disrupting work in the production environment and forcing companies to pay high ransoms.

Even organizations that use synthetic data in their production environment need to take security precautions. Threat actors can use the sandbox environment for reconnaissance, exploring the application and looking for vulnerabilities. The sandbox often reflects the operational system’s configurations, and attackers can use that knowledge to penetrate the live system.

5 Steps to Keep Your Sandbox Secure

The solution for protecting the data and structure of the sandbox is actually rather simple: Secure the sandbox environment the same way you secure your production system SaaS applications.

Step 1: Manage and Control Access

Limit users that have access to your sandbox, and ensure that only authorized users can create a sandbox environment. This will ensure that there are no unauthorized sandbox versions of your SaaS application floating around the internet.

Step 2: Match Your Settings

Maintain the same security configurations in your sandbox instance as you have on your production instance, such as multifactor authentication or implementing single sign-on and Identity Provider (IdP). Many SaaS apps have additional security settings designed for the app. For example, if your production Salesforce instance includes content sniffing production, default data sensitivity levels or authentication through custom domain, use those settings in your sandbox instance.

Step 3: Use Synthetic Data

Replace your production data with synthetic data. SaaS sandboxes are used to test changes in configurations, processes and flows. Any data using the same format should be sufficient. Avoid copying your production data or connecting to a live production database.

Step 4: Apply Any Changes to Security Settings

If there are security setting changes to your production environment, make the same changes to your sandbox instance. Sandbox security settings are frequently left unchanged, making the data vulnerable to threats that were minimized in the production environment. Reduce risk by syncing the sandbox daily.

Step 5: Close Your Sandbox When Done

Reduce your attack surface by shutting down sandbox environments when done. In circumstances when the sandbox instance needs to be maintained over long periods of time, limit access during dormant periods to those employees who require access and remove all other users.

Automate Your SaaS Security

Tracking misconfigurations and ensuring security in a sandbox environment can be time-consuming, and it’s easy to miss changes that are made by users. Implementing a SaaS secure posture management (SSPM) solution to your sandbox will help eliminate configuration drift, enabling prioritization of misconfiguration management and protecting against over-scoped third-party applications.

Explore how to automate security for your sandbox and SaaS app stack.

Group Created with Sketch.
TNS owner Insight Partners is an investor in: Pragma, Adaptive Shield.
THE NEW STACK UPDATE A newsletter digest of the week’s most important stories & analyses.