The use of SaaS apps has grown exponentially over the last few years, increasing by 18% in 2022 alone.

According to BetterCloud’s ‘The State of SaasOps’ 2023 report, organisations are using 130 apps on average. With this huge amount of growth comes a whole lot of sensitive data being shared between employees and customers. 

Data Security Posture Management (DSPM) focuses on the data layer of a business, giving security teams visibility over the data in their ecosystems, such as sensitive PII and PHI, as well as company secrets. 

It helps them to understand where data is stored, who can see it, and how it’s being used, all through automated processes. Instead of security teams trawling through SaaS apps to manually detect sensitive data and revoke access, DSPM arms security teams with the information they need to understand the data they’re holding, and makes it easier to protect it by setting remediation and redaction rules. 

How does DSPM protect sensitive data?

DSPM solutions can integrate seamlessly with SaaS apps such as Slack, Google Drive, and Jira. Automatically scanning for classifiers such as credit card numbers, email addresses, and phone numbers, they let security teams know the risks associated with these files. 

A DSPM solution can also help to triage risks so CISOs or other security professionals know what they’ll need to address urgently. The technology works off rules that teams can create in order to take actions like terminating access immediately, redacting sensitive data after a set period of time, or notifying employees if they’ve breached company security policies. 

How can DSPM help you? 

With more people working remotely than ever before, gaps are being revealed in security team set-ups. Employees don’t have a dedicated IT team at home who can keep an eye on the risks posed to their tools. 

As well as automating processes to free up a security professional’s time, it can also help create a more security-aware culture within your organisation. Considering human error causes 82% of data breaches, it’s easy to see why companies might want to educate their employees on data protection. DSPM solutions can notify employees with real-time notifications so they’re aware of their actions in the moment, keeping security front of mind. This reduces the risks of people exposing data accidentally, making sure your business is protected at the first line of defence. 

With a DSPM solution in place, you can better understand where your data is, and take steps to protect it so the risk of a data breach will be minimised. And with breaches on the rise, and an average $4.35m cost attached to them, it only makes sense to control your sensitive data so if your company were to be compromised, no information would be leaked. 

It can also help you to stay compliant with laws like GDPR and HIPAA, redacting data after a set period of time, and keeping customer data safe from prying eyes. 

How are companies using DSPM?

Let’s look at a few examples: 

- The team at Company 1 have been using SaaS apps for years with their 1000-strong staff finding it easier to collaborate with tools such as Google Drive. Their CISO has recently discovered a DSPM solution that helps them to monitor files that have been historically shared and has uncovered hundreds of forgotten files that are publicly accessible. 

As a result, they immediately changed access permissions to ensure the files were no longer public. Their DSPM solution has helped them to set custom rules, ensuring that any sensitive data doesn’t leave the boundary of the business in the future.

- Company 2 uses their DSPM solution to make sure contractors who work with the company for a short time do not have access to files in the future. Documents could include sensitive data such as customer email addresses and phone numbers, as well as company secrets. Using the new tool, they can revoke access immediately from contractors who stopped working with the company a long time ago and continue to revoke access from contractors in the future once the project they’re working on is complete. 

- Finally, Company 3 uses their DSPM solution to ensure compliance with GDPR and HIPAA legislation. For instance, GDPR rules dictate that personal information should be stored for the shortest time possible. So when it comes to the company audit, if the PII data for hundreds of customers is sitting in Slack channels, there could be a good chance the business isn’t complying with GDPR regulations. 

With their DSPM solution in place, they can identify where the files are sitting, control who has access, and make sure the data expires after a certain amount of time, keeping them within the confines of the law. 

‍What’s the difference between CSPM & DSPM? 

Cloud Security Posture Management (CSPM) focuses mainly on the infrastructure of your security and making sure things are set up correctly. DSPM, however, focuses on the all-important data layer. 

Both can be beneficial to a business, and it’s worth having both in place to ensure that your company is fully protected when it comes to security.  

‍Conclusion 

It’s well worth reviewing your own DSPM practices and seeing whether they’re sufficient to protect your business, especially as you grow. 

Bringing a DSPM solution to your company could help you minimise the risks if your SaaS apps were to be compromised as you’ll know that you’ve taken the necessary steps to avoid sensitive data being leaked.

Check out our case study with TravelPerk to see how Metomic helped them to protect their sensitive data as they scaled. 

‍