{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/saas","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/saas/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/saas/"},"term":{"en":"Software as a service (SaaS)","da":"Software as a service (SaaS)"},"aka":{"en":[],"da":[]},"domain":["platform"],"cluster":"cloud","layer":"infrastructure","status":"current","era":2001,"summary":{"en":"The cloud model where you simply use a finished program over the internet, and the provider runs everything behind it.","da":"Cloudmodellen, hvor du blot bruger et færdigt program over internettet, og udbyderen driver alt bag det."},"body":{"formal":{"en":"A cloud service model in which the customer uses the provider's programs, usually through a web browser, without managing the servers, operating system or program itself, apart from limited user settings.","da":"En cloud-servicemodel, hvor kunden bruger udbyderens programmer, typisk gennem en webbrowser, uden at drive servere, styresystem eller selve programmet, bortset fra begrænsede brugerindstillinger."},"plain":{"en":"Like taking a taxi instead of owning a car - you say where to go, and someone else handles the engine, the fuel and the repairs.","da":"Som at tage en taxa i stedet for at eje en bil - du siger, hvor du skal hen, og en anden klarer motor, brændstof og reparationer."},"inPractice":{"en":"A school moves to an online email and document suite; the school's IT lead no longer runs mail servers but still decides who gets accounts, whether MFA is on and who files may be shared with.","da":"En skole går over til en online pakke til mail og dokumenter; skolens IT-ansvarlige driver ikke længere mailservere, men bestemmer stadig, hvem der får konti, om MFA er slået til, og hvem filer må deles med."},"whyItMatters":{"en":"Even when the provider runs everything, the customer still owns its data, its user accounts and its sharing settings - and many breaches in such services start there.","da":"Selv når udbyderen driver alt, ejer kunden stadig sine data, sine brugerkonti og sine delingsindstillinger - og mange brud i den slags tjenester starter netop der."}},"deepDive":{"en":"NIST SP 800-145 defines SaaS as the capability to use the provider's applications running on a cloud infrastructure, accessible through a thin client such as a browser or through a program interface, where the consumer manages neither the infrastructure nor individual application capabilities, apart from limited user-specific configuration. Salesforce, founded in 1999, established the commercial pattern; Microsoft 365, Google Workspace and ServiceNow made it the default for business software. The defining architectural property is multi-tenancy, commonly described as silo (a dedicated stack per tenant), pool (shared compute and database, with every row carrying a tenant identifier enforced by query scoping or database row-level security) or a hybrid bridge model. In the pool model a single scoping bug becomes a cross-tenant data leak, which is why tenant isolation is the first thing to probe in a SaaS security assessment.\n\nThe customer's remaining controls are concentrated in identity and configuration. Authentication is federated to the organisation's identity provider via SAML 2.0 or OpenID Connect, accounts are provisioned and, crucially, deprovisioned via SCIM 2.0 (RFC 7643 and RFC 7644), and conditional access or MFA is enforced at the IdP. OAuth consent grants to third-party integrations are a separate and often unmanaged trust channel: a token granted to a connected app keeps working after a password reset and bypasses MFA. The 2024 wave of intrusions into Snowflake customer tenants worked with credentials harvested by infostealer malware against accounts that had no MFA; the provider's platform itself was not breached.\n\nHundreds of tenant settings drift over time, including external sharing (\"anyone with the link\"), guest access, mail forwarding rules and legacy authentication protocols; SaaS security posture management tools baseline and monitor them. Audit logging depends on licence tier and retention, and after the Storm-0558 intrusion in 2023 Microsoft broadened the logging available to standard customers. Providers generally protect against their own failures but not against customer-side deletion, malicious insiders or ransomware syncing encrypted files, so backup of SaaS data is usually a customer task. Exit requires data export in usable formats.\n\nUnder GDPR the SaaS provider is typically a processor; Art. 28(2) requires the controller's prior specific or general written authorisation for sub-processors, so the sub-processor list and change notifications belong in supplier management, together with data location and Chapter V transfer mechanisms. NIS2 Art. 21(2)(d) brings SaaS dependencies into supply chain security. SaaS differs from PaaS in that the customer brings no code, and from traditional managed hosting in that all customers run the same multi-tenant version on the provider's release schedule.","da":"NIST SP 800-145 definerer SaaS som muligheden for at bruge udbyderens applikationer, der kører på en cloudinfrastruktur og tilgås via en tynd klient som en browser eller via et programinterface, hvor kunden hverken driver infrastrukturen eller de enkelte funktioner i applikationen, bortset fra begrænsede brugerspecifikke indstillinger. Salesforce, grundlagt i 1999, etablerede forretningsmodellen, og Microsoft 365, Google Workspace og ServiceNow gjorde den til standard for forretningssoftware. Den afgørende arkitekturegenskab er multi-tenancy, typisk beskrevet som silo (en dedikeret stak pr. kunde), pool (delt compute og database, hvor hver række bærer et kunde-id, som håndhæves via afgrænsning i forespørgslerne eller row-level security i databasen) eller en hybrid bridge-model. I pool-modellen bliver én fejl i afgrænsningen til et datalæk på tværs af kunder, og derfor er isolation mellem kunder det første, man afprøver ved en sikkerhedsvurdering af en SaaS-løsning.\n\nKundens tilbageværende kontroller samler sig om identitet og konfiguration. Autentificering fødereres til organisationens identitetsudbyder via SAML 2.0 eller OpenID Connect, konti oprettes og ikke mindst nedlægges via SCIM 2.0 (RFC 7643 og RFC 7644), og betinget adgang eller MFA håndhæves i IdP'en. OAuth-samtykker til tredjepartsintegrationer er en separat og ofte ustyret tillidskanal: et token givet til en tilknyttet app virker stadig efter nulstilling af adgangskoden og går uden om MFA. Bølgen af indbrud i Snowflake-kunders miljøer i 2024 skete med loginoplysninger høstet af infostealer-malware mod konti uden MFA; selve udbyderens platform blev ikke brudt.\n\nHundredvis af indstillinger i et kundemiljø glider over tid, herunder ekstern deling (\"alle med linket\"), gæsteadgang, regler for videresendelse af mail og ældre autentificeringsprotokoller; værktøjer til SaaS security posture management fastlægger en baseline og overvåger dem. Revisionslogning afhænger af licensniveau og opbevaringstid, og efter Storm-0558-indbruddet i 2023 udvidede Microsoft den logning, der er tilgængelig for almindelige kunder. Udbydere beskytter som regel mod egne fejl, men ikke mod sletning hos kunden, ondsindede insidere eller ransomware, der synkroniserer krypterede filer, så backup af SaaS-data er normalt kundens opgave. En exit kræver, at data kan eksporteres i brugbare formater.\n\nEfter databeskyttelsesforordningen er SaaS-udbyderen typisk databehandler; art. 28, stk. 2, kræver den dataansvarliges forudgående specifikke eller generelle skriftlige godkendelse af underdatabehandlere, så listen over underdatabehandlere og varsling af ændringer hører til i leverandørstyringen sammen med datalokation og overførselsgrundlag efter kapitel V. NIS2-direktivets art. 21, stk. 2, litra d, trækker SaaS-afhængigheder ind under sikkerhed i forsyningskæden. SaaS adskiller sig fra PaaS ved, at kunden ikke leverer kode, og fra klassisk managed hosting ved, at alle kunder kører samme multi-tenant-version efter udbyderens udgivelsesplan."},"edges":[{"type":"requires","to":"cs/account","confidence":"high","strength":"normal"},{"type":"kind-of","to":"platform/cloud-computing","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"NIST SP 800-145 - The NIST Definition of Cloud Computing","tier":"standard","publisher":"NIST"}],"draft":true}