Overview
Posture drift is a configuration change that weakens a secure setting in a connected application. After you fix a failed SaaS posture check, administrators can change settings to solve a short-term problem, applications can introduce new features with permissive defaults, or integrations can request new access. Each change can quietly undo the work your team did to harden the application. For example, a sharing policy that is loosened or an MFA requirement that is turned off. Cato detects these changes in the audit logs collected by the App Activities connector. If the application also has a SaaS Posture connector, Cato links each drift to the posture check that the change caused to fail, with its remediation guidance.
Posture drift also supports threat detection. An attacker who gains administrator access often weakens security controls to keep that access, for example by disabling MFA requirements or adding a trusted location to a Conditional Access policy. These changes appear as drift even when no one on your team made them.
Posture drift detection requires an App Activities connector. Adding a SaaS Posture connector for the app links each drift to a posture check.
A CASB license is required for posture drift detection. For more information about purchasing a CASB license, please contact your Cato representative.
Understanding Posture Drift and SaaS Alerts
Posture drift and SaaS alerts are both detected in the audit logs collected by App Activities connector. They each have a distinct purpose:
Posture Drift: A SaaS Posture check that previously passed, but has now failed, weakening the security posture of the app’s configuration
SaaS Alerts: App Activities detections of suspicious post-breach activity (persistence, privilege escalation, exfiltration)
Viewing Posture Drifts
You can view Posture Drifts from:
Cloud Apps Dashboard: The Posture Drifts tile in the highlights bar shows the number of posture drifts, grouped by severity. The Top Posture Drifts widget in the SaaS Security Posture section lists them. For more information, see Using the Cloud Apps Dashboard
Posture Page: On the SaaS Security tab, filter the checks to show drifted checks
Events Page: Posture Drifts create an event with the Label SSPM Drift
Use Case
The security team at company ABC secured external sharing in Microsoft 365, and the related posture check has passed since then. A project manager asks a SharePoint administrator to allow anonymous sharing links for a vendor project, and the administrator changes the setting.
Cato detects the change in the Microsoft 365 audit log. The change appears in the Posture Drifts tile of the Cloud Apps Dashboard, linked to the external sharing posture check. The security administrator reviews the drift, confirms that the change wasn't approved, and creates a ServiceNow ticket for the SharePoint administrator to restore the setting and share the files with the vendor through a guest account.
Remediating Posture Drift
Remediating a Posture Drift involves identifying the drift in the CMA and updating the configuration within the third-party app.
To remediate Posture Drift:
Navigate to Home > Posture and identify the drift.
Review what configuration change was made:
To identify who made the change, filter the Home > Events page for admin settings activities in that application at the time of the change.
Determine whether the change was authorized:
If it wasn't, treat it as a possible security incident and review the SaaS alerts for the account that made the change.
If it was, but it weakens security, work with the application owner to find a secure alternative.
Follow the remediation guidance in the check, or create a ticket for the application owner. For more information, see Creating Tickets for Failed Posture Checks.
After the setting is restored, the check passes on the next posture evaluation, and the drift is no longer displayed.