Overview
SaaS applications hold some of your organization’s most sensitive data, from customer records and source code to financial documents and internal communications. Securing them requires more than deciding which applications employees can use, it requires ongoing visibility into their configuration, users, activities, and connected integrations.
SaaS Security is a set of capabilities included in your Cato CASB license. It helps you govern how SaaS applications are used, assess how they are configured, harden how they are configured, review the third-party apps connected to them, and monitor the activity inside them.
SaaS Security is managed from Security > Cloud Apps in the Cato Management Application (CMA).
A CASB license is required for SaaS Security.
Understanding Inline and Out-of-Band (API) Coverage
SaaS Security uses two complementary ways to see your applications. For complete coverage of sanctioned and unsanctioned applications, and of managed and unmanaged users, we recommend using both.
Inline (Application Control) analyzes traffic as it passes through the Cato Cloud, from Sites and remote users connected with the Cato Client. Cato identifies the applications in this traffic without any configuration, so you can see which applications are used, by whom, how much data is uploaded to and downloaded from each one, and how risky each one is. To see and control activities inside an application, such as uploads and sharing, and to distinguish corporate tenants from personal tenants, enable Application Control and TLS Inspection. Inline controls can block an activity in real time.
API connectors (SaaS Posture Management, Interconnected Apps, and App Activities) gain access and analyze data directly from the cloud app. For example, its configuration, its third-party grants, and its audit logs. They provide visibility of every user's activity, including contractors on unmanaged devices and users who connect to the application without going through the Cato Cloud. Connectors do not require TLS Inspection, and they do not block activity in real time.
Understanding the SaaS Security Capabilities
SaaS Security includes the following capabilities to secure your SaaS apps:
Capability | Purpose | How to enable |
|---|---|---|
Review and control which apps are used, by whom, and what can users do in them? | Enable the Application Control policy to analyze inline traffic passing through the Cato Cloud. TLS Inspection is required for activity-level and tenant-level control. | |
Understand if sanctioned apps are configured correctly and follow security best practices | API connector for each SaaS app | |
Understand which third-party apps can asses data and with which permissions | API connector for each SaaS app | |
Identifying change in app settings that weaken its security posture | API connector for each SaaS app | |
Review what actions users and admin are taking within an app to identify if it is being used for an attack | API connector for each SaaS app |
Use Case: Securing Microsoft 365
Company ABC uses Microsoft 365 for email, file sharing, and collaboration. The security team uses Cato SaaS Security to govern cloud application use and protect Microsoft 365 data.
The team starts by reviewing application usage in the Cloud Apps Dashboard, including application risk and upload and download volumes. It classifies Microsoft 365 as sanctioned and several high-risk file sharing applications as unsanctioned. An Internet Firewall rule blocks the unsanctioned applications.
After identifying large uploads to Microsoft 365, the team enables Application Control and TLS Inspection to distinguish corporate and personal tenants. It configures an Application Control rule that allows uploads to the corporate Microsoft 365 tenant and blocks uploads to personal tenants.
Next, the team creates SaaS Posture, Interconnected Apps, and App Activities connectors for Microsoft 365. A posture check based on the CIS Benchmark identifies an overly permissive external sharing setting in SharePoint. The security administrator creates a Jira ticket from the failed check, and the Microsoft 365 owner corrects the setting.
In Interconnected Apps, the team identifies a third-party application with application-level permission to read every mailbox, although it only requires calendar access. The Microsoft 365 administrator removes the excessive permission.
Later, an administrator weakens the SharePoint sharing policy. The change appears as a posture drift in the Cloud Apps Dashboard, linked to the posture check that the change caused to fail. The team reviews the finding and coordinates remediation with the application owner.
A SaaS alert also identifies an inbox rule that forwards email to an external address. The team investigates the associated App Activities and confirms with the user that the rule was unauthorized. It removes the rule and resets the user’s credentials.
Understanding How the SaaS Security Capabilities Work Together
The following capabilities work together to govern SaaS usage, assess application security, and identify changes that require investigation or remediation.
Review the Cloud Apps Dashboard
The Cloud Apps Dashboard is the starting point for all SaaS Security capabilities. Its highlights bar shows the items that need attention now: risky apps, high-severity SaaS alerts, high-severity failed posture checks, and posture drifts. Its Apps Coverage section shows which capabilities are enabled for each application you use.
The Cloud Apps Dashboard provides a common starting point for reviewing application use, posture findings, and SaaS alerts. Use the dashboard to identify use of unsanctioned apps, and prioritize posture findings that require remediation, or assess third-party connections alongside application activity to understand how business data may be exposed. Open the relevant findings or alerts to investigate the risk and determine which application owner needs to act.
For more information, see Using the Cloud Apps Dashboard.
Application Control (CASB)
Application Control discovers the cloud apps used in your environment, assesses their risk, and lets you classify them as sanctioned or unsanctioned. Discovery starts as soon as traffic passes through the Cato Cloud (without TLS inspection). You can then choose how to control access to each app:
Apply firewall policies to block risky applications or application categories.
TLS inspection is not required
Apply Application Control policy rules to control activities within permitted applications. For example, you can block uploads, downloads, or sharing. For supported applications, tenant-aware controls distinguish corporate and personal tenants, helping you restrict where users access or share business data. For example, your organization sanctions a cloud storage application for collaboration. You can permit supported upload and download activities in the corporate tenant while blocking access to personal tenants.
TLS inspection is required
For more information, see Managing the Application Control Policy and Restricting Access to SaaS Application Tenants.
SaaS Posture Management
SaaS Security Posture Management (SSPM) continuously evaluates the configuration and security settings of connected SaaS applications and compares them with the recommended settings defined by Cato’s research team. Misconfigurations that do not follow best practices, such as MFA enforcement, can expose business data even when access to the application is tightly controlled.
You can also assess your configurations against industry benchmarks for Salesforce and against CIS Benchmarks for Microsoft 365 and Google Workspace.
Each failed check provides information about the issue and recommended remediation. After configuring a ticketing integration, you can create a Jira or ServiceNow ticket directly from a failed check in the CMA. The ticket includes finding details, severity, recommended actions, and a link to the check. The application owner can use this information to make the required changes.
For more information, see Reviewing the Security Posture of Your SaaS Applications and Creating Tickets for Failed Posture Checks
Review Interconnected Apps
Third-party applications, extensions, and plugins can introduce risk to sanctioned SaaS applications. Users often authorize third-party apps, extensions, and plugins to access sanctioned applications through OAuth. These apps keep their access after the user stops using them, often have broad permissions, and are usually installed without a security review. If one of them is compromised, its access can expose your data even when the application itself is securely configured.
For each sanctioned app, Interconnected Apps provides visibility into third-party integrations, the users who authorized them, the permissions they hold, and their risk. For each permission, it shows whether the permission is delegated or application-level:
Delegated: The app acts on behalf of the user who authorized it, and can only reach data that this user can access
Application-level: The app acts as itself, with no user signed in. These permissions often apply to the data of every user in the organization, so they carry higher risk
The relationship graph in the Cloud Apps dashboard helps you understand connections between applications. Dedicated posture checks highlight risky privileges granted to Interconnected Apps, including excessive permissions granted to interconnected applications.
For example, an integration connected to Salesforce has permission to access more customer data than its business function requires. If the integration is compromised, those permissions can expose unnecessary business data. Review the connection and coordinate with the application owner to reduce its access.
For more information, see Viewing and Analyzing Interconnected Apps.
Detect Posture Drift
Administrators change app settings, add features, and integrations, or request new access. Posture drift detection identifies configuration changes that weaken a secure setting, so you can review the change and restore the setting. This helps you detect regressions after an application has been configured securely. Review the failed check to understand the change and coordinate remediation with the application owner.
Cato detects posture drift in the audit logs collected by the App Activities connector. If the application also has a SaaS Posture connector, Cato links each drift to the posture check that the change caused to fail, with its remediation guidance. Posture drifts are shown in the SaaS Security Posture section of the Cloud Apps Dashboard.
For example, an administrator changes a sharing configuration after your team has secured it. When the setting no longer meets the check’s requirements, posture drift detection helps you identify the regression.
For more information, see Detecting and Remediating Posture Drift.
SaaS Events
SaaS Events brings the audit logs of connected applications into Cato. Activities from different applications are mapped to common Activity Categories, such as Download, Share, and Admin Settings, so you can review them in one place.
SaaS alerts are detections that Cato runs on these audit logs. They flag behavior associated with techniques used in real attacks, for example, a user creating an inbox rule that forwards email to an external address, or a domain being switched to federated authentication, which lets an attacker sign in as any user without a password or MFA.
For more information, see What are SaaS Events?.
Request Additional Coverage
As applications introduce new features, Cato’s SaaS Security coverage may not yet include every application or activity your organization uses. You can submit a coverage request using a form in the CMA. Use this form to request support for a missing application or additional activities within an application.
For more information, see Requesting App Coverage.
Getting Started with SaaS Security
These are suggested steps to take to implement SaaS Security in your account.
Review Applications Used in your Environment: Cato discovers applications from the traffic that passes through the Cato Cloud, without any configuration. In the Cloud Apps Dashboard, review the applications, their risk, and who uses them.
Classify your Applications: Set the applications as sanctioned or unsanctioned.
Block Risky Applications: Create Internet Firewall rules that block unsanctioned or high-risk applications and categories.
(Optional) Control Activities and Tenants. To control activities, such as uploads and sharing, or to distinguish corporate tenants from personal tenants, turn on Application Control in Security > App & Data Inline and enable TLS Inspection. We recommend starting with an Application Control rule that monitors all cloud activities. For more information, see Managing the Application Control Policy.
Create Connectors for your Sanctioned Applications. The Apps Coverage section of the dashboard shows which applications don't have a connector configured. For each application, create a connector to enable SaaS Posture, Interconnected Apps, and App Activities, where supported.
Fix Failed Posture Checks: Prioritize high-severity checks. Set up a ticketing integration to assign remediation to application owners.
Review Interconnected Apps. Remove unused third-party apps and reduce excessive permissions, starting with application-level permissions.
Monitor SaaS Alerts and Posture Drift: Review new alerts and drifts from the Cloud Apps Dashboard.