SaaS architecture
There are also several elements of SaaS architecture that support the functionality of this highly valued commodity in the world of cloud computing.
Multi-tenant usage
As referenced in the SaaS delivery model, a SaaS provider usually creates a single copy of their software which has been specifically designed for SaaS distribution. This means that while this one software version runs on host servers, all subscribed users will be simultaneously accessing that version. This is called multi-tenancy.
Scalable, elastic infrastructure
Unlike on-premise software, which can be regulated by local admins and traditional enterprise resource planning, SaaS apps can be accessed by any number of subscribed users at any given time. This means that a SaaS service provider's network must be able to scale up quickly to accommodate user load while maintaining an efficient baseline when demand decreases. As with other types of cloud computing, most SaaS providers employ monitoring agents and microservices to assist with scaling, and tools such as Kubernetes or Docker are employed to drive elasticity.
Automated provisioning
Unlike traditional on-premise environments, where granting access to applications is a manual or semi-automated process, the SaaS model can utilize Cloud Services Broker (CSB) platforms to automate this procedure, providing on-demand access to SaaS applications instantly. And, conversely, CSBs also enable the automation of de-provisioning, where access is removed from users when the clients choose to discontinue their subscriptions to the application.
Access management
Since SaaS applications cannot access a client’s enterprise environment directly, application programming interfaces (APIs) are needed to connect commonly used business applications and specialized client applications with the SaaS application being subscribed to. For this reason, many independent software vendors (ISVs) build APIs and integration hooks for commonly used business solution software packages. To extend these capabilities, many SaaS builders expose a common set of APIs. These may include:
- Schema APIs: These APIs help developers create data entities within a SaaS product (e.g., document repositories, tables, key-value storage).
- Event APIs: When SaaS entities are changed or impacted by an activity, these APIs perform a designated activity, such as updating data or triggering a function.
- Create Read Update Release (CRUD) APIs: CRUD APIs are used to manipulate data and run operations against backend databases.
Single sign-on
Organizations often enable user access to multiple SaaS applications as part of their daily work function. To simplify both user experience and management, a single identity system can be put in place to authenticate user identity and access permissions for multiple systems and applications. While single sign-on would be complex and time-consuming within a traditional environment, the ease of SaaS application integration and auto provisioning enable single sign-on with minimal human intervention.
Cybersecurity
As with all cloud-based apps, cybersecurity posture is of paramount importance. However, in addition to leading cloud security best practices, SaaS providers must take further steps due to the nature of their products and access.
Data security
Due to multi-tenancy within the SaaS distribution model where multiple clients (and multiple users within each client) are accessing the same SaaS application simultaneously, certain types of data accessed by the SaaS application must have encrypted storage so that while one client (or tenant) can access that data, another tenant using the SaaS application simultaneously cannot and is directed to their own data set.
Additional SaaS security elements to protect customer data include:
- Strong monitoring and mapping protocols.
- Identity and Access Management (IAM) tools.
- Key management frameworks (internal or via external interface).
- Role-Based Access Control (RBAC).
- CASB (Cloud Access Security Broker) tools.
Application security
In addition to ongoing data security best practices, SaaS application service provider(s) must consider application security beginning at the point of development. By using a security-first Software Development Life Cycle (SDLC), along with penetration testing and threat modeling as part of the SDLC, SaaS applications can be hardened against possible cyber threats. In addition, the use of Security Posture Management (SSPM) tools during the SDLC can help reduce misconfiguration while regulating and enhancing data security efforts, as well.
