Data Protection in SaaS HR Applications: Security Analysis

This report examines data protection strategies within cloud environments, focusing on SaaS applications used by the Department of Administrative Services (DAS) for HR and personnel management. It discusses the impacts of SaaS applications, including the protection of sensitive data using Cloud Access Security Brokers (CASBs), and analyzes operational solutions for SaaS applications, highlighting the importance of centralized management and policy enforcement. The report identifies data security challenges such as privilege abuse, database input injection, malware, and excessive rights, and proposes operational solutions for ensuring the privacy and security of employee data, addressing digital identity, data sensitivity, and data sovereignty. It further explores security and privacy implications for DAS, including identity governance, forensics and detection, manageability, encryption, standards, compliance, and management. The report concludes by emphasizing the importance of hazard leadership and the role of SaaS providers in mitigating security threats, referencing various studies and frameworks relevant to cloud security and data protection.

Data
Protection
Using Cloud

Introduction
• Consists of three various types of services
• Platforms as infrastructure and services
• Provides variety of benefits
• Able to access the strong IT resources
• System as SaaS, PaaS, IaaS

SaaS Application

Impacts of SaaS Application
• Protecting Sensitive Data
• CASBs (Cloud Access Security Brokers)
• Solutions for Integrated Security Platform

DAS (The Department of Administrative
Services)
• Store the information and data of the staffs and employees
• Store the policies of staff management and personnel in the storage device
of DAS
• Provides the storage space for the information and data for various firms
• Enormous data safety is allowed by various statutory safety services
• Able to ensure the security of the information and the data

DAS (The Department of Administrative
Services)
• The shared strategies of DAS have helped to control the database.
• Improves the safety of the information and data
• DAS controls human resources in many organizations.
• The data or information of staffs and employees are centralized from
any place.
• The format of centralized data is readily available.

Operational Solution of SaaS application
• SaaS operation helps in improving the innovation of the organization.
• The implementation of SaaS has assisted in providing the safe environment of data
and information.
• The suppliers of SaaS provide the solutions for the public organizations of
Australia.
• MS Share Point and COTS provide many facilities for the Australian citizen.

Operational Solution of SaaS application
For qualifying the inclusion of the SaaS operational solution the SaaS management
includes:
• Centralized management for the various SaaS application
• SaaS operation management allows policy enforcement of security and identity
in the application.
• Associated with the task automatically with the policy management of SaaS

Operational Solution of SaaS application
• The facilities of SaaS include the hardware assembly among the organizations
• HR management conduct risks leadership speculations.
• The alternatives of operation include the risks resolution and safety attack policies.
• Operational risks leadership involves the risks mitigation process in the organization.

Data Security challenges in DAS
The safety issues of data and information are motivated by the third-party
participation such as safety, implementation monitoring and entry.
• Privilege abuse
• Database input injection
• Malware
• Excessive rights

Data Security challenges in DAS
Source: (Chowdhury, 2014)

Privilege Abuse
• Legitimate server issues in an illegitimate way that can be accessed
by clients in the organization
• DAS has allowed clients to access all the information, creating a
significant problem for server clients
• Dangerous for clients to see the image of other organizational
employees and staffs

Database Input Injection
•Two types of input injection in database SQL and NoSQL injection
•SQL injection attacks involve illegitimate statement
•NoSQL vector activities are conducted by injecting fake comments into the
components of Big Data
•Both types of software infringement attacks and staff information in the
organization

Malware
• Cloud security risks are dramatically improving as malware runs once cloud
malware affects a computer.
• This may begin to siphon secured or vulnerable information in some of the
instances.
• Various malware and viruses are inserted into the database (Watson et al.,
2015)
• Malicious function impacts the database table.
• Malware can crash the full database and all the information and data is lost
to the business

Excessive Rights
• The centralized database system has helped provide additional advantages to
clients
• Limitations on the database may occur owing to excessive checks.
• Due to useless freedoms, there may be limitations in the database
• Causes centralized database clients litigious in the organization who are
using SaaS

Operational Solution for Privacy
and Security of Employee Data
• In this context, the application of HR personnel management using the
SaaS application has brought countless advantages to the company.
• Safety of employee data
• Privacy of employees
• Sensitivity of data
• Digital identification

Privacy of Employee Data
• Employee data and information protection are monitored
• Staff sensitive data, such as telephone number and email address, might be
accessed
• Multiple sensitive external data, such as phone number, private
information, email address, address can be taken down by the hackers
• Several hazards connected with SaaS application involve data privacy and
security.
• Private staff data and information are very essential to safeguard and
secure

Security of Employee Data
• Employee data and information security are at danger of breach
• Staff information is registered in the repository as well as employees upgrade
information (Tari, 2014)
• Intruders can enter the scheme and download all information and data
• This can trigger huge losses for organisations and staff.
• Data safety for employees is maintained through the different safety procedures

Digital identity
• Digital identification card protection and security are very important
• No credential or delicate data storage in DAS may result in the
failure of significant data.
• Digital staff and staff identification is vital for any organization's
verification.
• If electronic identification data falls, it will trigger a major drop.

Data Sensitivity
• Data awareness or confidentiality relates to data quality and
data quality.
• The risk of losing data or information from the SaaS will be
enormous.
• Information or data may be wasted unless the safety certificates
changed.

Security Implications for
DAS
• Identity governance: Private information is managed and controlled
to access organization assets, facilities, apps and data.
• Forensics and detection: The organization's company requires
distinguishing unlawful and lawful operations as there is an
enormous possibility of unlawful entry to the SaaS.

Security Implications for
DAS
• Manageability: The on-premised and SaaS based implementation
requires a steady view. The scheme requires to be incorporated as a
separate entity if the organisation is a separate entity.
• Encryption: different consumers exchange code to protect and secure
delicate data resources such as machines or technologies based on
SaaS

Privacy Implications for
DAS
• SaaS information storage: data privacy and security are required to
manage the stored data and information in the SaaS implementation
(Mahamadu, Mahdjoubi & Booth, 2013)
• Data movement from point A to point B is controlled. It comprises of
managing data and information storage as well as data handling assets.

Privacy Implications for
DAS
• Standards: the norm is the agreed attitude to something like that.
SaaS-based norm guarantees interoperability, digital pictures, apps,
functional instruments, and many other cloud-based or SaaS-based
environments without rework.
• Compliance and management: management describes the duties and
functions as well as the processes and strategies to be followed by staff.
Governance of the SaaS implementation requires the infrastructure and
regulates it.

Issues Regarding Data
Sensitivity
• Sensitive and secret information is described as information that protects
against unjustified disclosures.
• It is important to safeguard access to delicate and private information.
• Protection and safety of delicate information for ethical or legal reasons,
proprietary scrutiny and private safety and privacy issues will be
required

Issues Regarding Data
Sensitivity
• Customary SGBDs may have the choice to store in the encrypted type
the data and information.
• Does not present any issue for simple item recovery scheme, many
applications will involve more advanced information processing, this
handling scheme contributes to storage data or information manipulate
(Martini & Choo, 2013).

Issues Regarding Data
Sovereignty
• Data freedom goes to the organisation when the organization's information or
data is recorded outside the country (Tweneboah-Koduah, Endicott-Popovsky &
Tsetse, 2014). It is subordinate to the nation's legislation that reside in the data
and information.
• It relies on the information and data collected kinds. Data sovereignty may not be
the problem, but hundreds of information is stored within the organization and it
is best to keep a backup for saving the data and reduce the risk.

Issues Regarding Data
Sovereignty
• The distribution network runs the SaaS application, referring to the complexity of
the organization's data sovereignty of the stored data when the data resides on a
third party.
• The distributed function of computing like SaaS can arrive in a beautiful and
strange location. This will reduce operating costs and make the clients very quick
to access (Bulla, Bhojannavar & Danawade, 2013). This will leave the clients data
at risk to the foreign nation as it is correlated with the laws.

Ethical and Security Issues of Cloud
Database
There are three important ethical problems in cloud services when it goes to
the facilities supplied in the cloud:
• Security problems
• Information integrity
• Confidentiality

Conclusion
• This can be stated that the organization's essential aspect is hazard or danger
leadership. The organisation identifies the hazards and safety threats. DAS helps
to store information and data about Australia's public staff and employees.
• The cloud or SaaS implementation uses assistance keep records of the
organization's staff's information and data. SaaS supplier’s use helps mitigate the
safety hazards and threats that the SaaS server involves.

References
Almorsy, M., Grundy, J., & Müller, I. (2016). An analysis of the cloud computing security problem. arXiv preprint arXiv:1609.01107.
Amoore, L. (2018). Cloud geographies: Computing, data, sovereignty. Progress in Human Geography, 42(1), 4-24.
Betgé-Brezetz, S., Kamga, G. B., Dupont, M. P., & Guesmi, A. (2013, November). End-to-end privacy policy enforcement in cloud infrastructure. In 2013
IEEE 2nd International Conference on Cloud Networking (CloudNet) (pp. 25-32). IEEE.
Bulla, C. M., Bhojannavar, S. S., & Danawade, V. M. (2013). Cloud computing: Research activities and challenges. International Journal of Emerging
Trends & Technology in Computer Science, 2(5), 206-214.
Büscher, M., Easton, C., Kuhnert, M., Wietfeld, C., Ahlsén, M., Pottebaum, J., & van Veelen, J. B. (2014). Cloud ethics for disaster response. In ISCRAM.
Chou, T. S. (2013). Security threats on cloud computing vulnerabilities. Int
Chowdhury, R. R. (2014). Security in cloud computing. International Journal of Computer Applications, 96(15).
Gashami, J. P., Chang, Y., Rho, J. J., & Park, M. C. (2014). Understanding the Trade-Off between Privacy Concerns and Perceived Benefits in SaaS
Individual Adoption. In PACIS (p. 354).
Hashizume, K., Rosado, D. G., Fernández-Medina, E., & Fernandez, E. B. (2013). An analysis of security issues for cloud computing. Journal of internet
services and applications, 4(1), 5.
Henze, M., Hummen, R., & Wehrle, K. (2013, May). The cloud needs cross-layer data handling annotations. In 2013 IEEE Security and Privacy
Workshops (pp. 18-22). IEEE.
Hooper, C., Martini, B., & Choo, K. K. R. (2013). Cloud computing and its implications for cybercrime investigations in Australia. Computer Law &
Security Review, 29(2), 152-163.
International Conference on Communication and Network Technologies (pp. 27-32). IEEE.
Mahamadu, A. M., Mahdjoubi, L., & Booth, C. (2013, December). Challenges to BIM-cloud integration: Implication of security issues on secure
collaboration. In 2013 IEEE 5th International Conference on Cloud Computing Technology and Science (Vol. 2, pp. 209-214). IEEE.
Martini, B., & Choo, K. K. R. (2013). Cloud storage forensics: ownCloud as a case study. Digital Investigation, 10(4), 287-299.
Patel, N. S., & Rekha, B. S. (2014). Software as a Service (SaaS): security issues and solutions. International Journal of Computational Engineering
Research (IJCER), 4(6).
Patel, N. S., & Rekha, B. S. (2014). Software as a Service (SaaS): security issues and solutions. International Journal of Computational Engineering
Research (IJCER), 4(6).

References
Porkert, K., & Sutton, H. (2013). Analysis pattern for the transformation of ERP system landscapes by SaaS. In Innovation and Future of Enterprise
Information Systems (pp. 131-139). Springer, Berlin, Heidelberg.
Prasad, M. R., Naik, R. L., & Bapuji, V. (2013). Cloud computing: Research issues and implications. International Journal of Cloud Computing and
Services Science, 2(2), 134.
Rittinghouse, J. W., & Ransome, J. F. (2017). Cloud computing: implementation, management, and security. CRC press.
Rong, C., Nguyen, S. T., & Jaatun, M. G. (2013). Beyond lightning: A survey on security challenges in cloud computing. Computers & Electrical
Engineering, 39(1), 47-54.
Roy, A., Sarkar, S., Ganesan, R., & Goel, G. (2015). Secure the cloud: From the perspective of a service-oriented organization. ACM Computing Surveys
(CSUR), 47(3), 41.
Sadeghian, A., Zamani, M., & Ibrahim, S. (2013, September). SQL injection is still alive: a study on SQL injection signature evasion techniques. In 2013
International Conference on Informatics and Creative Multimedia (pp. 265-268). IEEE.
Soofi, A. A., Khan, M. I., Talib, R., & Sarwar, U. (2014). Security issues in SaaS delivery model of cloud computing. International journal of computer
science and mobile computing, 3(3), 15-21.
Tari, Z. (2014). Security and Privacy in Cloud Computing. IEEE Cloud Computing, 1(1), 54-57.
Tweneboah-Koduah, S., Endicott-Popovsky, B., & Tsetse, A. (2014). Barriers to government cloud adoption. International Journal of Managing
Information Technology, 6(3), 1-16.
Watson, M. R., Marnerides, A. K., Mauthe, A., & Hutchison, D. (2015). Malware detection in cloud computing infrastructures. IEEE Transactions on
Dependable and Secure Computing, 13(2), 192-205.
Xia, Q. I., Sifah, E. B., Asamoah, K. O., Gao, J., Du, X., & Guizani, M. (2017). MeDShare: Trust-less medical data sharing among cloud service providers
via blockchain. IEEE Access, 5, 14757-14767.
Younis, Y. A., Kifayat, K., & Merabti, M. (2014). An access control model for cloud computing. Journal of Information Security and Applications, 19(1),
45-60.

THANK YOU