SaaS的安全责任是什么？

The security responsibility of SaaS is shared: both the provider and customer are responsible for safeguarding data and infrastructure. The provider’s side is relevant to you as well: Verizon’s 2026 Data Breach Investigations Report found a third party involved in 48% of the breaches in its 2025 data. Both of you have different roles; the SaaS provider should have a secure infrastructure and application. For your part, you should safeguard user access and your settings – in addition to your data.

网络安全需要双方共同努力。作为客户，您的职责是寻找能够为您提供所需保护的供应商，同时也要了解安全威胁。

共享责任模型将重点放在您和您的SaaS提供商身上。您应该关注不同的方面，以下是您需要考虑的方面的快速概述： 

• 提供商： The provider should focus on 诸如 application security and patching any vulnerabilities that arise. They are also responsible for looking after the network and operating system, along with the SaaS’s physical infrastructure.

• 客户： 您需要 保护您的数据 通过实施网络安全措施并避免潜在危险。您应该自定义用户访问和其他相关配置，并且还需要确保您的数据受到保护。

Security issues in IaaS, PaaS, and SaaS are not the same: the level of customer involvement in security-related activities varies according to the type of service. 以下是您需要注意 IaaS、PaaS 和 SaaS 安全性的方面：

• IaaS （基础设施即服务）： 基础设施可见性和 API。
• PaaS （平台即服务）： 应用程序和平台安全。
• SaaS （软件即服务）： 访问权限、第三方集成和数据安全。

The two primary areas of security concern for organizations using SaaS are 数据安全 and access management:

• 数据安全： 除了保持可用性和完整性之外，您还需要对数据保密。

• 访问管理： 您必须控制每个用户在您的应用程序中可以执行的操作，以及谁可以首先访问它。

采取这些预防措施：

• 选择信誉良好的供应商： Research each provider before you sign up for one. Look at their security track record and read what their customers have said about them. Third parties were involved in 48% of the breaches recorded in Verizon’s 2026 Data Breach Investigations Report, based on 2025 data (Verizon, May 2026).
• 强大的访问控制： Be strict about who has access, and use good practices like 诸如 principle of least privilege and two-factor authentication (2FA).
• 定期备份： 将您的 SaaS 数据备份到单独的位置；理想情况下，您应该设置自动备份。
• 数据加密: 确保您的数据在传输和静止时都经过加密。
• 安全意识培训： 确保您的员工了解不同的 security threats, such as phishing.