Articles
DOI DOI: 10.5281/zenodo.18421438

Cybersecurity of SaaS Products Threats, Secure-by-Design Engineering, and Security Metrics for Continuous Assurance

Oleksandr Khodorkovskyi1
  1. 1 Quantum Core, Ukraine

Abstract

Software-as-a-Service (SaaS) concentrates business-critical data and identity
workflows into always-on, internet-exposed systems, making it a prime target
for credential theft, API abuse, supply-chain compromise, and cloud-controlplane attacks. This paper develops a secure-by-design framework for SaaS that
integrates (i) governance and risk outcomes from NIST CSF 2.0, (ii) security
and privacy controls from NIST SP 800-53 Rev. 5 and ISO/IEC 27001, and
(iii) secure software engineering practices from NIST SP 800-218 (SSDF),
combined with application-layer standards such as OWASP ASVS and OWASP
API Security Top 10 (2023). OWASP Foundation+5NIST Computer Security
Resource Center+5NIST Computer Security Resource Center+5 Results include
a reference architecture for secure SaaS delivery (Figure 1) and a metrics-based
control matrix (Table 1) linking threat categories to measurable security outcomes,
aligned with SOC 2 Trust Services Criteria and cloud assurance mapping via
CSA CCM. AICPA & CIMA+2Cloud Security Alliance+2 The paper concludes
that resilient SaaS security requires unifying secure development, identity-centric
architecture, supply-chain integrity (SBOM/SLSA), and operational telemetry
into a continuous assurance loop.

How to Cite

Khodorkovskyi, O. (2026). Cybersecurity of SaaS Products Threats, Secure-by-Design Engineering, and Security Metrics for Continuous Assurance. Transnational Academic Journal of Economics, 3(1), 1–14. https://doi.org/10.5281/zenodo.18421438
Endnote/Zotero/Mendeley (RIS) BibTeX

References

  1. NIST. CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0 (Final). NIST Computer Security Resource Center+1
  2. NIST. Cybersecurity Framework (CSF) program page and updates. NIST
  3. NIST. SP 800-53 Rev. 5 (Update 1): Security and Privacy Controls for Information Systems and Organizations. NIST Computer Security Resource Center
  4. ISO. ISO/IEC 27001:2022 — Information security management systems — Requirements (standard overview page). ISO
  5. ISO/IEC. ISO/IEC 27001:2022 (publicly accessible PDF copy). eiso.upm.edu.my
  6. NIST. SP 800-218: Secure Software Development Framework (SSDF) v1.1 (Final). NIST Computer Security Resource Center
  7. CISA. NIST SP 800-218 SSDF resource page. CISA
  8. NIST. SP 800-207: Zero Trust Architecture (Final). NIST Computer Security Resource Center+1
  9. OWASP. Application Security Verification Standard (ASVS) project page. OWASP Foundation
  10. OWASP. ASVS GitHub repository (v4 series artifacts). GitHub+1
  11. OWASP. OWASP Top Ten 2021 (official materials). GitHub+1
  12. OWASP. OWASP Top 10 release notes and process (2021 cycle). owasptopten.org
  13. OWASP. OWASP API Security Top 10 – 2023 (official list). OWASP Foundation
  14. CSA. Cloud Controls Matrix (CCM) research page. Cloud Security Alliance
  15. CSA. Cloud Controls Matrix and CAIQ v4 (release and download artifact page). CSA+1
  16. AICPA & CIMA. SOC 2: Trust Services Criteria overview page. AICPA & CIMA
  17. EY. Summary of AICPA revisions to Trust Services Criteria / SOC 2 Description Criteria (2022). EY
  18. MITRE. ATT&CK Enterprise Cloud Matrix. MITRE ATT&CK
  19. NIST. SP 800-161r1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (Final). NIST Computer Security Resource Center
  20. NIST. NIST publication page for SP 800-161 (C-SCRM). NIST
  21. NTIA. Minimum Elements for a Software Bill of Materials (SBOM) (2021). NTIA
  22. Federal Register. Software Bill of Materials Elements and Considerations (Notice; EO 14028 context). Federal Register
  23. SLSA. Supply-chain Levels for Software Artifacts (slsa.dev). SLSA
  24. OpenSSF. SLSA project overview. OpenSSF
  25. CIS. CIS Critical Security Controls v8 (controls page). CIS
  26. CIS. CIS Controls v8 white paper (published May 18, 2021). CIS
  27. NIST. NIST CSF 2.0 overview and purpose statement (publication abstract). NIST Computer Security Resource Center
  28. NIST. SP 800-53 Rev. 5 control catalog overview (CSRC page). NIST Computer Security Resource Center
  29. CISA. Secure by Design Pledge (official page). CISA
  30. WIRED. Reporting on CISA secure-by-design pledge and its objectives (May 2024). WIRED