Software as a Service (SaaS) is a delivery model in which applications are hosted at an outsourced data center and sold to the enterprise security or IT user as a monthly subscription. With the physical security industry increasingly shifting to this approach, it is crucial that government buyers understand what security factors to consider when looking for a SaaS provider, according to Steve Van Till of Brivo Systems.

Because data security is still reported as the number one CIO concern with outsourced application services, it also needs to be the number one concern for the physical security SaaS buyer. “First and foremost, this means that you need to ensure that SaaS providers undergo regular third-party application security audits, and that they are willing to share those results with you in writing. There are a variety of standards that govern security audits, but one of the most common in the U.S. is SAS-70. Other standards to look for would include SysTrust, WebTrust or ISO 27001/2, depending on the application,” Van Till says.

Because SaaS security systems exchange data between on-premise devices and off-premise hosted applications, they need connections through the corporate firewalls, Van Till points out. There are both safe and unsafe ways to do this.

In a nutshell, enterprise security devices, such as control panels, cameras, etc., should be initiating the connection to the hosting data center, and not vice-versa. “Why’s that? First of all, you never want to open any inbound ports on your firewall unnecessarily. That’s just bad policy,” explains Van Till. “Second, firewalls are typically already configured to allow outbound connections from your network to external services points, such as Web sites. This principle explains how your corporate network can safely allow employees to connect to millions of Internet sites without specifically having to identify each one in advance, and, at the same time, keep millions of hackers from gaining entry into your network or personal computer. You should ask no less from your physical security solution.”