SaaS Shield Platform Getting Started

Preface

What’s in this guide

We describe the components of SaaS Shield and the onboarding process (which gets you ready to start the process of adding SaaS Shield to your applications). We include a link to a demo app you can examine to see how SaaS Shield works.

Intended audience

This getting started guide is primarily intended as a starting point to understand the core capabilities of the SaaS Shield platform via use-cases and examples. It will help anyone that wants to evaluate the product to get signed up. Product managers can see at a high level how SaaS Shield enables Bring Your Own Key (BYOK) / Hold Your Own Key (HYOK) capabilities in your systems, with an overview of how your tenants are able to manage their keys. Operations staff will find an overview of the required components that will need to be added to their infrastructure. Developers will find use cases and a high-level description of how SaaS Shield can be added to their applications.

The components of SaaS Shield

SaaS Shield is a suite of products designed primarily to enhance per-tenant security in your multi-tenant SaaS app. It can also be used to protect different segments of data within your enterprise applications. SaaS Shield allows you to easily add key management capabilities to your applications to satisfy customers who are demanding BYOK / HYOK functionality.

The two main products in the SaaS Shield platform are the multi-tenant security system (SaaS Shield Kit) and the S3 proxy (SaaS Shield for Amazon S3). Two other IronCore products, Cloaked Search and Cloaked AI, work together with the SaaS Shield platform to support advanced search use cases that are important for many applications.

(See product descriptions, use cases, pricing, and other information here).

The SaaS Shield Kit provides services and SDKs to enable your customers (or you on their behalf) to easily configure external cloud KMS and logging. It makes it easy to use many cloud options to encrypt multi-tenant data in your service’s code with a high-level SDK, and the SaaS Shield Kit provides benefits like security event audit logging without any additional code. You get the advantage of having each tenant’s data encrypted with a different key, creating additional protections against mixing multiple tenants’ data inadvertently, even if they are all sharing a data store.

The kit is made up of a Tenant Security Proxy, an optional companion Tenant Security Logdriver, and the IronCore Alloy SDK. There is also an optional Vendor Bridge that you can use to automate tenant management tasks. These components communicate with the Configuration Broker, a service that IronCore Labs operates to coordinate and control the operation of SaaS Shield. The Configuration Broker uses end-to-end encryption to protect your customers’ configuration data from access by IronCore Labs and by your operations staff.

SaaS Shield for Amazon S3 is a service that integrates with the SaaS Shield Kit and deploys directly into your infrastructure alongside the Tenant Security Proxy. It uses the Configuration Broker to allow you and your customers to manage KMS and cloud logging options, but doesn’t require any code changes to your services that use Amazon S3. You simply deploy it, configure it, and point your current S3 app to it.

You can also install the S3 proxy in an existing SaaS Shield installation - directions are here.

Which parts do I need?

If most of your multi-tenant data is in S3 and you just want to make sure that it’s secure, you should consider using SaaS Shield for Amazon S3. If your multi-tenant data is in other forms of storage (databases, disk, key value stores, etc.) or your use case is more complex, then you’ll want to use the SaaS Shield Kit directly.

For this security to be practical, your apps must still work as users expect, and for many apps, that requires searching over the protected data. The SaaS Shield Kit provides an option to secure data in such a way that you can continue to search your data store for exact matches even though the data is encrypted. We use deterministic encryption to facilitate this type of search.

If you are using Elasticsearch or OpenSearch to index your tenants’ data and provide additional search features, you can still protect the data in your search index while encrypting it by using Cloaked Search. This is another ready-to-deploy container that can be configured to use SaaS Shield to manage the keys it needs to protect fields in the index and still allow searches on the data. You can secure your search service and still allow you and your customers to manage KMS and logging cloud options.

Onboarding

To get started using SaaS Shield, you need to create an account in the IronCore Labs Configuration Broker. To create an account, you must do the following:

1. Obtain a sign-up token. Fill out the Contact Us form and indicate in the “Additional information” that you would like a token to create an account to test SaaS Shield.

2. A representative from IronCore Labs will email you a sign-up token. Once you have that, open the login page of the Configuration Broker.

3. Click the “Create ->” button.

4. On the next page, enter your email address (which will also be the login for your account), then select and enter an “Encryption Passphrase”. This is a password that will unlock the personal encryption keys that are generated for your account, allowing it to use end-to-end encryption to secure configuration data for your organization such that IronCore Labs cannot access it. It is important that you securely store this encryption passphrase - we recommend the use of a password manager.

5. Enter the passphrase a second time to confirm that it was typed correctly.

6. You must also enter your name, your company’s name, and your company’s domain (for example, “ironcorelabs.com”).

7. Finally, enter the sign-up token that was sent to you and click “Create Account”. This creates a new vendor organization for your company and creates an admin user associated with that organization.

8. The UI will display a recovery token for your account that you should also store securely. This token is required to recover your account if you lose the passphrase.

9. You are directed back to the login screen, where you can enter your email address and the encryption passphrase you provided. This will log you into the Configuration Broker.

Managing your organization

Managing administrators

Once you have created your organization and logged in as an administrator, we strongly recommend that you invite additional administrators. The administrators are able to access confidential information for your organization that is end-to-end encrypted, so if your only administrator loses access to their account, you will not be able to access the information, and IronCore Labs cannot help you recover it. Adding administrators will help to guarantee your ability to manage your organization’s data.

To invite another administrator, follow these steps:

1. Log into your account.

2. Click “Manage Admins” in the left side bar, and click “Invite Admin”.

3. Enter the new administrator’s email address and click “Invite Admin”. The Configuration Broker will send an email to that address that contains a link.

4. When the recipient receives the email and clicks the link, they will be able to enter their name and can change the email address if desired, then accept the invitation. This will create an admin account for that user and associate them with your vendor organization.

Administering multiple organizations

If the email address you invited is already associated with an administrator account, instead of creating a new account, the account you invited will be associated with your organization, and the administrator will be able to select from associated organizations to administer. On login, if an account can administer multiple organizations, the administrator selects one of those organizations to administer. They can choose to switch to a different organization after login. If the organizations use different authentication methods, they’ll need to log in again.

Single sign-on

The Configuration Broker supports single sign-on (SSO), with two separate use cases: SSO for administrators of the vendor organization, and SSO for administrators of their tenant organizations.

Single sign-on for vendor organization

In the user settings (accessed by clicking the down arrow in the upper right corner of the Configuration Broker UI), there is a group of “Organization Settings”. One of those settings is labeled “Update the authentication method for the admins that log in to the Configuration Broker UI.” This will allow your vendor organization to use an Identity Provider (IDP) that you use to provide SSO for apps within your organization to also authenticate administrators in the Configuration Broker. To configure SSO, follow these steps:

1. Click the “Update authentication method” button.

2. Switch the authentication method for your administrators from “Username/Encryption Passphrase” (the default) to “Own SSO”.

3. Copy the configuration information that is displayed and add it to your IDP so it can interoperate with the Configuration Broker.

4. Obtain a configuration file (in XML format) from your IDP to configure the other side of the connection.

5. Press the “Upload IDP Metadata” button and supply the XML file to upload.

6. Once you have uploaded the file and applied the displayed information to your IDP, assign a name to the SSO in the Configuration Broker.

7. Use the “Test” button to confirm that the configuration is correct in the IDP.

8. If the test is successful, save the entry.

Subsequent logins to the Configuration Broker will use the SSO controlled by your IDP to authenticate your admins. Note that the admin will still be prompted to provide their encryption passphrase, since this is used for the end-to-end encryption of configuration data.

Single sign-on for tenant organizations

You can also elect to provide an IDP for use by your tenants to authenticate their administrators in the Configuration Broker. In the user settings, the next button under the one to configure SSO for your administrators is labeled “Update the IDP provided for tenants to log in to the Configuration Broker UI.” If you click this, you need to follow a very similar process to configure the IDP to interoperate with the Configuration Broker. Once you have successfully tested and saved this, your tenants will be able to opt-in to use that IDP to authenticate their administrators.

Managing tenants

Once you have configured your vendor organization, you are ready to start adding tenants that will use your system. On the left sidebar of the Configuration Broker, you will find “Manage Tenants”. This allows you to invite a new tenant organization. When you click “Invite Tenant”, you will need to provide a name for the tenant, the email address of one of the tenant’s administrators that will receive the invitation, and an ID that you will use in your software to identify the tenant. (You will supply this ID when calling the SaaS Shield SDKs to encrypt the tenant’s data.) When you click “Invite”, it will send an email to the specified address that contains a link. If the recipient clicks this link, they will be able to provide an organization name and can optionally change their email address. If they proceed, it will create an organization and an admin account associated with that organization, and it will complete the link between your vendor organization and their tenant organization.

If the tenant organization is already added to the Configuration Broker, the recipient will be able to approve the connection between their organization, as a tenant, and your organization as a vendor.