Lab 2 – SaaS Security Posture & Third-Party Application Governance
Assess Dataparity's SaaS security posture, identify misconfigurations and compliance gaps, and review third-party OAuth applications with access to corporate data.
Business Scenario
Dataparity has standardized on approved corporate SaaS applications for collaboration, file sharing, CRM, and productivity workflows.
The security team must ensure:
- Users only interact with sanctioned SaaS tenants
- Sensitive data is governed consistently
- SaaS environments remain securely configured
- Misconfigurations are detected continuously
- Third-party applications and browser extensions are monitored for risk
The organization wants centralized visibility into SaaS posture, compliance alignment, and external integrations that may introduce data exposure risks.
Task 1 — SaaS Security Posture Management (SSPM)
Background
Once sanctioned SaaS access is established, organizations must continuously evaluate the security posture of those SaaS environments.
SSPM provides visibility into:
- Misconfigurations – settings that deviate from security best practices
- Security control failures – controls that were once passing and have regressed
- Compliance gaps – requirements not met under SOC 2, ISO 27001, NIST, or CIS
- Configuration drift – how posture has changed over time and what triggered it
- Risk exposure trends – whether the organization's SaaS posture is improving or deteriorating
Step 1 — Navigate to the SSPM Portal
Navigate to:
Analytics → SaaS Security Report
At the bottom-left of the page, enable the Switch to Existing Reports toggle. Then select the SaaS Security Report from the left navigation.
On the SaaS Security page, click the Posture Management tab, then click the Posture Management ↗ button to launch the advanced SSPM portal at apptotal.zscaler.com.
The SSPM portal opens as a separate application — this is Zscaler's Advanced SaaS Security Posture Management experience. Note the top navigation filter bar showing tenants by platform (Atlassian, Chrome Extension, Google, Microsoft, Okta, Salesforce) — each represents a connected SaaS tenant being continuously assessed.
Step 2 — Review the SSPM Dashboard
The SSPM dashboard provides an immediate view of Dataparity's overall SaaS security posture across all connected platforms.
Review the following sections:
① Enabled Controls The total number of active security controls being evaluated. Note the severity breakdown — High, Medium, and Low controls contribute differently to overall risk exposure.
② Status Summary A donut chart showing the distribution of control outcomes:
- Fail – controls with active misconfigurations requiring remediation
- Pass – controls meeting the security benchmark
- Partial – controls partially satisfied
- Pending – controls awaiting evaluation
- Disabled – controls that have been turned off
③ Controls by Platform A bar chart breaking down pass/fail status by SaaS platform (Microsoft, Salesforce, Okta, and others). This view quickly identifies which platform carries the highest number of failures.
④ Failed Controls Remediation Matrix A Severity × Effort priority grid. Controls in the High Severity / Low Effort cell are the highest-priority quick wins — maximum security improvement with minimum remediation complexity.
Select any control from the list below the summary to view its full detail.
In the control detail panel, review:
- Remediation – threat description, impact, MITRE ATT&CK mapping (tactic and technique), and step-by-step remediation instructions
- Compliance – which compliance framework controls this finding satisfies or violates
- Assets – the specific resources or users impacted by this misconfiguration
- Audit log – history of status changes for this control over time
- Notes – space for team collaboration and remediation tracking
The MITRE ATT&CK mapping in each control detail is a notable capability — it connects a SaaS misconfiguration directly to the adversary tactic and technique that could exploit it. For example, a missing RSS authentication control maps to Credential Access → Exploit Public-Facing Application. This bridges the gap between posture management and threat modeling.
Step 3 — Review the Failed Controls Remediation Matrix
The Failed Controls Remediation Matrix is a prioritization tool that helps security teams decide where to focus remediation effort first.
The matrix plots controls on two axes:
- Y-axis (Severity): High → Medium → Low — the risk impact of leaving this control unresolved
- X-axis (Effort): High → Medium → Low — the complexity of remediating the control
Controls in the top-right cell (High Severity, Low Effort) represent the optimal starting point — they provide the greatest risk reduction for the least remediation work.
Ask the group: "If you had one afternoon to improve your SaaS posture score, where would you start?" The matrix answers that question automatically — it surfaces the highest-impact, lowest-effort remediations without requiring manual triage. This is the operationalization of risk-based prioritization.
Step 4 — Review Compliance Mapping
From the left navigation, select Compliance.
The Compliance view shows how SSPM controls map to major security and privacy frameworks. Toggle between two perspectives:
Frameworks view Browse coverage by framework — PCI DSS, NIST Rev.5, ISO 27001, and others. Each framework shows total controls, how many have passed, and how many have failed. Expand a framework to see individual control mappings.
Platforms view Switch to the Platforms tab to see compliance status filtered by SaaS platform (e.g., Google Workspace, Microsoft 365). Identify which platform is introducing the most compliance failures across your active frameworks.
The right panel shows a control-by-control mapping table — Framework, Control ID, Security Check count, Status, and Tenant.
Compliance mapping helps organizations address three practical challenges:
- Align SaaS posture with governance requirements — each SSPM finding is already labeled with the framework control IDs it affects, so security and GRC teams share a common language
- Simplify audit preparation — instead of manually cross-referencing tool output against audit checklists, teams export a pre-mapped control evidence package directly from SSPM
- Prioritize remediation activities — when multiple failed controls compete for attention, compliance mapping reveals which remediations satisfy the most framework requirements simultaneously — the highest-efficiency path to audit readiness
A single SSPM check — for example, "Enforce MFA for all admin accounts" — often maps simultaneously to NIST IA-2, SOC 2 CC6.1, CIS Control 6.5, and ISO 27001 A.9.4.2. Remediating one misconfiguration satisfies multiple framework requirements in a single action.
Task 2 — Third-Party Application Governance
Background
Modern SaaS platforms are deeply interconnected with third-party applications through OAuth2 permission grants, API integrations, and browser extensions. Employees and administrators routinely connect productivity tools, automation platforms, and AI assistants to corporate SaaS environments — often without formal security review.
These integrations may introduce:
- Excessive permissions – scopes like
Mail.ReadorFiles.ReadWrite.Allgranted to low-trust third parties - Data exposure risks – OAuth apps can silently access and transmit email, files, calendars, and contacts outside the organization
- Unauthorized access paths – tokens persist after initial authorization and may outlive the employee's legitimate need
- Shadow IT concerns – user-consented installs that bypass IT governance processes entirely
Step 5 — Review the App Dashboard
From the left navigation pane in the SSPM portal, select App Dashboard.
Review the overview metrics:
- Active Apps – total OAuth applications currently authorized across connected SaaS platforms
- Risky Apps – apps flagged with elevated risk scores based on permissions, publisher reputation, or behavioral signals
- Affected Users – number of users with at least one risky app authorized
- Deactivated Apps – previously authorized apps that are no longer active
Below the metrics, review:
- Apps by Classification – breakdown of apps as Sanctioned, Unsanctioned, Reviewing, or Unclassified
- Apps by Finding Type – Potentially Harmful, Dormant, and Overprivileged app counts with representative app icons
- Top Apps by Risk Score – highest-risk apps ranked by Zscaler's risk score (note: AI tools such as ChatGPT for Google, Grammarly, and similar extensions frequently appear here)
- Highlights panel – recent threat findings surfaced across the app inventory (e.g., Extension Changed Ownership, Excessive Host Permissions, Expired Client Secrets)
Note the Top Apps by Risk Score list — AI-powered tools such as ChatGPT for Google (9.7), Easy File Converter (9.4), and Grammarly (9.4) consistently rank near the top. These are browser extensions and OAuth apps that request broad page-reading permissions and transmit content to external AI inference APIs. Every SaaS page the employee views — including payroll reports and customer data — may be sent to a third-party AI service. This connects directly to Lab 4: Copilot Readiness later in this module.
Step 6 — Review Active Apps and App Detail
From the left navigation, select Apps, then click on Active Apps (filtered by App Status: Enabled).
The inventory shows all enabled third-party apps across Dataparity's SaaS estate. For each app, note:
- Publisher – the developer or company behind the app
- Platform – which SaaS marketplace the app originates from (e.g., Chrome Extension, 3rd Party)
- Users – how many employees have this app authorized
- Risk Score – Zscaler's composite risk rating (higher = greater concern)
- Access Type – what level of access the app has been granted (Sign-in Only, Account Access, System, Data Access)
Click on any app — for example, Keeper® Password — to open the detail panel. Review each tab:
- Overview – app description, classification, risk score, connection graph showing OAuth relationships, and usage timeline (First Authorized, Last App Activity)
- Access – specific permission scopes and OAuth grants
- Activities – recent activity events associated with this app
- Details – publisher information, marketplace metadata, and app findings
- Notes – team annotation and review history
OAuth2 applications may gain persistent, silent access to a wide range of corporate data assets through their authorized scopes, including:
- Email – full mailbox access, including the ability to read sensitive communications
- Files – read, write, and share documents stored in OneDrive, SharePoint, or Google Drive
- Calendars – meeting schedules, attendee lists, and location data
- Contacts – full organizational directory and personal contact information
- SaaS administrative functions – in elevated cases, apps with admin-level scopes can modify tenant settings or alter permission structures
OAuth2 grants bypass inline proxy controls entirely — the data flows directly from Microsoft or Google to the third-party app server, never touching the Zscaler proxy. App Governance provides the only visibility into this channel.
Key Takeaways
| Capability | What It Provides |
|---|---|
| Inline Controls | Govern SaaS access in real time — tenant restrictions and instance awareness enforce which tenant employees can access |
| Instance Awareness | Enables tenant-specific policy — same URL, differentiated by corporate vs. partner vs. personal instance |
| SSPM | Continuously evaluates SaaS security posture across all connected platforms with out-of-the-box controls |
| Remediation Matrix | Prioritizes failed controls by Severity × Effort — surfaces the highest-impact, lowest-effort remediations first |
| Compliance Mapping | Aligns SSPM findings to SOC 2, ISO 27001, NIST, and CIS — a single remediation can satisfy multiple frameworks |
| Drift Analysis | Identifies unauthorized changes, configuration regressions, and newly introduced risk between audit cycles |
| App Governance | Surfaces OAuth apps and browser extensions that bypass inline controls — the only visibility into this data path |
Summary
Modern SaaS security requires both runtime inline protection and continuous posture governance.
Together, these capabilities help Dataparity:
- Protect sanctioned SaaS environments from access misuse and misconfiguration
- Reduce configuration risk through continuous automated assessment
- Govern third-party OAuth and browser integrations as first-class security objects
- Maintain continuous compliance visibility without manual audit overhead
What comes next: Lab 3 (DSPM) will discover where sensitive data — including Payroll_2025.xlsx — lives across cloud storage, building on the SaaS visibility established in this lab.