# Software-as-a-Service Security Challenges and Best Practices: A Multivocal Literature Review
## 6 Discussion  
This MVLR has examined the pertinent factors that motivate the need to recognize SaaS security problems/challenges and the best practices that can resolve these security issues. We identified the current security challenges and best practices for improving SaaS cloud security issues during this study. Security improvements are being more widely recognized to accelerate SaaS cloud adoption. R&P from all over the world have been working for years to identify SaaS cloud security problems and challenges, as well as practices that can help solve these issues. However, the problem still persists, and challenges are reported from time to time. Therefore, this area has significant potential for innovation and research. Before proceeding to provide more solutions to existing security issues, there is a need to synthesize R&P opinions at a single place to provide the complete and current picture of the situation. To fill this gap, this MVLR has compiled a list of possible challenges from the FL and GL to raise the awareness of the cloud tenants as well as CSPs. Further, we also compiled practices for improving the security of the SaaS cloud both from the GL and peer-reviewed literature. This will help R&P address these issues and improve their SaaS cloud performance and adaption. In the following, we discuss these results in the light of the posed research questions. **RQ1:** What software security challenges are involved in SaaS as identified in the FL? This research question aimed to identify the SaaS security issues and challenges discussed by researchers in this area. A total of 58 studies were selected as primary studies after applying I&E criteria. When these studies were analyzed to find the SaaS security issues or challenges, about 18 challenges were identified from 58 primary studies. The frequency of the identified challenges was also calculated to understand the severity of each challenge. According to our results, the challenges with a higher frequency were: data security/data loss or leakage, identity and access management issues, lack of user control/visibility, logical storage segregation & multi-tenancy/data locality, insecure interfaces and APIs, and governance/regulatory compliance/SLA compliance with a frequency of 41, 39, 39, 36, 31, and 30, respectively. Network security/shared technology, virtualization issues/cloud & CSP migration issues, and malicious insiders were also key challenges with a frequency of 29, 27, and 20, respectively. Other challenges are also detailed in Table 2. The data in \begin{table}
\begin{tabular}{l c c} \hline \hline
**Best Practices** & **Freq** & **Occurrence in GL Reference** \\ \hline Multifactor authentication & 18 & GL1, GL2, GL3, GL4, GL6, GL9, GL10, GL11, G14, GL19, \\  & GL20, GL21, GL23, GL24, GL25, GL27, GL30, GL34 \\ \hline Cloud-based identity and access & 18 & GL2, GL4, GL11, GL12, GL13, GL14, GL16, GL17, GL20, \\   management solutions & 18 & GL22, GL25, GL26, GL27, GL28, GL30, GL31, GL34, GL35 \\ \hline Better enterprise infrastructure & 16 & GL1, GL2, GL5, GL12, GL13, GL14, GL18, GL22, GL23, \\  & GL24, GL25, GL26, GL27, GL30, GL 31, GL33 \\ \hline Security expertise & 12 & GL2, GL11, GL12, GL14, GL20, GL21, GL22, GL23, GL27, \\  & GL29, GL31, GL33 \\ \hline Incorporating security in the & 6 & GL12, GL17, GL26, GL30, GL33, GL34 \\ SDLC process & 5 & GL1, GL8, GL 15, GL31, GL32 \\ \hline Customer Support & 4 & GL9, GL12, GL22, GL29 \\ \hline Others & 3 & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: _Cont._Table 2 provide a detailed overview of the SaaS security issues and challenges. This study will help R&P to obtain an overview of possible security issues and challenges. Based on these identified challenges, organizations can evaluate their current security breaches and can find timely solutions for these issues. **RQ2:** What software security challenges are involved in SaaS as identified in the GL? Many researchers have identified general SaaS security issues from the FL.