# Software-as-a-Service Security Challenges and Best Practices: A Multivocal Literature Review
## 5 Results
### GL Analysis
#### 5.2.4 Best Practices for Improving SaaS Cloud Security (Practitioners' Opinions)  
The selected GL was evaluated to extract suitable solutions/best practices to mitigate SaaS security issues and improve security. This will provide the practitioners' opinions regarding SaaS security. The extracted results are shown in Table 5. According to the results in Table 5, 26 out of 35 practitioners emphasize data encryption to ensure the security of SaaS cloud data, while governance and regulatory/standard compliance audits were suggested by 22 out of 35 practitioners. The third commonly agreed solution for improving SaaS security was the use of backups/recovery. The remaining best practices/solutions are detailed in Table 5 along with their frequency of occurrence and the corresponding GL reference.  
\begin{table}
\begin{tabular}{l c c} \hline
**Issues** & **Freq** & **Occurrence in GL Reference** \\ \hline loss of control/visibility & 10 & GL4, GL5, GL6, GL7, GL8, GL10, GL12, GL18, \\  & & GL24, GL31 \\ \hline Inability to maintain regulatory/standard compliance & 10 & GL1, GL5, GL6, GL7, GL8, GL12, GL24, GL26, \\  & & GL30, GL31 \\ \hline Inability to monitor data in transit to and from cloud applications & 10 & GL5, GL7, GL8, GL10, GL16, GL19, GL24, GL26, \\  & & GL30, GL27 \\ \hline Insider threats & 7 & GL3, GL5, GL6, GL11, GL12, GL19, GL27 \\ \hline Non-standard API interfaces & 6 & GL1, GL4, GL16, GL17, GL28, GL34 \\ \hline Lack of security detection expertise & 6 & GL4, GL5, GL8, GL19, GL22, GL33 \\ \hline Lack of robust service level agreements (SLAs) & 6 & GL8, GL12, GL15, GL18, G26, G30 \\ \hline Multi-tenant environment & 6 & GL2, GL3, GL5, GL11, GL16, GL22 \\ \hline Virtualization & 5 & GL1, GL12, GL18, GL22, G24 \\ \hline Backup and data destruction & 3 & GL1, GL26, GL30 \\ \hline Paying upfront and long-term & 3 & GL8, GL18, GL33 \\ \hline Heterogeneous devices & 3 & GL18, GL21, GL27 \\ \hline trust & 2 & GL1, GL32 \\ \hline SaaS deployment model & 2 & GL26, GL30 \\ \hline Cost & 1 & GL33 \\ \hline \end{tabular}
\end{table}
Table 4: _Cont._  
\begin{table}
\begin{tabular}{l c c} \hline
**Best Practices** & **Freq** & **Occurrence in GL Reference** \\ \hline Data protection and encryption & 26 & GL2, GL3, GL4, GL6, GL8, GL9, GL10, GL12, GL13, GL14, \\  & 26 & GL15, GL16, GL17, GL18, GL19, GL20, GL21, GL23, GL24, \\  & & GL25, GL27, GL28, GL29, GL30, GL34, GL35 \\ \hline Governance and regulatory/standard compliance audits & 22 & GL1, GL2, GL4, GL5, GL6, GL7, GL8, GL9, GL12, GL13, \\  & 22 & GL14, GL19, GL20, GL23, GL24, GL26, GL27, GL29, GL30, \\  & 20 & GL1, GL2, GL4, GL8, GL10, GL13, GL14, GL15, GL17, GL18, \\ Backups/recovery & 20 & GL19, GL20, GL23, GL24, GL25, GL27, GL29, GL30, \\  & 24 & GL34, GL35 \\ \hline Use advanced threat & 19 & GL2, GL5, GL6, GL9, GL10, GL12, GL13, GL14, GL15, GL16, \\ protection mechanism & 19 & GL20, GL21, GL22, GL23, GL24, GL27, GL32, GL34 \\ \hline \end{tabular}
\end{table}
Table 5: SaaS security solutions/best practices (practitioners’ opinion).  
Some best practices were only suggested by a single practitioner. Hence, we combined all the practices with a frequency one into the category of 'others'. The practices which fall in the category of others include: watch for OWASP's top security issues, being careful with deadlines, and make security a priority.