# Software-as-a-Service Security Challenges and Best Practices: A Multivocal Literature Review
## 6 Discussion
However, we did not find any study that has compiled R&P opinions together in a single study. To fill this gap and to provide a detailed overview of possible SaaS security issues as identified by academia and industry, this MVLR also extracted SaaS security issued from the GL. A total of 35 studies were selected as the GL, which include white papers, blogs, websites, and reports. According to our findings, the key security challenges identified by practitioners include data breaches/leakage, identity and access management, loss of control/visibility, inability to maintain regulatory/standard compliance and inability to monitor data in transit to and from cloud applications with a frequency of 21, 17, 10, 10, and 10 respectively. The detailed results are presented in Table 4. This will help SaaS tenants and CSPs obtain an overview of the practitioners' opinions on SaaS security issues and challenges. **RQ3:** Which practices are suggested by the FL for improving SaaS cloud security? This research question aims to analyze the selected primary studies to find the best practices that help in improving the security of the SaaS cloud. The mere identification of SaaS issues or challenges is not enough. Therefore, we extracted the solutions/best practices from these studies. Hence, 58 primary studies were also evaluated to find the security best practices, with a total of 14 practices identified from the peer-reviewed FL which provides a detailed overview of academia regarding SaaS security improvement. According to our findings, the researchers consider up-to-date security controls/standards, the use of strong encryption techniques, regulatory compliance/SLA compliance, multifactor authentication, and better enterprise infrastructure/proper data isolation as key practices for improving security with a frequency of 39, 38, 24, 24, and 23, respectively. A detailed list of these practices is given in Table 3. The results in Table 3 will help SaaS tenants and CSPs in relation to security analysis and improvement. **RQ4:** Which practices are suggested by the GL for improving SaaS cloud security? The experience of the people who are working in the industry is very useful in making any decision. To improve SaaS security, we also collected the opinions of practitioners who are actually working with SaaS and identified a list of practices mentioned by these practitioners. A total of 35 studies from the GL were evaluated and about 14 practices were identified from these studies that may help in improving SaaS security. According to practitioners, the most useful practices (based on frequency of occurrence) are data protection and encryption, governance and regulatory/standard compliance, and backups/recovery with a frequency of 26, 22, and 20 respectively. The complete list of practices identified from the GL is given in Table 5. The data in Table 5 will help SaaS tenants and CSPs to evaluate their current security structure and will help them in relation to further improvement. **RQ5:** Is there any similarity or discrepancy between R&P opinions regarding SaaS security issues and solutions? To compare academia and industry views regarding SaaS security issues and solutions, we analyzed the data presented in Tables 2-5. The security issues identified by academia and industry were almost same with a varying frequency of occurrence. Tables 6 and 7 provide the similarities and differences between R&P opinions regarding SaaS security issues /challenges and best practices, respectively. The results of Table 6 shows that R&P are almost on the same pace regarding most of the issues/challenges facing SaaS security, as shown by the data in column 3 of Table 6.  
The results of Table 7 shows that R&P are on the same pace regarding the best practices for SaaS security improvement. This shows that the provided MVLR is very helpful in identifying SaaS security challenges and solutions.