# Software-as-a-Service Security Challenges and Best Practices: A Multivocal Literature Review
## 1 Introduction  
Cloud computing (CC) offers a consolidated pool of configurable computing tools and computing outsourcing processes that enable various computing services to be offered to individuals and organizations. Millions of organizations have adopted CC due to its potential benefits, such as cost efficiency, improved collaboration, scalability, flexibility, automatic software updates, business continuity, etc. [1, 2] CC encompasses a wide range of services and implementation models, as shown in Figure 1. The three types of services provided by CC are platform-as-a-service (PaaS), infrastructure-as-a-service (IaaS), and software-as-a-service (SaaS). IaaS provides options such as renting IT storage (virtual or physical) andnetworking capabilities, while PaaS provides on-demand product development, training, delivery, and management tools. At the same time, SaaS is a subscription-based way of providing on-demand software applications through the cloud [3,4]. CC has four different models, namely the private cloud (PRC), the public cloud (PBC), the hybrid cloud (HYC), and the community cloud (CMC). In a PBC system, resources are shared by a group of users known as tenants. The cost of using CC is determined by how much IT infrastructure is used. On the other hand, individuals and businesses that want a PRC must have their own dedicated platform that is not shared by others. CMC is a cloud infrastructure used by users in the same industry or with common goals, and the HYC allows data and resources to be exchanged using PBC and PRC settings [5,6]. Security is one of the key challenges in all the platforms provided by CC. However, it has become a significant concern on the public SaaS cloud. The belief that storing sensitive data in a third-party data center leads to various security breaches becomes a primary obstacle to CC adoption. According to the statistics provided by Statista, the PBC SaaS market is increasing rapidly with time (as shown in Figure 2). It is a model in which the CSP hosts applications remotely and makes them accessible to consumers on-demand over the Internet. Customers benefit from the SaaS model in a variety of ways, including increased operating performance and lower costs. SaaS is quickly gaining attention as the preferred distribution model for business IT services. Most businesses, however, are still wary of the SaaS model due to a lack of insight into how their data are processed and protected. Thus, security is the top obstacle to SaaS adoption for enterprise IT infrastructures [7,8]. Figure 1: CC models and services. Various solutions for CC security in general and SaaS security are provided in the literature. However, no single solution fits all organizations under all circumstances. The security of SaaS is the joint responsibility of the cloud tenant (CT) and the cloud service provider (CSP), but customers still expect 100% security assurance from CSPs [10]. To help the SaaS CT and CSP, there is a need to provide better guidelines. This is only possible if they are aware of all possible security issues and challenges and best practices that may help overcome these challenges. To address this gap, this MVLR aims to provide a detailed overview of the opinions of researchers and practitioners (R&P) regarding SaaS security issues/challenges and best practices for secure SaaS. The objective of this MVLR is to conduct a detailed and systematic review of the scientific literature and the GL to identify SaaS security issues and challenges. This MVLR will try to answer the following research questions:  
**RQ1:** What software security challenges are involved in SaaS as identified in the FL? The aim of this question is to systematically gather and review the formal research studies published in peer-reviewed journals/conferences/workshops that focus on SaaS security issues and challenges and compile a list of potential SaaS cloud challenges. This will help SaaS CSPs and tenants to secure SaaS against internal and external threats.