JPMorgan CISO Spotlights SaaS Security Concerns. What Now?
Summary: JPMorgan Chase CISO Pat Opet published an open letter to third-party suppliers arguing that SaaS models are eroding decades of architected security boundaries, with OAuth tokens connecting applications lacking an equivalent of 2FA. The letter points to the July 2024 CrowdStrike outage as evidence of supply-chain interdependence, and to the December compromise of a BeyondTrust backdoor admin account at the US Treasury by Chinese state-backed actors as an example of provider privileged access.
What you should know: Opet's core claim is that app-to-app OAuth connections collapse authentication and authorization into single-factor trust, so one compromised token can move laterally across your SaaS ecosystem without tripping traditional controls. The article adds that the average enterprise now has more non-human than human identities in its SaaS estate, and most security teams cannot see them.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026