The use of third-party apps (also known as “connected apps”, “cloud to cloud apps”, “OAuth apps”) are apps developed by external and internal developers or organizations that can interact with and extend the functionality of a primary SaaS App. These are growing exponentially across organizations. According to the Netskope Cloud and Threat Report focused on Phishing, the average organization grants more than 440 third-party applications access to their Google data and applications, with organizations with less than 500 users granting access to at least 250 different cloud applications. In total 12,330 different applications were authorized by users in one organization.
A more recent study by Abnormal Security confirmed this growth and, unsurprisingly, the associated growth of the risks connected with third-party apps. According to the same study, the average organization integrates 379 third-party apps with email (a 128% increase since 2020), and for large enterprises with 30,000+ employees, the number of integrated third-party apps soars to 3,973 on average, including apps for collaboration, productivity, development, social networking, security, and more. Even worse, across the integrated third-party applications, 37% have high-risk permissions, such as the ability to create and delete emails or users, and even reset user passwords.
In a similar scenario, it’s no surprise that third-party apps are constantly exploited by opportunistic and state-sponsored threat actors to breach organizations. Consent Phishing (an attack where the attacker obtains an OAuth authorization token via a malicious cloud app) is quite a common technique, but unfortunately organizations can also be compromised through credentials stolen from legitimate third-party applications that were granted access to the victim’s cloud environment.
Corporate users are too often unaware of the risks deriving from installing third-party apps on their corporate devices (or their personal devices used for corporate purposes) and granting them access to the internal resources (such as email, contacts, etc.). At the same time organizations need to protect themselves from the risks associated with the supply-chain incl