Bedömning och förbättring av säkerhetsläget för en molnbaserad SaaS-applikation för små och medelstora företag

Small to Medium Enterprises (SMEs) increasingly rely on Software-as-a-Service (SaaS) platforms to deliver scalable, cost-efficient applications. However, the adoption of cloud-based architectures introduces significant security challenges, especially for resource constrained organizations lacking a mature security posture.This thesis evaluates the security posture of a cloud-hosted SaaS application by conducting a security assessment using a structured five-phase methodology. The assessment combines automated and manual vulnerability discovery, threat modeling, risk classification, and the application of selected security controls from the CIS Controls v8.1 and NIST SP 800-53 Rev. 5 frameworks. This resulted in 11 unique vulnerabilities being found and mitigated using tailored controls. This led to a significant reduction in pre- and post-mitigation risk matrices, indicating an improvement in the overall security maturity. The findings underscore the importance of threat and risk assessments processes for organizations of any size and the need for practical, resource-aware approaches to security hardening processes.