How Doctolib Built an Agile and Robust SaaS Security Program at Scale with Falcon Shield

Doctolib powers 430,000 healthcare practitioners and helps 90 million people throughout Europe. With more than 3,000 employees, the digital healthcare company has a presence in more than 30 cities across France, as well as in Germany, Italy, and the Netherlands.

The company has a large and mature security team, with three departments focused on different areas of security: Product Security, Corporate Security, and Platform Security. SaaS security is led by the Corporate Security team, who’s responsible for managing the onboarding and ongoing maintenance of all business-critical applications.

Doctolib originally used manual processes to manage and secure its SaaS applications, resulting in only a limited snapshot of its security posture. As the company adopted more applications, it realized that its existing approach to security and compliance management was inefficient and difficult to scale in the heavily regulated healthcare industry.

The Corporate Security team needed continuous visibility into configurations to help ensure applications remained secure and support compliance with regulatory requirements. The team also needed a better understanding of the thousands of users accessing those applications and the third-party applications connected to improve functionality and workflows.

Other SaaS challenges began to emerge. Teams were onboarding applications without the knowledge of the security team. Doctolib recognized the need to improve collaboration with its business units if it hoped to tame what it described as an “untamable jungle” of SaaS applications.

At the time, Doctolib managed its cloud infrastructure with a cloud security posture management (CSPM) solution. It sought an equivalent approach for managing its rapidly growing SaaS stack.

In 2022, Doctolib conducted an RFP with three leading SaaS security posture management (SSPM) vendors. During the proof of concept (POC), the company connected its most sensitive and complex applications to CrowdStrike Falcon® Shield.

After an extensive evaluation of leading SSPM solutions, Doctolib selected Falcon Shield. The solution supported more out-of-the-box integrations to provide broad SaaS coverage, and its security checks were the most comprehensive. It also associated users with their devices, offered an intuitive user experience, and simplified collaboration between the security team and application owners.

“With Falcon Shield, we quickly implemented a strong Zero Trust policy across our entire SaaS ecosystem,” said François-Xavier Le Quéré, Corporate IT Senior Security Engineer at Doctolib. “The tool continuously strengthens our SaaS security by honing in on individual misconfigurations, governing identities, detecting shadow apps, and providing visibility into SaaS user devices.”

Doctolib went live with the solution at the beginning of 2023. The security team immediately moved from the point-in-time visibility provided by manual audits to continuous, deep visibility across its critical applications.

In addition to the applications monitored during the POC, Doctolib quickly integrated its SaaS applications with the platform via API. For the first time, the organization could easily monitor users and their permissions, as well as third-party applications integrated into its SaaS stack.

The security team granted critical stakeholders access to the tool, including the GRC, Endpoint Management, Risk and Vulnerability Management, and SecOps teams, so they could regularly monitor their respective domains. Application owners were also onboarded to help them better understand security issues affected by configuration choices and collaborate on remediation.

Using Falcon Shield, Doctolib significantly strengthened the security posture of its SaaS stack. It uses the solution daily to manage multiple aspects of SaaS security.

The company identified and mitigated misconfigurations that put applications at risk and aligned application settings with compliance standards. In addition to out-of-the-box security checks, Doctolib created more than 40 custom security checks to help align applications with its security policies.

By monitoring users through Falcon Shield, Doctolib also improved its deprovisioning capabilities, fully removing access from employees who had been offboarded from the identity provider, but still retained access to SaaS applications.

Over the following year, Doctolib continued to enhance its security posture using additional inventory capabilities. The Permissions Inventory provides granular visibility into user entitlements and access, helping the company right-size user access. The Data Inventory shows which files are shared publicly, helping Doctolib limit the potential for data leaks.

Today, Doctolib monitors a large number of integrations through Falcon Shield. The company strives for a 100% security posture score on every application and conducts quarterly reviews with application owners to discuss failed security checks. It has come a long way in taming its SaaS jungle.