A Taxonomy of Security as a Service

  • Marwa Elsayed
  • Mohammad Zulkernine
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11230)


With the evolving expansion of threat landscape (i.e., internal and external) and the growing shortage of cybersecurity resources (i.e., tools and skills), Security as a Service (SecaaS) is gaining a momentum to fill this pressing gap. In this paper, we propose a taxonomy of existing research work in SecaaS. The taxonomy explores the current state-of-the-art in SecaaS to reason about SecaaS work with respect to three main dimensions: service operation, security solution, and threat. This taxonomy enables the SecaaS consumers and researchers to better differentiate among existing approaches and assess if they meet their security needs.


Security as a Service Cloud computing 



This research is partially supported by the Natural Sciences & Engineering Research Council of Canada (NSERC). Marwa Elsayed thanks the Schlumberger Foundation for supporting her Ph.D. study in Canada.


  1. 1.
    Cloud Security Alliance: The Treacherous 12 - Cloud Computing Top Threats in 2016 (2016)Google Scholar
  2. 2.
    Cloud Security Alliance: Defining Categories of Security as a service (2016)Google Scholar
  3. 3.
    Carvalho, C.A.B., Castro, M.F., Castro, R.M.: Secure cloud storage service for detection of security violations. In: Proceedings of the 17th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing. IEEE Press (2017)Google Scholar
  4. 4.
    Thomas, K., Grier, C., Ma, J., Paxson, V., Song, D.: Design and evaluation of a real-time URL spam filtering service. In: Proceedings of 2011 IEEE Symposium on Security and Privacy (SP), pp. 447–462. IEEE (2011)Google Scholar
  5. 5.
    Alharkan, T., Martin, P.: IDSaaS: intrusion detection system as a service in public clouds. In: Proceedings of the 12th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGRID), pp. 686–687 (2012)Google Scholar
  6. 6.
    Varadharajan, V., Tupakula, U.: Security as a service model for cloud environment. IEEE Trans. Netw. Serv. Manag. 11(1), 60–75 (2014)CrossRefGoogle Scholar
  7. 7.
    Hawed, M., Talhi, C., Boucheneb, H.: Security as a service for public cloud tenants (SaaS). Procedia Comput. Sci. 130, 1025–1030 (2018)CrossRefGoogle Scholar
  8. 8.
    Meng, Y., Li, W., Xiang, Y.: Towards designing privacy-preserving signature-based IDS as a service: a study and practice. In: Proceedings of 5th International Conference on Intelligent Networking and Collaborative Systems (INCoS), pp. 181–188. IEEE (2013)Google Scholar
  9. 9.
    Wu, R., Zhang, X., Ahn, G.J., Sharifi, H., Xie, H.: ACaaS: access control as a service for IaaS cloud. In: Proceedings of 2013 International Conference on Social Computing (SocialCom), pp. 423–428. IEEE (2013)Google Scholar
  10. 10.
    Lang, U.: OpenPMF SCaaS: authorization as a service for cloud & SOA applications. In: Proceedings of IEEE Second International Conference on Cloud Computing Technology and Science (CloudCom), pp. 634–643. IEEE (2010)Google Scholar
  11. 11.
    Guenane, F., Nogueira, M., Serhrouchni, A.: DDoS mitigation cloud-based service. In: Proceedings of 2015 IEEE Trustcom/BigDataSE/ISPA, vol. 1, pp. 1363–1368. IEEE (2015)Google Scholar
  12. 12.
    Pappas, V., Kemerlis, V.P., Zavou, A., Polychronakis, M., Keromytis, A.D.: CloudFence: data flow tracking as a cloud service. In: Stolfo, S.J., Stavrou, A., Wright, C.V. (eds.) RAID 2013. LNCS, vol. 8145, pp. 411–431. Springer, Heidelberg (2013). Scholar
  13. 13.
    Wood, T., Cecchet, E., Ramakrishnan, K.K., Shenoy, P.J., van der Merwe, J.E., Venkataramani, A.: Disaster recovery as a cloud service: economic benefits & deployment challenges. In: Proceedings of HotCloud, vol. 10, pp. 8–15 (2010)Google Scholar
  14. 14.
    Ghazi, Y., Masood, R., Rauf, A., Shibli, M. A., Hassan, Q.: DB-SecaaS: a cloud-based protection system for document-oriented NoSQL databases. EURASIP J. Inf. Secur. (1), 16 (2016)Google Scholar
  15. 15.
    Zhou, H., et al.: Agentless and uniform introspection for various security services in IaaS cloud. In: Proceedings of 2017 4th International Conference on Information Science and Control Engineering (ICISCE), pp. 140–144. IEEE (2017)Google Scholar
  16. 16.
    Kaliski Jr, B.S., Pauley, W.: Toward risk assessment as a service in cloud environments. In: Proceedings of HotCloud (2010)Google Scholar
  17. 17.
    Mahalakshmi, J., Kuppusamy, K.: Security-as-a-service for files in cloud computing—a novel application model. In: Proceedings of 2016 10th International Conference on Intelligent Systems and Control (ISCO), pp. 1–5. IEEE (2016)Google Scholar
  18. 18.
    Rak, M., Suri, N., Luna, J., Petcu, D., Casola, V., Villano, U.: Security as a service using an SLA-based approach via SPECS. In: Proceedings of IEEE 5th International Conference on Cloud Computing Technology and Science (CloudCom), vol. 2, pp. 1–6. IEEE (2013)Google Scholar
  19. 19.
    Sun, Y., Nanda, S., Jaeger, T.: Security-as-a-service for microservices-based cloud applications. In: 2015 IEEE 7th International Conference on Cloud Computing Technology and Science (CloudCom), pp. 50–57. IEEE (2015)Google Scholar
  20. 20.
    Tupakula, U., Varadharajan, V., Karmakar, K.: SDN-based dynamic policy specification and enforcement for provisioning SECaaS in cloud. In: Bouguettaya, A., et al. (eds.) WISE 2017. LNCS, vol. 10570, pp. 550–561. Springer, Cham (2017). Scholar
  21. 21.
    Zhang, Y., Chen, J.L.: Access control as a service for public cloud storage. In: Proceedings of 32nd International Conference on Distributed Computing Systems Workshops (ICDCSW), pp. 526–536. IEEE (2012)Google Scholar
  22. 22.
    Roundy, K.A., et al.: Smoke detector: cross-product intrusion detection with weak indicators. In: Proceedings of the 33rd Annual Computer Security Applications Conference, pp. 200–211. ACM (2017)Google Scholar
  23. 23.
    Shu, X., Yao, D.: Data leak detection as a service. In: Keromytis, A.D., Di Pietro, R. (eds.) SecureComm 2012. LNICST, vol. 106, pp. 222–240. Springer, Heidelberg (2013). Scholar
  24. 24.
    Zawoad, S., Hasan, R., Haque, M.M., Warner, G.: CURLA: cloud-based spam URL analyzer for very large datasets. In: Proceedings of 2014 IEEE 7th International Conference on Cloud Computing (CLOUD), pp. 729–736. IEEE (2014)Google Scholar
  25. 25.
    Gonzales, D., Kaplan, J.M., Saltzman, E., Winkelman, Z., Woods, D.: Cloud-trust—a security assessment model for infrastructure as a service (IaaS) clouds. Proc. IEEE Trans. Cloud Comput. 5(3), 523–536 (2015)CrossRefGoogle Scholar
  26. 26.
    Poon, H.T., Miri, A.: Scanning for viruses on encrypted cloud storage. In: Proceedings of 2016 International IEEE Conferences on Ubiquitous Intelligence and Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress, pp. 954–959. IEEE (2016)Google Scholar
  27. 27.
    Elsayed, M., Zulkernine, M.: IFCaaS: information flow control as a service for cloud security. In: Proceedings of the 2016 11th International Conference on Availability, Reliability and Security, (ARES), Salzburg, Austria, pp. 211–216. IEEE (2016)Google Scholar
  28. 28.
    Elsayed, M., Zulkernine, M.: Towards security monitoring for cloud analytic applications. In: Proceedings of the 4th IEEE International Conference on Big Data Security on Cloud, BigDataSecurity 2018, Omaha, NE, USA. IEEE (2018). (Best student paper award)Google Scholar
  29. 29.
    Wang, W., Yongchareon, S.: A survey on security as a service. In: Proceedings of International Conference of Web Information Systems Engineering (WISE) (2017)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  1. 1.School of ComputingQueen’s UniversityKingstonCanada

Personalised recommendations