View source for Security a A Service

'''Security as a service''' (SECaaS) is a [[business model]] in which a [[service provider]] integrates their security services into a corporate infrastructure on a subscription basis more cost effectively than most individuals or corporations can provide on their own, when [[total cost of ownership]] is considered.<ref>{{Cite web |author = Olavsrud, Thor |title = Security-as-a-service model gains traction  |date = April 26, 2017 |url = http://www.cio.com/article/3192649/security/security-as-a-service-model-gains-traction.html |website = cio.com|accessdate = 2017-06-22}}</ref> SECaaS is inspired by the "[[software as a service]]" model as applied to information security type services and does not require on-premises hardware, avoiding substantial capital outlays <ref>{{cite web|title=Security as a Service|url=https://www.techopedia.com/definition/26746/security-as-a-service-secaas-saas|website=techopedia|accessdate=10 June 2017}}</ref><ref>{{Cite journal|last=Furfaro|first=A.|last2=Garro|first2=A.|last3=Tundis|first3=A.|date=2014-10-01|title=Towards Security as a Service (SecaaS): On the modeling of Security Services for Cloud Computing|url=http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6986995|journal=2014 International Carnahan Conference on Security Technology (ICCST)|pages=1–6|doi=10.1109/CCST.2014.6986995}}</ref>. These security services often include [[authentication]], [[anti-virus]], [[anti-malware]]/spyware, [[intrusion detection]], Penetration testing<ref>{{cite web|title=Penetration Testing as a Service|url=http://www.penteston.com/|website=PENTESTON|accessdate=20 June 2017}}</ref> and security event management, among others.<ref>{{cite web|title=Definition of Security as a Service|url=http://searchsecurity.techtarget.com/definition/Security-as-a-Service}}</ref>

Outsourced security licensing and delivery is boasting a multibillion-dollar market.<ref>{{Cite web|title = Security as a service really has become a no-brainer|url = http://www.cloudpro.co.uk/cloud-essentials/cloud-security/3671/security-as-a-service-really-has-become-a-no-brainer|accessdate = 2015-09-24}}</ref> SECaaS provides users with [[Internet security]] services providing protection from online threats and attacks such as [[DDoS]] that are constantly searching for access points to compromise websites.<ref>{{Cite web|title = cloudbric blog: Who's Behind DDoS Attacks and How Can You Protect Your Website?|url = http://blog.cloudbric.com/2015/09/whos-behind-ddos-attacks-and-how-can.html|website = blog.cloudbric.com|accessdate = 2015-09-24}}</ref> As the demand and use of [[cloud computing]] skyrockets, users are more vulnerable to attacks due to accessing the Internet from new [[Wireless access point|access point]]s. SECaaS serves as a buffer against the most persistent online threats.<ref>{{Cite web|title = Security-as-a-service, Cloud-Based on the Rise  (Part 1)|url = http://www.cloudcomputingadmin.com/articles-tutorials/security/security-service-cloud-based-rise-part1.html|archive-url = https://web.archive.org/web/20140815043929/http://www.cloudcomputingadmin.com/articles-tutorials/security/security-service-cloud-based-rise-part1.html|dead-url = yes|archive-date = 2014-08-15|accessdate = 2015-09-21}}</ref>

==Categories of SECaaS==
The [[Cloud Security Alliance]] (CSA) is an organization that is dedicated to defining and raising awareness of secure cloud computing. In doing so, the CSA has defined the following categories of SECaaS tools and created a series of technical and implementation guidance documents to help businesses implement and understand SECaaS<ref>{{cite web|last1=Cloud Security Alliance|title=Defined Categories of  Security as a Service|url=https://downloads.cloudsecurityalliance.org/assets/research/security-as-a-service/csa-categories-securities-prep.pdf|website=Cloud Security Alliance|accessdate=5 June 2017}}</ref>. These categories include:
* [[Business Continuity and Disaster Recovery]] (BCDR or BC/DR)
* Continuous Monitoring
* [[Data Loss Prevention]] (DLP)
* Email Security
* [[Encryption]]
* [[Identity and Access Management]] (IAM) 
* Intrusion Management
* [[Network Security]]
* [[Information Technology Security Assessment | Security Assessment]]
* [[Security Information and Event Management]] (SIEM)
* [[Vulnerability scanner | Vulnerability Scanning]]
* [[Web Security]]

==SECaaS models==
SECaaS are typically offered in several forms:
* Subscription: Examples include [https://www.opaq.com OPAQ]
* Payment for utilized services
* Free of charge: Examples include AIONCLOUD, [[Cloudbric]], [[CloudFlare]], and [[Incapsula]].

==Benefits==

Security as a service offers a number of benefits,<ref>{{Cite web|title = cloudbric blog: The Newbie’s Guide to Security as a Service (SECaaS)|url = http://blog.cloudbric.com/2015/09/the-newbies-guide-to-security-as.html|website = blog.cloudbric.com|accessdate = 2015-09-24}}</ref> including:
*Cost-cutting: SECaaS eases the financial constraints and burdens for online businesses, integrating security services without on-premises hardware or a huge budget. Using a cloud-based security product also bypasses the need for costly security experts and analysts.<ref>{{Cite web|title = The Cloud is Safe and Cost Effective for Critical Data Storage. No, Really. - Peak 10|url = http://www.peak10.com/the-cloud-is-safe-and-cost-effective-for-critical-data-storage-no-really/|accessdate = 2015-09-21}}</ref>
*Consistent and uniform protection:SECaaS services provide continued protection as databases are constantly being updated to provide up-to-date security coverage. It also alleviates the issue of having separate infrastructures, instead combining all elements in one manageable system.
* Constant [[computer virus|virus]] definition updates that are not reliant on user compliance
* Greater security expertise than is typically available within an organization
* Faster user provisioning
* [[Outsourcing]] of administrative tasks, such as log management, to save time and money and allow an organization to devote more time to its core competencies
* A web interface that allows in-house administration of some tasks as well as a view of the security environment and ongoing activities

==Challenges==
SECaaS has a number of deficiencies that make it insecure for many applications. Each individual security service request adds at least one across-the-'Net round-trip (not counting installer packages), four opportunities for the hacker to intercept the conversation:
#At the send connection point going up
#At the receive connection point going up
#At the sending point for the return; and
#At the receiving point for the return.

SECaaS makes all security handling uniform so that once there is a security breach for one request, security is broken for all requests, the very broadest attack surface there can be. It also multiplies the rewards incentive to a hacker because the value of what can be gained for the effort is dramatically increased. Both these factors are especially tailored to the resources of the nation/state-sponsored hacker.

The biggest challenge for the SECaaS market is maintaining a reputation of reliability and superiority to standard non-cloud services. SECaaS as a whole has seemingly become a mainstay in the cloud market.<ref>{{Cite web|title = Security as a service really has become a no-brainer|url = http://www.cloudpro.co.uk/cloud-essentials/cloud-security/3671/security-as-a-service-really-has-become-a-no-brainer|accessdate = 2015-09-24}}</ref>

Cloud-based website security doesn’t cater to all businesses, and specific requirements must be properly assessed by individual needs.<ref>{{Cite web|title = Cloud vs. Data Center: What's the difference?|url = http://www.businessnewsdaily.com/4982-cloud-vs-data-center.html|accessdate = 2015-09-21}}</ref> Business who cater to the end consumers cannot afford to keep their data loose and vulnerable to hacker attacks. The heaviest part in SECaaS is educating the businesses. Since [[data]] is the biggest asset for the businesses,<ref>{{Cite web|title =Why Security as a Service [SECaaS] Will be the Biggest Asset for Any CIO or CTO Today|url = https://blog.appknox.com/security-service-will-biggest-asset-cio-cto-today/|accessdate = 2016-03-22}}</ref> it is up to [[Chief information officer|CIOs]] and [[Chief technology officer|CTO]]s  to take care of the overall security in the company.

==See also==
*[[Web application security]]
*[[Managed security service]]
*[[Cloud computing]]

==References==
{{reflist}}

== External links ==
* [https://cloudsecurityalliance.org/research/secaas/#_get-involved  Security as a Service Working Group]

[[Category:As a service]]
[[Category:Internet security]]
[[Category:Outsourcing]]
[[Category:Computer network security]]