A systematic review of security threats and countermeasures in SaaS

Article type: Research Article

Authors: Díaz de León Guillén, Miguel Ángel^{; *} | Morales-Rocha, Víctor | Fernández Martínez, Luis Felipe

Affiliations: National Laboratory of Information Technologies, Autonomous University of Ciudad Juárez, México

Correspondence: [*] Corresponding author. E-mail: [email protected].

Abstract: Among the service models provided by the cloud, the software as a service (SaaS) model has had the greatest growth. This service model is an attractive option for organizations, as they can transfer part or all of their IT functions to a cloud service provider. However, there is still some uncertainty about deciding to carry out a migration of all data to the cloud, mainly due to security concerns. The SaaS model not only inherits the security problems of a traditional application, but there are unique attacks and vulnerabilities for a SaaS architecture. Additionally, some of the attacks in this environment are more devastating due to nature of shared resources in the SaaS model. Some of these attacks and vulnerabilities are not yet well known to software designers and developers. This lack of knowledge has negative consequences as it can expose sensitive data of users and organizations. This paper presents a rigorous systematic review using the SALSA framework to know the threats, attacks and countermeasures to mitigate the security problems that occur in a SaaS environment. As part of the results of this review, a classification of threats, attacks and countermeasures in the SaaS environment is presented.

Keywords: Software as a service, cloud security, threats, countermeasures, systematic review

DOI: 10.3233/JCS-200002

Journal: Journal of Computer Security, vol. 28, no. 6, pp. 635-653, 2020