Deakin University
Browse

File(s) under permanent embargo

Improving tenants' trust in SaaS applications using dynamic security monitors

Version 2 2024-06-04, 06:02
Version 1 2016-04-10, 17:40
conference contribution
posted on 2024-06-04, 06:02 authored by Mohamed AbdelrazekMohamed Abdelrazek, JC Grundy, A Ibrahim
It is almost impossible to prove that a given software system achieves an absolute security level. This becomes more complicated when addressing multi-tenant cloud-based SaaS applications. Developing practical security properties and metrics to monitor, verify, and assess the behavior of such software systems is a feasible alternative to such problem. However, existing efforts focus either on verifying security properties or security metrics but not both. Moreover, they are either hard to adopt, in terms of usability, or require design-time preparation to support monitoring of such security metrics and properties which is not feasible for SaaS applications. In this paper, we introduce, to the best of our knowledge, the first unified monitoring platform that enables SaaS application tenants to specify, at run-time, security metrics and properties without design-time preparation and hence increases tenants’ trust of their cloud-assets security. The platform automatically converts security metrics and properties specifications into security probes and integrates them with the target SaaS application at run-time. Probes-generated measurements are fed into an analysis component that verifies the specified properties and calculates security metrics’ values using aggregation functions. This is then reported to SaaS tenants and cloud platform security engineers. We evaluated our platform expressiveness and usability, soundness, and performance overhead.

History

Pagination

70-79

Location

Gold Coast, Queensland

Start date

2015-12-09

End date

2015-12-12

ISBN-13

9781467385817

Language

eng

Publication classification

E Conference publication, E1 Full written paper - refereed

Copyright notice

2015, IEEE

Title of proceedings

ICECCS 2015 : Proceedings of the 20th International Conference on Engineering of Complex Computer Systems

Event

Engineering of Complex Computer Systems. International Conference (20th : 2015 : Gold Coast, Queensland)

Publisher

IEEE

Place of publication

Piscataway, N.J.