Pervasive communications and the rapid expansion of Internet trigger a myriad of concerns about trust and information security. Moreover, composing software from components and services, originating from diverse sources, without a thorough quality assurance practices may expose serious weaknesses that open up the systems for malicious attacks and misuse. In order to guarantee the security of the systems we need a uniform understanding about what security is and how to measure it. This paper introduces a taxonomy of information security, intended for the use of software architects of servicecentric systems. The security taxonomy extends our quality oriented architecting environment (QoAE) an integrated tool environment for defining quality ontologies, describing the quality properties of service architectures, and analyzing quality requirement satisfaction at the level of proposed architecture.