What are the Cloud Service Models?

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Time
12 hours 57 minutes
Difficulty
Intermediate
CEU/CPE
13
Video Transcription
00:00
>> Hello, welcome back.
00:00
Module 1.5, what are the cloud service models?
00:00
We've talked about the three cloud service models
00:00
in past modules,
00:00
but now we're going to take things to another level by
00:00
talking about the use cases as well as
00:00
many of the security concerns
00:00
that come with each of these different service models.
00:00
The learning objectives for this module
00:00
include describing the three Cloud service models,
00:00
identifying which model is really
00:00
appropriate for a given business case,
00:00
because as we said in the past,
00:00
security is really driven by the business case and
00:00
requirements for the Cloud service model.
00:00
We're going to analyze
00:00
the benefits and tradeoffs that really come with
00:00
each model when it comes to
00:00
security responsibility and how much you
00:00
really have to depend on vendors and third parties.
00:00
Here are our service models again.
00:00
Software as a service.
00:00
If you were the Cloud customer,
00:00
you are accessing someone else's application in
00:00
the Cloud and all you're really putting in is your data.
00:00
Platform as a service,
00:00
this is used for spinning of development environments.
00:00
Typically, the Cloud provider offers
00:00
a number of different operating systems to choose from.
00:00
You provision your environments,
00:00
and then do your development work.
00:00
Infrastructure as a service.
00:00
This is really where you get to pick the flavor of
00:00
operating system that's installed on the hardware.
00:00
Let's go deeper into these service models.
00:00
Each comes with its own distinct controls,
00:00
costs, and security responsibilities.
00:00
Infrastructure as a service,
00:00
this is where you really have the most control.
00:00
Over here on the right-hand side in the graphic,
00:00
we see the components that are
00:00
incorporated into infrastructure as a service.
00:00
Now, although you have the most control,
00:00
you also have the most security responsibility.
00:00
The Cloud provider is accountable for
00:00
the facilities themselves, maintaining the hardware,
00:00
ensuring that the utilities work,
00:00
that all the devices are patched
00:00
in accordance to any security flaws that pop up.
00:00
Now, that layer comes with
00:00
the greatest amount of responsibility.
00:00
Platform as a service.
00:00
You have less control
00:00
than the infrastructure as a service, but still,
00:00
there's a certain amount of responsibility that comes
00:00
with provisioning all these virtual environments,
00:00
ensuring that they're configured
00:00
properly and that things are patched,
00:00
and a regular cadence to prevent
00:00
security vulnerabilities from creeping
00:00
into these development environments.
00:00
Software as a service.
00:00
As the consumer, you really have the least amount of
00:00
control and there is
00:00
the lowest amount of security responsibility.
00:00
If you are providing the software as a service,
00:00
you have to ensure that your application
00:00
is batched properly,
00:00
that the APIs are maintained securely so that customers
00:00
can transmit their data over a secure connection,
00:00
that doesn't enable their data to
00:00
be somehow intercepted and transit,
00:00
and that there are
00:00
no backdoors or floors in your application that also
00:00
allow malicious actors to get in and cause havoc.
00:00
Again, look at this from the top down.
00:00
Software as a service,
00:00
you really are only responsible for,
00:00
if you are the Cloud customer,
00:00
making sure your data is secure in the application.
00:00
If you are the provider of the software as a service,
00:00
you're maintaining the application security as well as
00:00
the connection level security
00:00
to your application through these APIs
00:00
or how it may interact with
00:00
the customer's network if it's
00:00
a business or how
00:00
individual puts their data into your application.
00:00
When it comes to platform as a service,
00:00
this is where we see things increase.
00:00
You really are responsible for ensuring that
00:00
these development environments are maintained safely,
00:00
that the operating system
00:00
should be maintained by the Cloud provider
00:00
in this instance but
00:00
that there are really effective rules
00:00
of the road regarding
00:00
the applications there being developed and
00:00
that software is being developed securely.
00:00
For infrastructure, this is really
00:00
where you have the most control over the environment,
00:00
what operating system you're imposing,
00:00
but the Cloud provider has
00:00
the ultimate responsibility for
00:00
maintaining the hardware and the facilities,
00:00
ensuring redundancy with the utilities.
00:00
Let's finish up here with a quiz question.
00:00
Which service model provides the greatest control as
00:00
well as responsibility for security?
00:00
Is it infrastructure as a service,
00:00
software as a service,
00:00
or platform as a service?
00:00
If you said A, infrastructure as
00:00
a service, you're correct.
00:00
In this module, we covered the
00:00
three Cloud service models,
00:00
the security responsibilities that
00:00
come with each of them,
00:00
and the common use cases for each of the models.
00:00
See you in the next module.
Up Next