Cloud computing — IaaS, PaaS, SaaS and cloud models
The recognized NIST definition put into everyday operational decisions
Cloud computing (the cloud) is according to NIST's publication SP 800-145 a model where on demand and with minimal effort from the provider you can access a shared pool of configurable IT resources — networks, servers, storage, applications — that can be quickly scaled up and down. NIST describes the model with three service levels and four deployment models and these concepts recur in almost every conversation about cloud strategy.
§Three service models
| Model | The customer controls themselves | The supplier controls |
|---|---|---|
| IaaS (Infrastructure as a Service) | Control system, applications, data | Physical hardware, networking, virtualization |
| PaaS (Platform as a Service) | The application and its data | Control system, development platform, substrate operations |
| SaaS (Software as a Service) | Only own data and user settings | The entire application and everything under it |
The longer towards IaaS you choose, the more flexibility and responsibility you have yourself; the longer towards SaaS, the less you have to operate yourself, but in return you have less influence on how the service functions under the surface.
§Four rollout models
- 01Private cloud: the infrastructure is reserved for one organization, often to maintain full control over sensitive data
- 02Public cloud: the infrastructure is shared between many customers at a provider and accessed over the internet
- 03Hybrid cloud: a combination where, for example, sensitive systems run privately while others run in the public cloud
- 04Community cloud (shared cloud): infrastructure shared between organisations with common requirements such as an industry or agency type
§Shared responsibility
A widespread misconception is that 'the cloud takes care of security'. In reality there is shared responsibility: the provider typically ensures the physical data center hardware and — depending on service model — parts of the platform while the customer always has responsibility for access control configuration and the data placed in the cloud. The closer to SaaS the more responsibility shifts to the provider but it never completely disappears for the customer.
“The cloud doesn't move responsibility — it moves where work is performed. The responsibility for choosing correctly stays with the customer.”
— Rule of thumb from cloud consulting.