Cloud service models (such as SaaS, PaaS, and IaaS) are appearing in more and more certification exams lately. I’ve seen these topics pop up in several certifications lately including CompTIA Network+, Security+, (ISC)2 SSCP, and CISSP.
See this post for info on cloud deployment models (such as public, private, hybrid, and community).
Understanding Cloud Service Models Question
As an example, can you answer this question?
The Springfield Nuclear Power Plant has created an online application teaching nuclear physics. Students in the Springfield Elementary school access this application via the cloud, and teachers can monitor the student’s progress. What type of cloud service model is this?
A. IaaS
B. PaaS
C. SaaS
D. Public
Answer below.
SaaS Cloud Service Model
Software as a Service (SaaS) includes any software or application provided to users over a network such as the Internet. Internet users access the SaaS applications with a web browser. It usually doesn’t matter which web browser or operating system a SaaS customer uses. They could be using Internet Explorer, Chrome, Firefox, or just about any web browser.
Web-based email is an example of SaaS. This includes Gmail, Yahoo! Mail, and others. The service provides all the components of email to users via a simple web browser. If you have a Gmail account, you can also use Google Docs, another example of SaaS. Google Docs provides access to several SaaS applications, allowing users to open text documents, spreadsheets, presentations, drawings, and PDF files through a web browser.
PaaS Cloud Service Model
Platform as a Service (PaaS) provides customers with a preconfigured computing platform they can use as needed. It provides the customer with an easy-to-configure operating system, combined with appropriate applications and on-demand computing.
Many cloud providers refer to this as a managed hardware solution. For example, I host http://gcgapremium.com/ on a virtual server through Liquid Web (http://www.liquidweb.com/) using one of their “Fully Managed” offerings.
Liquid Web provides several features in their fully managed solutions, including an installed operating system, a core software package used for web servers, Apache as a web server, antivirus software, spam protection, and more. Additionally, they keep the operating system up to date with relevant updates and patches. I manage the software used for the web site, including software changes and updates. However, I don’t need to worry about managing the server itself. The couple of times when the server developed a problem, they fixed it before I was even aware of the problem.
IaaS Cloud Service Model
Infrastructure as a Service (IaaS) allows an organization to outsource its equipment requirements, including the hardware and all of its support operations. The IaaS service provider owns the equipment, houses it in its data center, and performs all of the required hardware maintenance. The customer essentially rents access to the equipment and often pays on a per-use basis.
Many cloud providers refer to this as a self-managed solution. They provide access to a server with a default operating system installation, but customers must configure it and install additional software based on their needs. Additionally, customers are responsible for all operating system updates and patches.
IaaS can also be useful if an organization is finding it difficult to manage and maintain servers in its own data center. By outsourcing its requirements, the company limits its hardware footprint. It can do this instead of, or in addition to, virtualizing some of its servers. With IaaS, it needs fewer servers in its data center and fewer resources, such as power, HVAC, and personnel to manage the servers.
Remember this
Applications such as web-based email provided over the Internet are Software as a Service (SaaS) cloud-based technologies. Platform as a Service (PaaS) provides customers with a fully managed platform, which the vendor keeps up to date with current patches. Infrastructure as a Service (IaaS) provides customers with access to hardware in a self-managed platform. Customers are responsible for keeping an IaaS system up to date.
Security Responsibilities with Cloud Service Models
One important consideration with cloud service models is the different security responsibilities. The following graphic (derived from Figure 1 in the US Department of Defense (DoD) “Cloud Computing Security Requirements Guide“) shows the differences in responsibilities. This includes both maintenance responsibilities, and security responsibilities.
As an example for SaaS, consider Gmail. Google has the majority of responsibility for maintaining the app and ensuring it is available. Additionally, Google has the majority of responsibility to ensuring the security for Gmail. If you use it, you still have some responsibility such as ensuring you use a strong password that is different from other online accounts.
With a PaaS solution, the cloud service provider (CSP) has the responsibility to provide you with the platform, and ensure it remains available. Many CSPs provide additional security protection such as firewalls, malware content filters, and intrusion detection systems. Still, the customer has a much greater responsibility for the operation, configuration, and security of the platform.
The CSP has the least responsibility for an IaaS solution and the customer has the most responsibility when compared to both PaaS and SaaS.
Understanding Cloud Service Models Answer
The Springfield Nuclear Power Plant has created an online application teaching nuclear physics. Students in the Springfield Elementary school access this application via the cloud, and teachers can monitor the student’s progress. What type of cloud service model is this?
A. IaaS
B. PaaS
C. SaaS
D. Public
Answer C is correct. This is a Software as a Service (SaaS) model. The software is the online application and the cloud provider (the Springfield Nuclear Power Plant in this example) maintains it.
A is incorrect. Infrastructure as a Service (IaaS) provides customers with the hardware via the cloud. Customers are responsible for installing the operating system any applications.
B is incorrect. Platform as a Service (PaaS) is a computing platform. For example, a cloud provider can provide a server with a preconfigured operating system.
D is incorrect. Public is a type of cloud deployment model, not a type of cloud service model. While the question didn’t specify, if any organization can access the application it would be public.
