Cloud Service Models
IaaS (Infrastructure as a Service): cloud provider delivers virtual hardware — servers (VMs), storage, networking. Customer manages: OS, middleware, runtime, applications, data. Customer has most control. Examples: AWS EC2, Microsoft Azure Virtual Machines, Google Compute Engine. Use case: replacing on-premises servers with cloud VMs.
PaaS (Platform as a Service): cloud provider delivers hardware + OS + middleware + runtime. Customer manages: applications and data only. Less administrative overhead. Examples: Google App Engine, Microsoft Azure App Service, Heroku. Use case: developers deploy applications without managing server OS.
SaaS (Software as a Service): cloud provider delivers the complete application. Customer just uses the software through a browser or app — manages only their data. Examples: Microsoft 365 (Office apps + Exchange + Teams), Google Workspace, Salesforce, Dropbox. Most end users interact with SaaS daily without realizing it. No installation required (web-based) — access from any device.
Shared responsibility model: in IaaS, the customer is responsible for securing the OS, applications, and data; the cloud provider secures physical infrastructure. In SaaS, the customer is responsible only for access management and data; the provider handles everything else. Understanding the boundary of responsibility is critical for security planning.
Cloud Deployment Models and Characteristics
Public cloud: owned and operated by a third-party provider (AWS, Azure, Google Cloud) — shared infrastructure, multiple customers (multi-tenant). Resources available on demand, pay-per-use, no upfront hardware investment. Most common for general workloads.
Private cloud: cloud infrastructure dedicated to one organization — can be on-premises (owned data center using cloud management software like VMware vSphere) or hosted exclusively by a provider. Higher security and compliance control. More expensive than public cloud.
Hybrid cloud: combination of public and private cloud connected to share data and applications. Organizations keep sensitive data private, use public cloud for burst capacity or less-sensitive workloads. Most enterprises use hybrid cloud.
Community cloud: shared by several organizations with common requirements (government agencies, healthcare organizations) — costs distributed among members. Less common than the other three models.
Key cloud characteristics (NIST definition): on-demand self-service (provision resources without human interaction with provider), broad network access (accessible from any device/location), resource pooling (multi-tenant infrastructure), rapid elasticity (scale up/down quickly), measured service (pay only for what you use). Metered service enables cost control — no capital expenditure.