Let's start looking at various cloud deployment models
from a very high overview perspective.
NIST defines the cloud deployment models as composed
of five essential characteristics, three service models,
and four deployment models in the special publication 800‑145.
Those five essential characteristics of the cloud
include on‑demand self‑service, broad network access,
resource pooling, rapid elasticity, and measured service.
However,
even NIST admits that many cloud deployments do not have all
of these five essential characteristics,
but this is what makes the cloud so flexible,
usable, and practical for many organizations.
You can expand and retract some of the resources
you use as a self‑service option.
You only pay for what you use.
You have access to a pool of resources, rather than having to buy it yourself,
for example.
If we look at an overview, for example, of a public cloud implementation,
we see a number of different elements to this.
We see the cloud provider in the center with all of their
various types of equipment that are available,
servers, for example, for both compute and storage needs,
and they are continuously improving those,
replacing them, but it operates as a single unit to the cloud consumer.
You have clients that initiate access wanting to subscribe to a cloud service.
You then have all of those computers that are providing
service through some type of a network, public clients accessing the cloud,
and of course, new hardware going in and old hardware coming out.
Then you have, of course, clients terminating access, leaving the cloud as well.
If we went back to a traditional type of operation,
we had then a consumers facility with their users and quite
often they would have their own equipment,
but now,
they are able to subscribe to a cloud‑based service and not necessarily
have to have that equipment on their own site or location.
They have, of course, the need to provide proper security and isolation,
and this is where very often we put up that security perimeter,
that is where we can control access from our building to,
say, the cloud service providers.
So this is a high‑level overview of initiating,
terminating, maintaining access the relationships between the various entities.
We have three primary service models.
Now, almost anything these days can be called as a service,
Disaster Recovery as a Service, even Ransomware as a Service,
but the three that are defined by NIST and 800‑145
include Software as a Service, Platform as a Service,
and Infrastructure as a Service,
and we'll look at each of these a little bit more later on,
however, we know that one of the important things with this is where is control,
who has responsibility?
If we looked, for example, of a high level at Software as a Service,
we can see that the cloud provider really has total control over the facility,
the hardware, the operating system, the middleware,
and they do administrative control over the application.
The cloud consumer has no control over the building or equipment, and they
only have a limited level of administrative control,
say, for example, setting up user access levels than for the application.
We have four primary deployment models: the private
cloud on‑premise or off‑premise, community cloud,
public cloud,
and a combination of cloud providers in a hybrid cloud type of deployment.
One of the important things we looked at a moment ago
was the idea of a security perimeter.
Having a defined area of responsibility that says what is within or inside
my perimeter is that which I must maintain control over.
Sometimes that was known as the trusted computing base.
That which was outside of the perimeter was beyond my direct control,
and I could try and control how data flowed from inside to outside
through some type of a boundary controller allowing certain activities
in and certainly blocking others as well.
Many organizations have looked at things like an on‑site private cloud.
That means that I take my own equipment,
but I now use it as a type of cloud‑based deployment using some of the
advantages of having things that are more shared resources,
and we can see here in this case, in the case of a private cloud,
that all of that equipment is inside the security perimeter of the organization.
Now,
we could also have a private cloud located at the
facility of a cloud service provider.
We can go to a CSP and we can then lease from them the
space that our equipment runs on, perhaps in a protected cage at their facility.
And so a private cloud really refers to a cloud for the use of one customer,
and in this case,
since this private cloud is located within the facility of the cloud consumer,
then they control access all within their perimeter,
but they may allow outside access as well through some type
of approved and legitimate access path.
When we look at the cloud,
it's important to understand the roles of the various entities involved.
Let's do a quick overview of what those main ones are.
You have the cloud consumer or a customer who is using cloud‑based services.
Now,
I will point out that throughout this course and
the certification by ISC squared,
we often have a little bit of a bias towards the
perspective of the cloud consumer.
So very often when we look at things, we're looking at,
if I am the cloud consumer, what do I need to do?
And that's one thing to remember that we still obviously have to
consider the perspective of the cloud provider as well,
but the natural default tends to be with the consumer.
You have clients or users that are using cloud‑based services,
they could be employees of the cloud consumer.
You have the actual, you have cloud provider,
the cloud service provider that is providing the
facility for cloud‑based services, and of course,
you have the carriers,
the networks that are enabling access even to remote locations.
Some of the things we need to remember as we now go
deeper into this course is that this term,
cloud computing, is not just referring to one thing.
It's sort of like using the term a car.
Well there is a big difference between, obviously, one type of car and another.
A Chevrolet is not quite the same as a Maserati,
for example, and yet they're both cars.
So the term cloud computing may be used in many ways and is
based on the way that cloud providers define,
or let's say, market their services, and that cloud consumers use those services.