- In 10.2, we're gonna start
talking about cloud services,
primarily from the end user perspective.
And then in 10.3, we'll revisit cloud,
but this time, from an infrastructure
or data center perspective.
So let's get going here.
Let's define cloud computing as our starting point.
Cloud computing is a delivery of computing services
including servers, storage, databases,
networking, software, analytics, and intelligence
over the internet, "The cloud,"
that scale to business need.
And we talked about this in the last lesson.
It's not just that it's delivery over the internet,
it's that it scales to business needs.
Now we're gonna talk about three service models.
Software-as-a-Service, SaaS,
Platform-as-a-Service, PaaS,
and Infrastructure-as-a-Service, IaaS.
Now, these are only three
of a lot of different models
that are currently available
but these are the three that you need to know for the exam.
We're gonna talk about four deployment models.
A private cloud, a community cloud,
a public cloud, and a hybrid cloud.
And then we're gonna talk about this idea
of shared responsibility,
or a shared responsibility model
in terms of security.
So starting with SaaS, Software-as-a-Service,
we're gonna look at three components
for Software-as-a-Service,
Infrastructure-as-a-Service,
and Platform-as-a-Service,
specifically provisioning customer impact
and our security considerations.
So what are we provisioning?
Well, as the end user or the customer,
we are provisioning computing resources
plus an operating system,
plus an application.
So for example, Salesforce.
Now the customer uses the provider's application
running on the cloud infrastructure.
The customer impact?
Customer doesn't have to do anything
other than run the application, right?
The customer doesn't manage or control
of the underlying cloud infrastructure
including network server,
operating system storage,
or even in some cases,
the individual application capabilities.
Now, there may be some tweaking you can do, right?
A few little settings,
but generally speaking,
it all belongs to the cloud provider.
So from a security consideration,
what are we thinking about?
Well, one, we wanna make sure
that the application is responsive
and certainly meets our needs,
that it's scalable,
that it can grow as we grow,
we wanna really understand
how that application
and the entire supporting infrastructure
behind it is maintained.
We wanna know more about vulnerability management, right?
How well is the systems being managed
for any new vulnerabilities
whether it's the backend operating system
or it's in a piece of hardware,
or it's the data itself
because we wanna make sure
that there aren't any vulnerabilities
that could be exploited, right?
By an adversary who might get access to our data.
In that same token, right?
We wanna think about confidentiality and privacy, right?
What are their controls that they have,
and what are their policies?
Who actually owns the data that's stored in the cloud?
Particularly, if it's a cloud vendor
who manipulates your data in some way.
So maybe it's a cloud vendor
that helps you do some credit scoring.
So you've inputted information
but they come up with the credit score.
Who actually owns that information?
You know, do they own the credit score
and you own the the data about the person?
Or do you own both?
Or do you own neither?
So we really wanna know,
kind of, who owns data.
Then we have multi-tenancy,
because in a Software-as-a-Service environment,
we're not the only person using that software.
So there'll be other tenants there.
And we wanna make sure
that there isn't any cross-border pollination,
if you will,
that I can't get to somebody else's data,
they can't get to mine,
that everything is kept separate.
We wanna know what kind of testing
they're doing on their systems
on a regular basis,
and we'd really love to see an audit.
Do they have an independent audit done?
Next up is PaaS, Platform-as-a-Service.
And we start shifting now more responsibility
to the end user, to the customer.
So provisioning, or what's gonna be provisioned,
computing resource and an operating system,
and optionally, a database,
like an Oracle database or a SQL database.
Now, the customer is gonna deploy
onto that cloud infrastructure,
applications that they either created
or they acquired.
So customer impact,
while the customer does not manage
or control the underlying cloud infrastructure
the operating system,
the programming languages,
the tools or the platform.
But the customer does have full control
over the deployed application.
Our security considerations,
again, responsiveness, scalability,
maintenance, vulnerability management,
confidentiality and privacy,
data ownership, multi-tenancy,
testing and audit.
Really, all the same things we looked at
in Software-as-a-Service.
Our third is Infrastructure-as-a-Service or IaaS.
Very often that's referred to
as, "bare metal" computing.
What's provisioned?
Well, really whatever the customer needs.
They can provision processing power,
they can provision storage,
they can provision connectivity,
or any other fundamental computing resource.
So the customer impact,
well, the customer has control
over the operating system,
storage deployed applications,
and perhaps a limited control
of select networking components.
So security considerations,
again, availability, scalability,
can they grow with us?
How is the system maintained?
Their vulnerability management program,
confidentiality, multi-tenancy,
testing, and audit.
And then we have this other thing called XaaS
which should be probably AaaS, but it's not.
It's XaaS, called Anything-as-a-Service.
Where the X represents really,
anything and everything.
So Anything-as-a-Service
represents a growing type of services
that are available over the internet
via cloud computing,
opposed to being provided locally or on premises.
So here's some examples,
but these won't come up in your exam.
Desktop-as-a-Service, DaaS,
Disaster Recovery-as-a-Service, DRaaS,
Network-as-a-Service, NaaS,
Communications-as-a-Service, CaaS,
Database-as-a-Service, DaaS.
So let's talk about who's responsible.
Who's responsible for different components of security?
Is the service provider, which is the CSP,
the cloud service provider responsible?
Or is the user,
by the user, we mean the end user,
not the individual necessarily,
but the customer, the company
that's the provisioner of the service?
So let's look at five components.
Infrastructure security, platform security,
application security,
including APIs, application programming interfaces,
data security, and user security.
In the Software-as-a-Service environment,
the cloud service provider is responsible
for infrastructure security, platform security,
and application security,
where the user's actually responsible
for their own data,
and for the security on the user side.
So when we talk about security on the user side,
we're really talking about access control.
Who has given rights to use
that particular application,
and how they're authenticating,
you know, how well they're securing
their own password, et cetera.
Platform-as-a-Service, again,
we see a shifting over to the user,
the provisioner of the service,
so the cloud service provider is responsible
for infrastructure security and platform security.
But the application security,
including those APIs,
the data security, the user security,
really now reside with the provisioner or the user.
And then lastly,
we get to Infrastructure-as-a-Service
and we see a further moving, right?
In an Infrastructure-as-a-Service.
The cloud provider is responsible
for infrastructure security.
But then as we move down
to platform application data and user,
the responsibility shifts over
to the provisioner of the service.
Now, these aren't hard and fast,
and these may vary a little bit
depending upon a specific application.
But what I'm really trying to stress here,
is that cloud security is really a shared responsibility,
and it's a shared responsibility
between the cloud service provider
and the provisioner of the service.
So let's talk next about cloud deployment models.
There are four cloud deployment models,
public cloud, community cloud,
private cloud, and hybrid cloud.
The public cloud is provisioned for the public use.
So what are we considering?
Well, first of all, where is it?
Because we may have contractual
or regulatory obligations that say
our data can only be in certain locations,
so we need to know where it is.
And of course, multi-tenancy,
because it's a public cloud,
there's other tenants
and we really wanna be concerned about,
is there any kind of cross-pollination, right?
We wanna make sure in a public cloud,
my stuff is my stuff,
your stuff's your stuff,
and never the twain shall meet.
A community cloud is provisioned
for the exclusive use of a well-defined group.
Our considerations are still multi-tenancy,
'cause there's others in our group.
But generally, we'll know the location.
In a private cloud,
that's provisioned for the exclusive use
of a single organization.
So we're okay on location
we'll know where it is,
and there aren't any other tenants,
so multi-tenancy isn't an issue,
but we wanna make sure that it's scalable,
that it can grow appropriate with us.
Hybrid cloud is the mixed use
of on-premise infrastructure,
private cloud, and public cloud platforms
with orchestration or coordination
among the providers.
And so in addition to what happens
at each of the different clouds,
what we're also need to have
a security consideration about,
is going to be the security of the connection.
A term I want you to be familiar with
is cloud bursting.
Cloud bursting refers to the on-demand
and temporary use of the public cloud
when demand exceeds resources available
in either a private cloud,
or in an on-prem infrastructure.
Now, there are three categories of cloud bursting.
Distributed load balancing,
which focuses on workload balancing
and monitoring between the data center
and the public cloud.
Automated bursting,
which is based on on-demand policies,
and then manual bursting,
which is the manual provisioning
of cloud resources on a temporary basis
for specific workloads.
So how do you make a decision?
And be on-premise versus cloud?
Well, there's a lot of considerations.
Legal, regulatory, and contractual,
infrastructure availability,
disaster recovery, and business continuity,
and security are just some of them.
You know, I'm often asked,
"What would you do?
Is cloud more secure or less secure?
Is on-prem more secure or less secure?"
And my answer's always gonna be,
"It depends," right?
In some situations, the cloud is more secure
and on-premise less,
in others, on-prem is more secure, the cloud is less.
The key is to know what your requirements are, right?
Know what you need,
and then those same requirements will apply
whether it is an on-prem or in the cloud.
And you wanna make sure, right?
That in either location,
wherever your systems or data are gonna be,
that those security requirements can be met.
So let's look through some of these categories, right?
In terms of legal, regulatory, and contractual,
we wanna evaluate legal, regulatory,
and contractual restrictions
or obligations that we might have.
The infrastructure,
we wanna evaluate the required investment
to build, maintain, and support the infrastructure.
Again, we're deciding,
should we go to the cloud or be on-prem?
Availability, we wanna evaluate
the capability of resources
and the ability to provision additional resources
as we need them.
Disaster recovery and business continuity,
that's the DR and BC,
we wanna evaluate the synergy
with disaster recovery and business continuity
strategies and requirements.
And lastly, security.
We wanna be evaluating security and privacy requirements.
There are other things we're gonna look at too, of course,
we're gonna look at reputation,
we're going to look at cost,
you know, there's a whole host of things,
but here are some of the primary categories
that we use when we kind of make these decisions
of on-prem versus cloud.
Alright, my friends.
That brings us to a three-second challenge.
Five challenge questions, three seconds each.
You know how to do this.
This cloud deployment models provision
for the exclusive use of a well-defined group.
One, two, three,
keyword, "Exclusive" here.
Exclusive use of a well-defined group.
That's gonna be a community cloud.
In this cloud service model,
the computing resources, operating system,
and an application are all managed by the provider.
One, two, three.
That's gonna be Software-as-a-Service or SaaS.
Number three, this term represents
a growing type of service available in the cloud.
So it really encompasses all these new services
that are available in the cloud.
One, two, three.
That's XaaS, which is Anything-as-a-Service.
Number four, the security and compliance framework
describes the duties of the CSP,
the cloud service provider,
and the provisioner.
We looked at a matrix, what was it called?
One, two, three.
That was a shared responsibility matrix,
or a shared responsibility framework.
And lastly, number five,
this term refers to the ability
to provide additional resources on demand.
One, two, three.
And that's gonna be scalability.
So that brings us to a Security-in-Action.
And this one's about cloud computing.
So we're gonna put that knowledge
right into play for you.
So a metropolitan school district
has decided to transition their entire
IT infrastructure to the public cloud.
SaaS, Software-as-a-Service,
will be used for email, payroll,
and facilities management.
And PaaS, Platform-as-a-Service
for the student database.
Now, the cloud providers have promised,
"Great service and great security
at a great price."
However, they have refused to provide
any audit or testing documentation.
Now, the district superintendent is really excited
about the potential cost savings,
which will be realized by eliminating
district IT and audit personnel.
Hmm, so what's your first reaction to this plan?
Just a quick recap.
This is a school district.
They're gonna transition
their entire IT infrastructure to the public cloud.
They're gonna use SaaS
for email, payroll, and facilities.
They're gonna use PaaS,
Platform-as-a-Service for the student database.
The cloud providers are great marketers,
'cause they say, "Great service, great security
everything you've ever wanted at a great price."
But this is really important.
They have refused to provide
any audit or testing documentation.
Our superintendent thinks this is awesome
because there's gonna be a cost savings.
Where does the superintendent
think the cost savings are gonna come from?
By eliminating district IT and audit personnel.
So how are you gonna react to this?
Well go ahead and put me on pause,
put some notes down,
and let's talk about this shared responsibility
and why we probably don't feel so good about this plan.
So this approach doesn't acknowledge at all,
the inherent shared responsibility
in client computing,
that we can't put the onus for everything
on one side or the other.
There is a shared responsibility.
Remember, we looked at that
shared responsibility matrix.
Outsourcing absolutely does not relieve the district
of their governance, their risk management,
and their compliance responsibilities.
And they are still responsible
for the security and privacy
of that student database,
as well as, you know, payroll,
and you know, other components as well.
Due diligence, remember,
due diligence is the active investigation
before we sign a contract with a vendor
during the lifetime of the relationship,
and especially whenever we're doing renewal,
due diligence or the investigation demands visibility.
And part of that visibility would be,
"Okay show us, you know,
any security testing you've had.
Show us who's audited you,
and what's the results of the audit?"
And the fact that the cloud provider
won't provide that information is a huge red flag.
Now, technical and audit expertise
are still gonna be required
to manage the relationship.
Particularly because we're also using
Platform-as-a-Service,
meaning that the student database
is still going to be a local responsibility.
As I said earlier, data protection,
still the school district's responsibility.
Right? They cannot outsource that.
And lastly, it's really strategic alignment
that should be the significant driver,
not cost alone.
It'd be great if the school district
could save some money,
but that's not the way to do it,
the way they're thinking about it.
And cost alone should never be the reason
why we make a decision.
It should always be strategically aligned
with the needs of an organization.
Now, the needs of an organization
may also be to spend less,
but that's only gonna be one among many.
So really kinda understanding the situation
and once again having the conversation
with a decision maker
to help them better understand
the impact of their decisions.
Absolutely, security and action.
Right, there's your word cloud,
you've got a lot here.
Make sure that you understand all of these concepts
because we're gonna continue talking about cloud,
but we're gonna shift focus in the next lesson,
and look at it from a cloud infrastructure perspective.
So get these concepts down first
before you move on.
When you're ready,
I'll see you right there.