3.1a 1 cloud service and deployment models

Responsibility matrix

Document from a CSP showing who secures each layer across SaaS, PaaS, IaaS, and on-prem.

Shared responsibility model

The principle that security duties are divided between cloud provider and customer based on the service model chosen.

Golden rule of the responsibility matrix

Regardless of service model, the customer is ALWAYS responsible for their own data and their accounts/identities.

Cloud service model

Classification of how much of the stack the provider preconfigures and where provider responsibility ends.

Infrastructure as a Service (IaaS)

Provider supplies compute, storage, network. Customer manages OS, patching, runtime, apps, data, accounts. Example: AWS EC2.

Platform as a Service (PaaS)

Provider supplies OS, runtime, and platform. Customer writes and secures the application and its data. Example: Azure SQL Database.

Software as a Service (SaaS)

Provider supplies a finished application. Customer manages only data and access. Example: Microsoft 365, Salesforce.

Function as a Service (FaaS)

The service-model name for serverless. Apps split into autonomous functions running in stateless containers. Example: AWS Lambda.

XaaS (Anything as a Service)

Umbrella term for any cloud service model delivered on subscription.

Cloud deployment model

Classification of ownership and management of a cloud: public, private, community, or hybrid.

Public cloud

Multi-tenant service offered over the internet by a CSP to any consumer, usually pay-as-you-go.

Private cloud

Cloud infrastructure owned by and exclusive to one organization; greater control over privacy and security.

Hosted private cloud

Cloud hosted by a third party for the exclusive use of one organization.

Community cloud

Cloud shared by several organizations with a common concern, splitting the cost of a private or hosted private cloud.

Hybrid cloud

Environment combining public and private (or on-prem) infrastructures. NOT the same as multi-cloud.

Multi-cloud

Using services from two or more different cloud service providers. CompTIA lists this under 3.4 resilience.

Single-tenant architecture

Dedicated infrastructure for one customer. Highest control and isolation, higher cost.

Multi-tenant architecture

Multiple customers share infrastructure with logical separation. Cost-effective, higher leakage risk if misconfigured.