Oct 06: Cloud, Network, Architecture (24)

IaaS vs PaaS vs SaaS

IaaS: virtual infrastructure (VMs, storage). PaaS: platform to build/run apps. SaaS: ready-to-use software.

Shared responsibility model

Provider secures the cloud itself; the customer secures what they put in it. More customer duty with IaaS, least with SaaS.

Cloud deployment models

Public, private, hybrid, community.

Serverless (FaaS)

Run code without managing servers; billed per execution.

Microservices

Application split into small independent services.

Infrastructure as code (IaC)

Define and deploy infrastructure through code for consistency and repeatability.

SDN

Software-defined networking: control plane is separated from the data plane.

Containers vs virtual machines

Containers share the host OS kernel and are lightweight. VMs each include a full OS and are more isolated.

Air gap

Physical isolation from other networks, including the internet.

Zero trust planes

Control plane: policy engine, policy administrator. Data plane: policy enforcement point (PEP) enforces access.

Screened subnet (DMZ)

Buffer zone between internet and internal network for public-facing servers.

Jump server

Hardened host used to administer systems in a separate security zone.

Proxy server

Intermediary for client requests; filters and caches. Reverse proxy sits in front of servers.

Load balancer

Distributes traffic across servers for availability and scale.

IDS vs IPS

IDS detects and alerts. IPS sits inline and can block.

WAF

Web application firewall: filters HTTP/HTTPS traffic to defend against web attacks.

NGFW / UTM

Next-gen firewall: app-aware inspection. UTM: bundles multiple security functions in one device.

Stateless vs stateful firewall

Stateless: checks each packet in isolation. Stateful: tracks connection state.

802.1X

Port-based network access control using authentication (e.g., RADIUS).

IPsec tunnel vs transport mode

Tunnel: encrypts the entire original packet (site-to-site VPN). Transport: encrypts only the payload.

SASE / SD-WAN

SD-WAN: software-defined WAN routing. SASE: converges networking with cloud security services.

Fail-open vs fail-closed

Fail-open: allows traffic on failure (availability). Fail-closed: blocks on failure (security).

Active/active vs active/passive

Active/active: all nodes handle load. Active/passive: standby takes over on failure.

ICS / SCADA / IoT / RTOS

Specialized, often legacy or embedded systems; hard to patch, so isolate and segmen