![]()
CHAPTER 1: CLOUD COMPUTING – A REFRESHER
Before we delve into Cloud security, let’s look at some key concepts relating to Cloud Computing.
What is Cloud Computing?
A definition of Cloud Computing is somewhat in the eye of the beholder. The definition that is generally accepted is from the National Institute of Standards and Technology (NIST), as follows:
Cloud Computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
There are several aspects of Cloud Computing that help define and categorize it among IT service paradigms, including its:
- essential characteristics
- services models
- deployment models.
The following graphic (Figure 1) was created by NIST and highlights these key areas. Each one is considered below in more detail (all NIST material used by permission).
Figure 1: Visual model of Cloud Computing (source: NIST)
Essential characteristics of Cloud Computing
NIST has defined five essential characteristics that comprise Cloud Computing. These characteristics are key drivers for Cloud adoption:
1 On-demand self-service: A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed, automatically without requiring human interaction with each person’s provider.
2 Broad network access: Capabilities are available over the network, and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g. mobile phones, laptops and PDAs).
3 Resource pooling: The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand.
4 Rapid elasticity: Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out, and rapidly released to quickly scale in.
5 Measured service: Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g. storage, processing, bandwidth and active user accounts).
Cloud service models
Cloud Computing is not binary. There are more than just two choices (“in the Cloud” or “not in the Cloud”). Your IT operation is most likely a very complex, hybrid environment. The decision of what to move “to the Cloud,” and when, is one of the most important (and complex) ones that you will make. You can move your infrastructure, your software platform, your software applications, your data, or any reasonable combination of these objects, to the Cloud. And, of course, you can choose to use a private Cloud, a public Cloud, or a combination of the two. Figure 2 illustrates three primary Cloud service models.
1 Infrastructure as a Service (IaaS): Provides basic storage and computing capabilities over the network. The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run their preferred software, which can include operating systems and applications. These infrastructure resources are pooled, so as to flexibly handle the varied computing requirements of the multiple tenants of the service.
Figure 2: Cloud service models
2 Platform as a Service (PaaS): Provides not only the core components, such as servers and storage, but also provides a software platform on which higher-level software components and applications can be built. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems or storage, but has control over the deployed applications and possibly application hosting environment configurations.
3 Software as a Service (SaaS): A well-known model, having achieved significant success through vendors, such as Salesforce.com. In this model, applications are accessible through a browser, but the consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities.
Cloud deployment models
As with service models, there are several different ways that Cloud Computing environments can be deployed. These choices might be impacted by an enterprise’s level of risk tolerance, their requirements for information privacy and their cost flexibility.
There are four primary Cloud deployment models:
1 Public Cloud: The Cloud infrastructure is made available to the general public or a large industry group, and is owned by an organization selling Cloud services. This model would probably not be appealing to those with extensive or complex security and privacy requirements, such as are specified by PCI, HIPAA, EU Privacy laws, or other mandates highly focused on security and compliance.
2 Private Cloud: A private Cloud is operated solely for the use of a single client organization. It may be managed by the organization or a third party and may exist on-premise or off-premise. This model allows IT groups to be more responsive to their own company’s needs by provisioning servers and applications much more quickly than the traditional method, which required procurement of the actual server, loading operating systems, configuring and a series of additional steps depending on the requirements, typically taking two to four weeks.
3 Community Cloud: The Cloud infrastructure is shared by several organizations and supports a specific community that has common interests (e.g. mission, security requirements, policy and compliance considerations). This service model allows for consumers to work together to leverage a common solution – an option that has appeal when a public Cloud would not support the requirements of a few select consumers.
4 Hybrid Cloud: This model combines instances of the other Cloud models. Hybrid Clouds could be used, for example, to augment a private Cloud with public Cloud resources to handle severe workload fluctuations. One challenge is with the transmittal of data to the public Cloud in the case of excessive services demands. Transferring large amounts of data to accommodate small amounts of application processing reduces the viability of this model in certain environments.
It is important that the boundaries of these models be transparent to users. For example, if an enterprise uses some local IT resources coupled with an external Cloud, access to these services needs to be seamless to the u...
