CompTIA Security+ Preparation · lesson 23 of 45 · 25 min
Cloud Service Models
IaaS (Infrastructure as a Service) — provider manages physical hardware, networking, and virtualization. Customer manages: OS, middleware, runtime, applications, data. Examples: AWS EC2, Azure VMs, Google Compute Engine. Most control, most responsibility.
PaaS (Platform as a Service) — provider manages infrastructure + OS + runtime. Customer manages: applications and data. Examples: AWS Elastic Beanstalk, Azure App Service, Google App Engine. Good for developers who want to focus on code.
SaaS (Software as a Service) — provider manages everything. Customer manages: data and user access. Examples: Microsoft 365, Salesforce, Google Workspace. Least control, least responsibility.
Shared responsibility model — security responsibilities are divided between the cloud provider and the customer. The split depends on the service model. The provider is always responsible for security OF the cloud (physical, network, hypervisor). The customer is always responsible for security IN the cloud (data, identity, access).
Cloud Security Tools
CASB (Cloud Access Security Broker) — sits between users and cloud services. Enforces security policies, provides visibility into cloud usage, detects shadow IT, prevents data exfiltration. Can be inline (proxy) or API-based.
CSPM (Cloud Security Posture Management) — continuously monitors cloud configurations for misconfigurations and compliance violations. Detects: public S3 buckets, overly permissive IAM roles, unencrypted storage, missing MFA.
CWPP (Cloud Workload Protection Platform) — protects workloads (VMs, containers, serverless) in the cloud. Provides runtime protection, vulnerability scanning, and compliance monitoring.
Cloud deployment models: Public (shared infrastructure, provider-owned), Private (dedicated infrastructure), Hybrid (mix of public and private), Community (shared by organizations with common requirements).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Cloud Service Models
In IaaS, the customer is responsible for:
- Physical hardware
- The hypervisor
- The OS, applications, and data
- Network infrastructure
- Answer: The OS, applications, and data
IaaS: provider manages hardware, network, and hypervisor. Customer manages everything above: OS, middleware, apps, and data. In SaaS, the customer is responsible for:
- The OS
- The application code
- Data and user access management
- The runtime environment
- Answer: Data and user access management
SaaS: the provider manages everything except data and identity/access — the customer controls who has access and what data is stored. CASB is used to:
- Scan for vulnerabilities in cloud VMs
- Enforce security policies between users and cloud services
- Monitor cloud configurations for misconfigurations
- Encrypt cloud storage
- Answer: Enforce security policies between users and cloud services
CASB acts as a gatekeeper — it enforces policies, provides visibility into cloud usage, and prevents data exfiltration. CSPM detects:
- Malware in cloud workloads
- Cloud misconfigurations like public S3 buckets and overly permissive IAM
- Network intrusions
- User authentication failures
- Answer: Cloud misconfigurations like public S3 buckets and overly permissive IAM
CSPM continuously monitors cloud configurations — it catches misconfigurations that create security risks. The shared responsibility model states that the cloud provider is always responsible for:
- Customer data
- User identity management
- Security OF the cloud (physical, network, hypervisor)
- Application security
- Answer: Security OF the cloud (physical, network, hypervisor)
The provider secures the underlying infrastructure. The customer secures what they put IN the cloud. Shadow IT refers to:
- Dark web activity
- Unauthorized cloud services used without IT approval
- Encrypted cloud storage
- Offline backups
- Answer: Unauthorized cloud services used without IT approval
Shadow IT: employees using Dropbox, personal Gmail, or other unapproved cloud services — creates data leakage and compliance risks. A hybrid cloud deployment combines:
- IaaS and PaaS
- Public and private cloud
- Two different public cloud providers
- SaaS and IaaS
- Answer: Public and private cloud
Hybrid cloud: sensitive workloads on private cloud, scalable workloads on public cloud — connected for data portability. Microsoft 365 is an example of:
- IaaS
- PaaS
- SaaS
- CaaS
- Answer: SaaS
Microsoft 365 is fully managed software delivered over the internet — the provider manages everything, the customer manages data and access.
In the shared responsibility model, the customer is always responsible for their _____ and identity/access management.
Answer: data
Regardless of service model, the customer owns their data and is responsible for who can access it.
AWS EC2 is an example of:
- SaaS
- PaaS
- IaaS
- FaaS
- Answer: IaaS
EC2 provides virtual machines — the customer manages the OS and everything above. AWS manages the physical infrastructure.
Try it: Shared responsibility
Previous lesson: Cloud security architecture: shared responsibility, CASB, CSPM
Back to CompTIA Security+ Preparation
Next lesson: Secure network design: NAC, proxy, reverse proxy, load balancer, WAF, SIEM, SOAR