Instructor: Service models. 2 2
In this lesson, we're going to dig into the different type 3 3
of cloud service models. 4 4
When I'm talking about cloud service models, 5 5
I'm talking about classifying the provision 6 6
of cloud services and the limit 7 7
of the cloud service provider's responsibility 8 8
as either software, platform, infrastructure, 9 9
or some other thing. 10 10
Essentially, when we talk about something as a service, 11 11
this is what we're talking about. 12 12
What type of cloud service model are you using? 13 13
Usually when we talk about cloud services, 14 14
we talk about them as software as a service, 15 15
platform as a service, infrastructure as a service, 16 16
and so we need to understand 17 17
what each of these are and what they do for us 18 18
and what kind of security risks they have. 19 19
The first one we're going to talk 20 20
about is software as a service, also known as SaaS. 21 21
Now, SaaS is going to provide all the hardware, 22 22
the operating systems, the software, the applications, 23 23
everything you need for a complete application service 24 24
to be delivered to your end user. 25 25
For example, if you use something like Slack or Freshdesk 26 26
or QuickBooks Online, these are all software as a service. 27 27
This happens when the cloud service provider 28 28
is responsible for the security of the platform 29 29
and the infrastructure 30 30
because they're providing you everything 31 31
from the application layer all the way down. 32 32
What are you responsible for as a consumer? 33 33
Well, as a consumer, 34 34
you're responsible for application security, 35 35
account provisioning and authorizations. 36 36
So in my company, for instance, we use G Suite. 37 37
When we use G Suite and I hire a new employee, 38 38
I'm responsible for creating their account. 39 39
That also gives them authorizations 40 40
to what they're able to access within our portfolio 41 41
and we control the application security that way. 42 42
Now, if you think about Office 365, 43 43
this is another great example of a SaaS product. 44 44
Who is responsible for what? 45 45
Well, if someone's able to perform 46 46
a cross-site scripting attack or an SQL injection 47 47
or something like that on the application, 48 48
this would be Microsoft's fault 49 49
because they wrote the application, 50 50
they host the application, 51 51
they do everything with the code on down. 52 52
They as the SaaS provider are responsible 53 53
for securing the infrastructure 54 54
and the platform and the code. 55 55
Now, if somebody in my organization lost their username 56 56
and password and somebody else logged in 57 57
to exfiltrate that data, whose fault is this? 58 58
It's not Microsoft's, it's not the service provider's, 59 59
it's ours, the consumer of the application 60 60
because it happened either on our client computer 61 61
because they had malware or a key logger, 62 62
or our employee was just negligent 63 63
and wrote down their username and password. 64 64
This is the idea when you're dealing with SaaS. 65 65
Who's responsible for what? 66 66
The responsibility for the data and for the authorization 67 67
is that of the consumer. 68 68
Everything else from the software on down 69 69
is the problem of the service provider. 70 70
The next one we're going to talk 71 71
about is infrastructure as a service or IaaS. 72 72
When we talk about infrastructure as a service, 73 73
this is going to provide all the hardware, 74 74
the operating system, and the backend software 75 75
needed to develop software or services. 76 76
Now, notice the difference here. 77 77
I talked about the backend software 78 78
and you're using this to develop your own software services. 79 79
So when you go to my website, for instance, 80 80
that's actually running 81 81
on an infrastructure as a service product. 82 82
The reason is that service provider is giving me 83 83
the load balancers, the servers, the storage area networks, 84 84
the database servers, all of that stuff they give us, 85 85
and they give us the basic operating system. 86 86
Now, once they do that, 87 87
we have to end up doing everything on top of that. 88 88
We made the website, we made the exams, 89 89
we made all that software that provides you access 90 90
to what you see when you go to our website. 91 91
Now, this allows me, 92 92
instead of having to buy all the hardware, 93 93
I can just call up my IaaS provider, 94 94
somebody like Amazon Web Services, Microsoft Azure, 95 95
Google Cloud, or somebody like that, and I say, 96 96
"Hey, I need a new website." 97 97
Go ahead and spin me up a new virtual machine 98 98
and now I can build on top of that what I exactly want. 99 99
They give me everything from the hardware down 100 100
and they will give me the basic operating system, 101 101
but then I take it over from there 102 102
and I'm responsible from the operating system up. 103 103
Now, infrastructure as a service 104 104
is going to place the responsibility on the consumer, 105 105
in this case me, 106 106
for the security of the platform and the applications. 107 107
When I talk about the platform, 108 108
I'm talking about things like the operating system and up. 109 109
Now, when we talk about cloud service providers, 110 110
their job here is to make sure they have confidentiality, 111 111
integrity, and availability of the hardware 112 112
within the resource pool. 113 113
What does that mean? 114 114
When we talk about the resource pool, 115 115
let's say I'm using Amazon Web services. 116 116
That's their servers. 117 117
When I say I want to spin up a new virtual machine, 118 118
they're going to go ahead and figure out where in their pool 119 119
of all of their servers they're going to install 120 120
my virtual machine on. 121 121
Now, for that hardware pool, 122 122
they're going to provide confidentiality, 123 123
integrity, and availability. 124 124
For my instance, my virtual machine, 125 125
they're not going to do anything inside of that. 126 126
That's on me as the service consumer. 127 127
That's where that line in differentiation is. 128 128
Now, when we talk about infrastructure as a service, 129 129
one of the things you have to keep in mind 130 130
is you have to have good organizational governance 131 131
to control how those VMs and those containers 132 132
are being provisioned and deprovisioned. 133 133
If you don't have good organizational governance on this, 134 134
you can have problems like VM sprawl and huge cost overruns. 135 135
If anyone can spin up a VM and anyone can set it 136 136
to whatever limit they want, 137 137
they can use up tons of resources 138 138
and you can get a huge bill, so keep that in mind 139 139
when you're using infrastructure as a service. 140 140
The third one we're going to talk 141 141
about is platform as a service. 142 142
Now, platform as a service or PaaS 143 143
is where it provides your organization 144 144
with the hardware and the software needed 145 145
for a specific service to operate. 146 146
Now, this one often gets students confused 147 147
because it sounds kind of like software as a service 148 148
and kind of like infrastructure as a service 149 149
and the reason for that is it kind of sits 150 150
right between the two of them. 151 151
So the best way I know to explain platform as a service 152 152
to you is by doing it graphically. 153 153
Let's say I have infrastructure as a service. 154 154
Now, infrastructure as a service 155 155
is the lowest of these three. 156 156
When I look at infrastructure as a service, 157 157
I'm going to get the networking from the vendor. 158 158
I'm going to get the storage from the vendor. 159 159
I'm going to get the server from the vendor. 160 160
I'm going to get the virtualization from the vendor 161 161
and I'm even going to get the operating system installed 162 162
by the vendor, but then I have to support it from there. 163 163
Now, any kind of middleware I need, 164 164
any kind of runtime I need, any kind of data I need, 165 165
any kind of applications I need, 166 166
that's all on me as the consumer. 167 167
That's where that dividing line is. 168 168
It's from the operating system and you could see it there 169 169
as it's split between the vendor and the customer. 170 170
Now, if you go to PaaS, 171 171
you're going to go a little bit higher. 172 172
With PaaS, they're going to provide you 173 173
with the operating system and they're going to patch it 174 174
and maintain it and do the security of it. 175 175
They're going to provide the middleware and the runtime, 176 176
but they're not going to provide the data 177 177
and they're not going to provide the application. 178 178
That's for you to develop. 179 179
Then when we go to software as a service, 180 180
the vendor is going to give you everything all the way up 181 181
from the application on down. 182 182
So, let's take an example like QuickBooks, 183 183
which is a piece of accounting software. 184 184
There is QuickBooks Online, which is a SaaS product. 185 185
When you use it, they provide you everything. 186 186
They built the application, 187 187
all you have to do is log in and do your own data entry. 188 188
You're going to put in what you spent and what you took in 189 189
and you'll be able to run through that program that way. 190 190
Now, if I wanted to make my own QuickBooks, 191 191
I wouldn't do a SaaS solution. 192 192
I might use a platform as a service solution instead. 193 193
In this case, I can go to somebody like Amazon and say, 194 194
"Hey, I'm going to make a web application. 195 195
I need you to give me a Linux server 196 196
that's updated and patched and running 197 197
and everything's perfect 198 198
and it has these programming languages that are supported." 199 199
Maybe I'm going to write it in Python or PHP or whatever it is 200 200
and I need these type of databases 201 201
and all these things I need, they can give me that platform. 202 202
All I would do is actually code my application. 203 203
That's the application and data piece. 204 204
Now, on the other hand, if I go all the way down to IaaS, 205 205
infrastructure as a service, I would go to Amazon and say, 206 206
"Hey, I need a server that has this much memory 207 207
and this much storage 208 208
and I want you to install it with Windows or Linux." 209 209
They would do that and hand it over to me 210 210
and then I would install 211 211
whatever programming languages I need. 212 212
I would install the databases. 213 213
I would install an Apache server or an IIS server 214 214
and then I can code and develop my application. 215 215
So that's the difference here. 216 216
When you go to SaaS, it's a completely done product. 217 217
When you go to IaaS, it's pretty much just the vehicle 218 218
and you have to do everything yourself. 219 219
With PaaS, it's somewhere in between. 220 220
Essentially, you have an operating system 221 221
that's well maintained for you. 222 222
They do the security patches and everything, 223 223
but everything on top of the operating system 224 224
and on top of the programming languages, 225 225
that's going to be on you to code your specific application. 226 226
So when you're dealing with platform as a service, 227 227
what kind of things do you need to consider from security? 228 228
Well, you need to think about access control. 229 229
You need to think about load balancing. 230 230
You need to think about failover and privacy 231 231
and protection of your data. 232 232
All of these things are things you have to think about 233 233
because you're designing the application. 234 234
And so if you're going to have redundancy and failover, 235 235
you're going to program that into your application 236 236
so it knows which servers to point to. 237 237
That's the idea with PaaS. 238 238
There is some of that that you're responsible for. 239 239
The hardware underneath it, you're not, 240 240
but you do have to do the coding 241 241
to make sure it knows which hardware to go to. 242 242
Now, another thing to think about when you're dealing 243 243
with PaaS, is you should always encrypt your data. 244 244
A lot of PaaS solutions are third party. 245 245
So for instance, if you're going to make a website 246 246
and you decide you're going to run it on WordPress, 247 247
you can go to a managed WordPress solution. 248 248
That means you can go to a provider, 249 249
third-party PaaS solution 250 250
and they're going to give you a server 251 251
with WordPress installed and configured 252 252
and they'll make sure it's always up to date, 253 253
but then you can put your system 254 254
on top of that WordPress by designing your own web apps. 255 255
When you do that, 256 256
always encrypt that data because it's being stored 257 257
in this third-party PaaS solution 258 258
that may be in a database that they're not encrypting 259 259
'cause you don't have control 260 260
of the underlying operating system. 261 261
Now the last thing I want to talk 262 262
about is the fact that there are many other as a services. 263 263
Now for the CySA+ exam, 264 264
you only need to know the three we just talked about, 265 265
but I think it's also important to talk 266 266
about security as a service. 267 267
This provides your organization 268 268
with various types of security services 269 269
without the need to maintain a cybersecurity staff. 270 270
Now, why is it that I'm bringing up security as a service? 271 271
Well, you're getting certified 272 272
to be a cybersecurity analyst. 273 273
Where might you work one day? 274 274
You might work for security as a service. 275 275
Now, security as a service 276 276
can cover a lot of different things. 277 277
It can do anything that really protects the network. 278 278
It can include encryption services, 279 279
incident response services, anti-spam services, 280 280
anti-malware services, and many other things. 281 281
When we talk about security as a service, 282 282
one of the first places it was used 283 283
was really with anti-malware solutions. 284 284
They were one of the first security as a service products. 285 285
Now, as somebody who's going to be in this field, 286 286
it's important for you to understand 287 287
what providers do security as a service. 288 288
Why? 289 289
Because if you look around and find the different providers 290 290
who are doing security as a service, 291 291
that's good places to check if they have job openings 292 292
and see if you can get a position there 293 293
because they're always looking for cybersecurity analysts. 294 294
There's a lot of places do instant response as a service. 295 295
They do monitoring as a service, logging as a service, 296 296
and all of this falls under security as a service, 297 297
so if you work for one of these companies, 298 298
you can use your newfound skills as a cybersecurity analyst.