Domain 4 of 5 · Chapter 3 of 3

Understand Cloud Security

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Cloud computing as one model
  • The five essential characteristics
  • Service models: IaaS, PaaS and SaaS
  • Deployment models: public, private, community, hybrid
  • The shared responsibility model
  • Responsibilities the customer always keeps
  • Hosting AI solutions in the cloud
  • Incident response with a cloud provider
  • Planning for cloud service interruptions
  • Security testing in the cloud

IaaS vs PaaS vs SaaS: what the customer controls

AspectIaaSPaaSSaaS
What the customer receivesProcessing, storage and networks to run any softwareA provider-run platform to deploy its own applicationsThe provider's finished application
Customer managesOperating systems, storage, deployed applications and some network controls such as host firewallsIts deployed applications and settings for the hosting environmentLimited user-specific application settings
Provider managesPhysical infrastructure and virtualizationPhysical infrastructure, operating systems and the platformEverything up to and including the application
Typical scenarioA server whose operating system the team hardens and patchesAn in-house web application deployed without managing serversHosted email used as delivered
Customer keeps in every modelData, accounts and access, configuration, endpointsData, accounts and access, configuration, endpointsData, accounts and access, configuration, endpoints

Decision tree

Distinct clouds bound togetherfor data and application portability?Hybrid cloudmembers stay distinctYesNoOpen to the general public?Public cloudanyone may subscribeYesNoExclusive to a singleorganization?Private cloudone organization, on or off premisesCommunity cloudorganizations with shared concernsYesNoLocation alone never decides the model: a private cloud can be off premises
Cheat sheet

Cheat sheet

  • On-demand self-service lets consumers provision resources without provider staff handling each request
  • Broad network access makes cloud capabilities available through standard network mechanisms
  • Resource pooling dynamically shares provider capacity among consumers
  • Rapid elasticity expands and releases capacity as demand changes
  • Measured service makes cloud resource consumption visible through metering
  • IaaS gives the consumer control of operating systems and deployed applications
  • PaaS lets consumers deploy applications without administering the underlying platform
  • SaaS provides an application for the consumer to use
  • Public cloud infrastructure is available for use by the general public
  • A private cloud is dedicated to one organization even when hosted elsewhere
  • A community cloud serves a defined group of organizations with shared concerns
  • A hybrid cloud connects distinct clouds while preserving their identities
  • The responsibility split must be checked for the specific cloud offering
  • The cloud provider protects the underlying infrastructure it operates
  • Customers remain responsible for deciding who may access their cloud resources
  • Moving data to the cloud does not remove the customer's accountability for its protection
  • Customer-controlled configuration can expose data even on secure provider infrastructure
  • Using a cloud service does not transfer security of customer endpoints to the provider
  • Cloud incident response requires a defined handoff between customer and provider
  • Cloud customers must plan for interruption of the services they depend on
  • A cloud subscription does not authorize testing of the provider's underlying infrastructure

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  2. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf
  3. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf
  4. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-146.pdf
  5. https://media.defense.gov/2024/Mar/07/2003407863/-1/-1/0/CSI-CloudTop10-Shared-Responsibility-Model.PDF
  6. https://media.defense.gov/2020/Jan/22/2002237484/-1/-1/0/CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF
  7. https://www.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model
  8. https://cloudsecurityalliance.org/blog/2023/07/28/generative-ai-proposed-shared-responsibility-model
  9. https://media.defense.gov/2024/Apr/15/2003439257/-1/-1/0/CSI-DEPLOYING-AI-SYSTEMS-SECURELY.PDF
  10. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
  11. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-210.pdf