Intro

In this video, we explore all aspects of cloud computing: benefits, required characteristics, principles, service models, deployment models, and key cloud roles. You can download the script for this video from above or at the end of the video.

What is the Cloud?

There are various definitions of cloud computing. However, I base the content in this video on the NIST standards. We begin with the overall definition of cloud computing from NIST SP 800-145. "Cloud computing is a model for enabling ubiquitous convenient on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction this cloud model is composed of five essential characteristics three service models and four deployment models." Take a moment to digest this before we break this down and dive into each component.

Cloud Benefits

There are two significant benefits associated with cloud use: agility and cost containment. Agility is the ability of an organization to respond to market and industry outages. It enables a business to quickly seize new opportunities and increase profits. In the ISC(2) cloud immersion training, ability is represented by the formula BUSINESS AGILITY = NEW OPPORTUNITIES + GROWTH. Failure to make IT changes in order to make meet frequent changes and market conditions, increasing interconnectedness of business entities and services, new laws, and political conditions will cause an organization to lose competitive advantage. Agility can come with increased costs. However, cloud computing can help drive down the costs of change. As we cover later, the required characteristics of cloud services provide the means to quickly implement solutions and scale them as needed, and only pay for what you use. This can be done with little to no capital expense.

Cloud Characteristics

According to the NIST, a cloud service should possess five characteristics in order to be considered a true cloud solution: resource pooling, rapid elasticity, on-demand self-service, broad network access, and measured service. Let's look at each of these. In traditional data centers, it purchases a set of resources for each system, for example sales, would have a database server and one or more application servers. Regardless of the amount of processing power used, these resources are dedicated to a single purpose. This often results in a significant amount of unused processing resources. Further, the amount of resources allocated to sales efforts is fixed, so if additional resources are quickly needed, it isn't easy to expand the processing or storage power.

Resource Pooling

With resource pooling, the cloud service provider or CSP enables a sharing of resources across multiple consumer organizations. I will use the term "consumer" to indicate a user of cloud services. This is known as the multi-tenant model. This enables full use of all resources without resource purchase and maintenance costs for the consumer.

Rapid Elasticity

Resource pooling also enables rapid elasticity. For example, if the consumer has a big sales event, the resources used by the sales system can be quickly increased for the period of the sale. When no longer needed the additional resources are removed. Rapid elasticity can enable the addition or reduction of resources within minutes, whereas traditional data center implementations might take weeks to implement. Further, adding data center infrastructure for occasional sales leaves a lot of resources idle when not needed. Depending on the CSP agreement, changes in resource use might be automatic based on measured use.

Measured Service

Paying for only what you use requires accurately measuring what cloud resources a consumer actually uses. This is the role of measured service. In our previous sales example, the consumer would pay for the increase in resources for only as long as needed. Again, this reduces the cost of data center capital costs related to implementing standby systems. Measured service is particularly useful when the resources needed are automatically provided by metered increases or decreases in usage. If a consumer contracts with a CSP for automatic adjustments to allocated resources, alerts can be sent to the consumer when resources are added or costs increased.

On-Demand Self-service

On-demand self-service is closely related to rapid elasticity. Individuals authorized by the consumer can contact the CSP and quickly bring up needed resources... or take them down. Again, this contrasts with the weeks it might take to purchase, receive, configure, and implement data center resources.

Broad Network Access

Broad network access provides consumer, customer, employee, partner, and supplier access to needed resources from anywhere at any time. It does this with high guaranteed uptimes and support for all types of user devices.

Cloud Deployment Models

Now let's look at cloud deployment models. Consumers can use one or more deployment models: private, community, public, or hybrid. The model used depends on the security of the data and the services needed for employees and customers.

Private Cloud

A private cloud is exclusively used by a single organization. Access is highly controlled, and the infrastructure can be in the data center, hosted by a third party, or both. Private clouds are a good choice for data center implementation. Datacenter implementations are still reasonable for organizations that already have infrastructure on-site and to adequately manage the risk associated with highly sensitive information. Private clouds, which can also be hosted in the cloud, enable more customization because the resources are not shared with other consumers. This lack of resource pooling also increases infrastructure costs. However, security is stronger because multi-tenancy is not present. Take a moment and look at the advantages and disadvantages of private cloud implementation.

Public Cloud

According to VMware, "a public cloud is an IT model where on-demand computing services and infrastructure are managed by a third-party provider and shared with multiple organizations using the public internet." In other words, a public cloud is a pool of computing, storage, and network resources located at and managed by a CSP. The resources are shared by any number of consumers in an approach known again as multi-tenancy. The resources controlled by the CSP and those controlled by the consumer depend on the cloud service models involved. We discuss cloud service models shortly. Public cloud resources are shared by multiple consumers and are commonly used for application hosting, application development, application testing, base infrastructure hosting, file sharing, and email services. This table shows the advantages and disadvantages of public cloud use. The advantages, time reduction, cost-effectiveness, and pay-as-you-go scalability. Disadvantages are higher security risks, network performance can suffer from instability, and the lack of customization capabilities.

Community Cloud

Community cloud is created, managed, and used by a group of consumers with common interests, concerns, and needs. It's owned and operated by one or more members of the community, and it may be hosted by a third party. Access is restricted to authorized members of the community. Community clouds are often used by universities and law enforcement agencies. They support cooperation integration of infrastructure, integration of resources, inter-organizational projects, and shared use of resources.

Hybrid Cloud

A single consumer might have a need for both a private and a public cloud. Integration of these clouds is usually needed, and this makes hybrid clouds a combination of multiple cloud implementation models the most difficult to create and manage. Each cloud is surrounded and managed with both standardized and proprietary technology. Integration requires data portability and risk overall attack surface security. This is why a cloud broker is often needed. I describe the cloud broker role later in this video. This table shows the advantages and disadvantages of hybrid cloud use. The advantages include flexibility and control, cost-effectiveness, and enhanced organizational agility. The disadvantages are requires more maintenance, initial costs, and data and application integration. Most of these are the same as a private cloud except for the data and application integration... that is... that can be a very difficult thing to do, and it can be difficult to manage security across that integration.

Cloud Service Models

CSP cloud deployment agreements with consumers determine the services provided. These services generally fall into one of three cloud service models: IaaS, PaaS, SaaS. When subscribing to cloud services, the consumer can choose between three service models. IaaS, PaaS, SaaS. The technology included in each of these models, and who is responsible for security across each, depends on the CSP's offerings and what the consumer can negotiate into the service agreement. In general, the consumer is responsible for the security associated with the technology not supplied by the CSP. In addition, the consumer can never relinquish its responsibility for overall governance of all data collected, stored, and processed in the cloud. Finally, the consumer is responsible for defining user roles and managing user access. IaaS, or infrastructure as a service, provides the basic hardware needed to deploy operating systems, databases, and applications. PaaS goes further by providing everything needed for application development and hosting. Third-party applications can also be deployed by the consumer. The CSP may provide programming interfaces, languages, libraries, and other development tools. In addition to what is provided by IaaS, PaaS also provides operating systems, middleware, and other runtime tools. SaaS adds applications and data management for those applications.

Cloud Roles

Now let's look at roles. We've already looked at two of the roles: cloud service provider and consumer. The two new roles are cloud broker and service auditor.

Cloud Broker

The cloud broker helps consumers select, implement, and manage cloud services. This is especially true when a consumer is implementing a hybrid cloud environment. Selecting the right cloud service providers, integrating secure connectivity between the clouds, and managing overall security is where the broker comes in. The broker usually provides a catalog of services provided by itself and by affiliated services. To summarize, a broker provides service intermediation: helping to select the right service providers. Service aggregation: helping to securely integrate existing and new services and data flows; and service arbitrage: ensuring the services continue to meet customer expectations.

Service Auditor

The service auditor is a third party that checks service provider outcomes, including security, against what the consumer expects. This requires ensuring that the service agreements clearly state what the consumer expects from the CSP services, not just what services are provided.

Cloud Service Expectations

Expectations must include security and uptime. When listing expectations in an agreement, it's important for a consumer to understand and consider at least six things. They are also challenges that organizations should address in service agreements and SLAs, including data portability, data ownership, key management, e-discovery, resource isolation, and security. Data portability is the ease with which a consumer can either share data or move the data to another service provider.

Data Ownership

Data ownership addresses how much control the consumer has over the data, including where it's stored. For example, a CSP might store a US-based consumer's data offshore. Is this something the consumer accepts, based on the data classification and regulatory constraints? It also applies to logs and other data created by processing and network activities. The question the consumer has to ask about each data set is who is control of how it's used, where is it stored, and how it's managed throughout its life cycle?

Key Management

Key management is important for keeping data encrypted, allowing access when and where needed and enabling key changes when necessary. In a cloud environment, Who stores the keys? Who manages the key management system? Who has access to the keys? What happens if access to the key management system fails?

e-Discovery

E-discovery is the process of locating, tagging, and preserving information as part of court orders and procedures. While tools exist to make this possible for datacenter resources, how will e-discovery processes work across cloud instances? Who is responsible for enabling e-discovery, and how will a CSP help ensure preservation of covered resources?

Resource Isolation

Resource isolation is part of any security program, and it's critical for organizations moving to a zero-trust model. Remember that resource sharing in the cloud usually means that multiple consumers use the same processing, storage, and network resources. An organization must ask questions about how the CSP separates one consumer from another. In many cases, a private cloud is a better choice for highly classified and highly categorized information resources and infrastructure.

Security

Security is a shared responsibility. The consumer is always responsible for overall governance. This is why I include in an agreement a requirement that the CSP must comply with my security policies in a way acceptable to both my organization and provider. This may not always be possible, and we may have to use compensating controls, but it's a good baseline to work from. Finally, security responsibilities differ based on the service models used, and this I describe in the video above. It's important to understand and document exactly what the CSP is responsible for and monitor compliance with audits. That's it for this lesson. If you have questions, please ask. ...and until next time be careful what you click