Cloud service models (IaaS, PaaS, SaaS)

Cloud service models are the ways cloud is delivered, as infrastructure (IaaS, Infrastructure as a Service), platform (PaaS, Platform as a Service) or software (SaaS, Software as a Service), and each sets how far the customer stays responsible for its own security. Special Publication 800-145 of NIST (National Institute of Standards and Technology), dated September 2011, runs only a few pages and remains the reference that contracts, regulators and policies cite. It defines cloud by five characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), then by its service models. In IaaS, the provider rents out compute, storage and network; the customer runs the operating system, the applications, the data and a good share of the filtering rules. In PaaS, the provider also runs the operating system and the runtime, and the customer deploys its code. In SaaS, the customer uses an application and controls little beyond its accounts, permissions and data. The responsibility boundary moves back at each layer, and it is what sorts the claim. A database exposed on an IaaS instance is a configuration error by the insured, which falls under its own data breach cover. A SaaS application outage is an event at the provider, which points to dependent business interruption or a cloud outage clause. Real offerings spill over the grid, though: a managed database, a serverless function or an AI model served by API (application programming interface) mix the layers, and it is the provider's contract, more than the acronym, that says who applies the patches. A questionnaire that asks "do you use the cloud?" therefore measures nothing. What tells you something is the service model of the critical applications, and the name of whoever administers their identities.