While many open systems interconnection have similar functions and so may have similar security needs, most will restrict your authority over the components – to some extent in order to decrease overall administration cost. As a result, many organisations will require a new approach to evaluate security and compliance.
If you’re just starting up with cloud services or diversification your public cloud offers, it’s critical to think about your security and compliance needs for each new service you add to your portfolio. Let’s taking a description of the various most prevalent business solutions and their related security needs for individuals who aren’t familiar with these acronyms.
IaaS (Infrastructure as a Service)
IaaS (Infrastructure as a Service) is when a cloud provider hosts the infrastructure components that would normally be found in an on-premises data centre, such as servers (operating systems), storage and networking gear, and the virtualization or hypervisor layer.
This option comes the closest to traditional in-house IT infrastructure in terms of security. As a result, it will need many of the same security technologies.
But, because IaaS server instances may “come and go” dynamically, tools that recognize/are aware of the infrastructure’s hosted state may offer considerable benefits (taking advantage of ease of doing so in a hosted environment). This means, for example, that licensing and data recording should be flexible enough to record compliance state for a “spun up” virtual machine that is brought online for only a few hours before being withdrawn without incurring ongoing licence charges.
PaaS (Platform as a Service)
The PaaS (Platform as a Service) model essentially expands on the IaaS paradigm since, in addition to the basic infrastructure services outlined above, the service provider will host and administer traditional operating systems, middleware, and other applications for its users.
Because they offer pre-baked setups, PaaS facilitates workload deployment. As a result, administrators may have less freedom in creating the environment they desire, including certain security solutions that may be acceptable for your specific security and compliance goals.
Because security technologies may be built into the service, PaaS alters the security model in other ways as well. This can be a difficulty for IT shops that employ a mix of PaaS and conventional infrastructure to ensure that coverage is consistent across devices. Compliant teams, in especially, should make sure that any needed security choices (especially those related to authentication, in my experience) remain available and configured consistently. When it comes to analysing your whole estate to ensure there are no gaps, compliance technologies that let you do so in both settings will offer you a major edge.
SaaS (Software as a Service)
Finally, Cloud services will maintain and manage whole IT infrastructures, including apps. In effect, a SaaS user does not install anything; instead, they log in and utilise the provider’s application instance, which is hosted on the provider’s infrastructure. Because the SaaS provider is responsible for the application’s ground-up setup, this often limits the extent of customisation but considerably minimises the “configuration surface area” for apps.
Although there is mostly less awareness into security choices with SaaS, this should not mean that they should be ignored. It’s still critical to make sure compliance and security evaluations don’t just assume security “works.” Both during the initial service composition and to ensure that appropriate information is accessible, care must be given.
What is the Difference Between IaaS, PaaS and SaaS?
It’s critical that your appropriate mechanisms technologies address these concerns. The days of just ensuring that “antivirus is installed on all machines” are long gone. Instead, each type of service may need a unique methodology to account for its unique strengths and shortcomings. If your present security tool doesn’t or can’t provide assessment capability for services maintained by your cloud provider, this may need a lot of extra “research” before making buying choices to guarantee that teams can show compliance of the toolset(s) to certain requirements.
One last problem with all of the above-mentioned tools is achieving consistent assessment reporting, which the present providers, in my opinion, have not fully “solved” (though they are certainly working on it). Many teams are now building their own technical support to pull together many data sources and give a single large overview or consistent detailed reporting; this is critical to make services easily accessible across the organisation. However, I am optimistic that future manufacturers will use the APIs available on all these platforms to give reporting insights that meet this demand.
