Table of Contents Cloud Delivery Models
Infrastructure as a Service (IaaS)
IaaS provides infrastructure to run applications on a pay-per-use basis.
- Scalability – easily adjust resources based on demand.
- Pay-as-you-go – pay only for the processing power, disk space, and computing resources you use.
- Abstracted infrastructure – users don’t need to manage hardware, data partitioning, scaling, security, or backup.
- Control – the cloud provider manages the infrastructure, while users can deploy, manage, and scale services.
Example: Hosting virtual machines and storage in the cloud.
Platform as a Service (PaaS)
PaaS offers a cloud-based development environment where developers can build and deploy applications without managing underlying infrastructure.
- No hardware concerns – developers don’t need to worry about processors, memory, or OS compatibility.
- Browser-based tools – development tools are hosted in the cloud and accessed online.
- Easy deployment – applications can be deployed without system administration expertise.
- Payment model – customers pay for the platform and related distribution services.
Example: Google App Engine provides a scalable platform for developing and hosting web applications.
Software as a Service (SaaS)
SaaS delivers software applications online on a subscription or pay-per-use basis.
- No installations – applications are accessible directly from the web.
- Reduced maintenance – customers don’t need to worry about patches, upgrades, or OS compatibility.
- Cost savings – instead of purchasing software and licenses, businesses rent software.
- Business productivity – SaaS provides ready-to-use apps like word processing, spreadsheets, CRM, etc.
Example: Salesforce.com offers cloud-based business applications that can be customized on demand.
Cloud Security Vulnerabilities
While cloud delivery models offer flexibility and cost benefits, they also introduce security risks.
1. Attacks on IaaS
- Hackers may rent virtual machines (VMs), analyze configurations, and exploit vulnerabilities.
- Attackers can target other customers’ VMs in the same cloud.
- Example: Brute-force attacks leverage IaaS computing power to crack passwords.
2. Data Loss
Data is at risk in all service models:
- SaaS – business data and customer data stored in cloud data centers.
- PaaS – developers may expose sensitive data while testing during the SDLC.
- IaaS – users store data on virtual machine drives that could be accessed by unauthorized employees or hackers.
Both insider threats (intentional or accidental) and external threats (hackers using techniques to breach databases) are major risks.
3. Traditional Network Attacks
- Malicious programs can be uploaded into cloud systems and executed as valid instances.
- Cloud environments are vulnerable to classic network exploits (e.g., injection attacks, worms, malware).
To secure cloud systems, it is critical to identify threats early and implement robust security mechanisms.
