Cloud Service Models (IaaS, PaaS, SaaS)

Overview

Understanding cloud service models is fundamental to implementing ISO 27017 effectively. Each service model—Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)—has distinct characteristics, security implications, and responsibility distributions that directly impact how security controls are applied.

Learning Objectives

By the end of this lesson, you will be able to:

• Define and differentiate between IaaS, PaaS, and SaaS service models
• Understand the security responsibilities for each service model
• Identify appropriate use cases for each model
• Recognize the security implications of each model
• Apply ISO 27017 controls appropriately based on service model
• Make informed decisions about service model selection

The Cloud Service Model Hierarchy

Visual Representation

Traditional IT    IaaS           PaaS           SaaS
┌────────────┐   ┌────────────┐  ┌────────────┐  ┌────────────┐
│Applications│   │Applications│  │Applications│  │Applications│ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│   Data     │   │   Data     │  │   Data     │  │   Data     │ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│  Runtime   │   │  Runtime   │  │  Runtime   │  │  Runtime   │ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│Middleware  │   │Middleware  │  │Middleware  │  │Middleware  │ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│    O/S     │   │    O/S     │  │    O/S     │  │    O/S     │ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│Virtualiz'n │   │Virtualiz'n │  │Virtualiz'n │  │Virtualiz'n │ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│  Servers   │   │  Servers   │  │  Servers   │  │  Servers   │ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│  Storage   │   │  Storage   │  │  Storage   │  │  Storage   │ ◄── Provider
├────────────┤   ├────────────┤  ├────────────┤  ├────────────┤
│ Networking │   │ Networking │  │ Networking │  │ Networking │ ◄── Provider
└────────────┘   └────────────┘  └────────────┘  └────────────┘
 You Manage       You Manage     You Manage     You Manage
     All           Top Layers    Top 2 Layers   Data/Config

Infrastructure as a Service (IaaS)

Definition

IaaS provides fundamental computing resources over the internet. Customers rent virtualized hardware resources including servers, storage, and networking components, and have control over operating systems, storage, and deployed applications.

Key Characteristics

Common IaaS Services

Compute Services:

• Virtual machines (VMs)
• Bare metal servers
• Container hosting
• Auto-scaling groups

Storage Services:

• Block storage (virtual hard drives)
• Object storage (file storage)
• Archive storage
• Backup services

Network Services:

• Virtual networks
• Load balancers
• DNS services
• VPN gateways
• Firewalls and security groups

IaaS Providers Examples

Security Responsibilities in IaaS

Cloud Service Provider Responsibilities:

• Physical security of data centers
• Network infrastructure security
• Hypervisor security and isolation
• Hardware maintenance and replacement
• Power and cooling systems
• Physical access controls
• Infrastructure monitoring

Cloud Service Customer Responsibilities:

• Operating system security and patching
• Application security
• Data encryption (at rest and in transit)
• Identity and access management
• Network security configuration (firewalls, security groups)
• Backup and disaster recovery
• Compliance and governance
• Vulnerability management
• Security monitoring and logging

IaaS Security Controls (ISO 27017)

Critical Controls for IaaS Customers:

1. A.9.4.4 - Use of privileged utility programs

   • Restrict access to virtualization management tools
   • Implement privileged access management

2. A.12.3.1 - Information backup

   • Configure automated backup solutions
   • Test restoration procedures regularly

3. A.13.1.1 - Network controls

   • Configure virtual firewalls and security groups
   • Implement network segmentation

4. A.14.2.1 - Secure development policy

   • Secure configuration of virtual machines
   • Use hardened OS images

5. A.18.1.3 - Protection of records

   • Ensure data residency compliance
   • Implement audit logging

IaaS Use Cases

Ideal Scenarios:

• Development and testing environments
• High-performance computing workloads
• Big data analytics
• Disaster recovery sites
• Custom application hosting
• Organizations requiring full control over infrastructure

Example: Enterprise Application Migration

Scenario: Large retailer migrating e-commerce platform to cloud

IaaS Choice Factors:
✓ Custom application stack requiring specific OS versions
✓ Need for fine-grained security controls
✓ Compliance requirements for data handling
✓ Existing investment in application licenses
✓ In-house expertise in system administration

Implementation:
- Deploy virtual machines with custom OS configurations
- Configure network security groups for multi-tier architecture
- Implement encryption for data at rest using customer-managed keys
- Set up automated backup and disaster recovery
- Integrate with existing identity management systems

Platform as a Service (PaaS)

Definition

PaaS provides a complete development and deployment environment in the cloud. Customers can develop, run, and manage applications without dealing with the underlying infrastructure complexity. The provider manages the operating system, middleware, and runtime environment.

Key Characteristics

Common PaaS Services

Application Platforms:

• Web application hosting
• API management platforms
• Mobile backend services
• Serverless computing (Functions as a Service)

Database Services:

• Managed relational databases (MySQL, PostgreSQL, SQL Server)
• NoSQL databases (MongoDB, Cassandra, DynamoDB)
• In-memory databases (Redis, Memcached)
• Data warehousing services

Development Tools:

• Continuous integration/deployment (CI/CD)
• Version control systems
• Development frameworks
• Testing environments

Integration Services:

• Message queues
• Event streaming
• API gateways
• Enterprise service buses

PaaS Providers Examples

Security Responsibilities in PaaS

Cloud Service Provider Responsibilities:

• All IaaS-level responsibilities
• Operating system security and patching
• Middleware security
• Runtime environment security
• Platform service security
• API security
• Database engine security (for DBaaS)
• Service availability and resilience

Cloud Service Customer Responsibilities:

• Application code security
• Application-level access controls
• Data encryption configuration
• Secure API design and implementation
• Application-level logging and monitoring
• Secure configuration of platform services
• Data classification and handling
• Application-level backup strategies

PaaS Security Controls (ISO 27017)

Critical Controls for PaaS Customers:

1. A.14.1.1 - Information security requirements analysis

   • Understand platform security features
   • Verify compliance capabilities

2. A.14.2.1 - Secure development policy

   • Implement secure coding practices
   • Use platform security features appropriately

3. A.9.1.2 - Access to networks and network services

   • Configure application-level access controls
   • Implement authentication and authorization

4. A.10.1.1 - Policy on use of cryptographic controls

   • Enable encryption features provided by platform
   • Manage encryption keys appropriately

5. A.12.4.1 - Event logging

   • Configure application and platform logging
   • Integrate with security monitoring systems

PaaS Use Cases

Ideal Scenarios:

• Rapid application development
• API development and management
• Microservices architectures
• Event-driven applications
• Applications with variable workloads
• Teams wanting to focus on code, not infrastructure

Example: Startup SaaS Application

Scenario: Startup building a project management SaaS application

PaaS Choice Factors:
✓ Small team focused on feature development
✓ Need for rapid iteration and deployment
✓ Variable user load requiring auto-scaling
✓ Limited infrastructure expertise
✓ Cost-effective for early stage

Implementation:
- Use managed application platform for web tier
- Leverage managed PostgreSQL database
- Implement serverless functions for background jobs
- Use platform authentication services
- Configure automated scaling policies
- Integrate platform logging with security monitoring

Software as a Service (SaaS)

Definition

SaaS provides complete, ready-to-use application software over the internet. Customers access applications through a web browser or API without managing any underlying infrastructure, platform, or application code. The provider manages everything except user data and configuration.

Key Characteristics

Common SaaS Categories

Productivity and Collaboration:

• Email and calendaring (Microsoft 365, Google Workspace)
• Document collaboration
• Video conferencing
• Project management

Business Applications:

• Customer Relationship Management (CRM)
• Enterprise Resource Planning (ERP)
• Human Resources Management Systems (HRMS)
• Financial management

Specialized Applications:

• Marketing automation
• Customer support systems
• Learning management systems
• Security and compliance tools

SaaS Providers Examples

Security Responsibilities in SaaS

Cloud Service Provider Responsibilities:

• All IaaS and PaaS-level responsibilities
• Application security
• Application availability and performance
• Multi-tenant isolation
• Data storage security
• Application-level access controls
• Compliance certifications
• Security updates and patches
• Data backup and recovery
• Incident response

Cloud Service Customer Responsibilities:

• User access management
• User authentication configuration
• Data classification
• Appropriate use of the application
• User training and awareness
• Configuration security
• Data input validation
• Third-party integration security
• Monitoring user activities
• Compliance with terms of service

SaaS Security Controls (ISO 27017)

Critical Controls for SaaS Customers:

1. A.9.2.1 - User registration and deregistration

   • Implement proper user lifecycle management
   • Regular access reviews

2. A.9.2.2 - User access provisioning

   • Follow least privilege principle
   • Use role-based access control

3. A.9.4.1 - Information access restriction

   • Configure data access controls properly
   • Implement data classification

4. A.18.1.4 - Privacy and protection of PII

   • Understand data processing agreements
   • Configure privacy settings appropriately

5. A.15.1.1 - Information security policy for supplier relationships

   • Review SaaS provider security certifications
   • Evaluate service level agreements

SaaS Use Cases

Ideal Scenarios:

• Standard business processes (email, CRM, HR)
• Rapid deployment requirements
• Limited IT resources
• Predictable, recurring workloads
• Need for global accessibility
• Focus on business functions, not technology

Example: Enterprise Email Migration

Scenario: 5,000-employee company migrating from on-premises email to SaaS

SaaS Choice Factors:
✓ Standard email functionality sufficient
✓ High availability requirements (99.9% SLA)
✓ Global workforce needing access anywhere
✓ Desire to reduce IT infrastructure costs
✓ Need for modern collaboration features

Implementation:
- Configure single sign-on with corporate identity provider
- Set up data loss prevention (DLP) policies
- Configure email retention policies for compliance
- Implement multi-factor authentication
- Train users on security features
- Establish monitoring for suspicious activities

Comparing Service Models

Comprehensive Comparison Matrix

Security Control Distribution

Hybrid and Multi-Cloud Scenarios

Combining Service Models

Modern organizations often use multiple service models simultaneously:

Example Architecture:

┌─────────────────────────────────────────────────┐
│              Organization's Cloud Strategy       │
├─────────────────────────────────────────────────┤
│ SaaS: Microsoft 365 (Email, Office)             │
│       Salesforce (CRM)                           │
│       Workday (HR)                               │
├─────────────────────────────────────────────────┤
│ PaaS: Azure App Service (Web applications)      │
│       AWS Lambda (Serverless functions)          │
│       Google Cloud SQL (Managed database)        │
├─────────────────────────────────────────────────┤
│ IaaS: AWS EC2 (Legacy applications)             │
│       Azure VMs (Development environments)       │
│       GCP Compute (Analytics workloads)          │
└─────────────────────────────────────────────────┘

Security Considerations for Multi-Model Environments

Challenges:

• Consistent security policy enforcement
• Centralized identity and access management
• Unified monitoring and logging
• Complex compliance requirements
• Data flow between services

Best Practices:

• Implement cloud access security broker (CASB)
• Use federated identity management
• Centralize security monitoring (SIEM)
• Establish data classification standards
• Create comprehensive cloud governance framework

Decision Framework: Choosing the Right Service Model

Decision Tree

Start: What is your primary objective?

├─ Need custom infrastructure control?
│  └─ YES → IaaS
│      Examples: Custom apps, specific OS, compliance requirements
│
├─ Need development platform without infrastructure management?
│  └─ YES → PaaS
│      Examples: Web apps, APIs, microservices
│
└─ Need ready-to-use business application?
   └─ YES → SaaS
       Examples: Email, CRM, HR, collaboration tools

Evaluation Criteria Checklist

Technical Requirements:

• Level of customization needed
• Specific technology stack requirements
• Integration with existing systems
• Performance and scalability needs
• Data residency requirements

Organizational Factors:

• In-house technical expertise
• IT staff availability
• Budget constraints
• Time to deployment
• Risk tolerance

Security and Compliance:

• Regulatory requirements
• Data sensitivity level
• Required security controls
• Compliance certifications needed
• Audit and reporting requirements

Operational Considerations:

• Maintenance capabilities
• Update and patch management preferences
• Disaster recovery requirements
• Availability requirements (SLA)
• Vendor lock-in concerns

ISO 27017 Implementation by Service Model

IaaS Implementation Priority

High Priority Controls:

1. Virtual machine security configuration
2. Network security groups and firewalls
3. Encryption key management
4. Backup and recovery procedures
5. Privileged access management
6. Vulnerability scanning and patching

PaaS Implementation Priority

High Priority Controls:

1. Secure application development practices
2. API security and authentication
3. Platform-specific security configurations
4. Application-level monitoring
5. Data protection in managed services
6. Secure CI/CD pipelines

SaaS Implementation Priority

High Priority Controls:

1. User access management
2. Single sign-on (SSO) configuration
3. Data loss prevention (DLP)
4. User activity monitoring
5. Third-party app permissions
6. Data export and portability

Common Pitfalls and How to Avoid Them

IaaS Pitfalls

PaaS Pitfalls

SaaS Pitfalls

Real-World Case Studies

Case Study 1: Financial Services - Multi-Model Approach

Organization: Regional bank with 200 employees

Implementation:

• SaaS: Microsoft 365 for productivity, Salesforce for CRM
• PaaS: Azure SQL Database for customer data, App Service for web apps
• IaaS: Azure VMs for legacy core banking system

Security Approach:

• Unified identity management via Azure AD
• Data classification across all services
• Centralized monitoring with Azure Sentinel
• Segregation of duties based on service model
• Regular third-party audits

Results:

• 30% reduction in infrastructure costs
• Improved regulatory compliance posture
• Enhanced security visibility
• Faster application deployment

Case Study 2: Healthcare Provider - PaaS Focus

Organization: Multi-location healthcare provider

Challenge: HIPAA compliance while modernizing applications

Solution: PaaS-centric architecture

• AWS Elastic Beanstalk for patient portal
• Amazon RDS for patient data (encrypted)
• AWS Lambda for automated workflows
• Amazon S3 for medical image storage

ISO 27017 Controls Implemented:

• Encryption at rest and in transit
• Detailed access logging
• Regular security assessments
• Business associate agreements
• Disaster recovery with geographic redundancy

Outcome:

• HIPAA compliance maintained
• 99.95% application uptime
• Reduced security incidents by 45%
• Improved patient experience

Case Study 3: E-commerce - IaaS Flexibility

Organization: Growing online retailer

Requirements:

• PCI DSS compliance for payment processing
• Custom application stack
• High-performance requirements
• Seasonal scalability

Implementation: IaaS on Google Cloud Platform

• Compute Engine for application servers
• Cloud SQL for product catalog
• Cloud Load Balancing
• Cloud Armor for DDoS protection

Security Measures:

• Network segmentation (DMZ, application, data tiers)
• Custom firewall rules
• Regular vulnerability assessments
• Encrypted data storage
• Comprehensive audit logging

Benefits:

• PCI DSS Level 1 certification achieved
• Ability to scale 10x during peak season
• Full control over security configurations
• Cost-effective resource utilization

Key Takeaways

1. Three distinct service models - IaaS, PaaS, and SaaS each serve different needs with varying levels of control and responsibility

2. Shared responsibility model - Security responsibilities shift based on service model, with customers always responsible for data

3. IaaS provides maximum control - Best for custom requirements but requires the most management overhead

4. PaaS balances control and convenience - Ideal for development-focused teams wanting to avoid infrastructure management

5. SaaS minimizes complexity - Best for standard business functions with minimal customization needs

6. Multi-model strategies are common - Organizations typically use a combination of service models

7. Security controls must match the model - ISO 27017 implementation varies significantly by service model

8. Decision framework is essential - Systematic evaluation of technical, organizational, and security factors guides model selection

Preparation for Next Lesson

In the next lesson, we'll explore the Shared Responsibility Model in detail, including:

• Detailed breakdown of responsibilities by service model
• How to document and communicate responsibilities
• Common misunderstandings and gaps
• Contractual and compliance implications
• Best practices for managing shared security

Self-Assessment Questions

1. What are the three primary cloud service models defined in ISO 27017?
2. In IaaS, who is responsible for operating system security?
3. What layer of the stack do PaaS customers primarily manage?
4. Name three examples of SaaS applications commonly used in enterprises.
5. Which service model provides the highest level of customization?
6. What is the primary security responsibility for SaaS customers?
7. How does the shared responsibility model differ between IaaS and SaaS?
8. What factors should influence the choice of service model?
9. What are the main security challenges in a multi-model cloud environment?
10. Which service model requires the most in-house technical expertise?

Practical Exercise

Scenario: You are advising a healthcare organization on their cloud strategy. They have:

• A custom electronic health records (EHR) system
• Need for email and collaboration tools
• Want to develop a patient portal
• Strict HIPAA compliance requirements

Task:

1. Recommend appropriate service models for each need
2. Justify your recommendations
3. Identify key security controls for each
4. Outline the organization's security responsibilities

This lesson has provided comprehensive coverage of cloud service models. Understanding these models is crucial for applying ISO 27017 controls appropriately in different cloud environments.