Cloud Security · Topic 2 of 6
Cloud Models, NIST 800-145 and Cloud Access Security Broker
Learn the NIST 800-145 cloud definitions, public, private, hybrid and community models, IaaS, PaaS and SaaS, and how a CASB secures cloud app use.
- 4 min
- NIST 800-145 defines five essential characteristics, three service models and four deployment models.
- The service models are IaaS, PaaS and SaaS.
- The deployment models are public, private, community and hybrid.
What it is
NIST Special Publication 800-145 gives the standard definitions of cloud computing, and a CASB is the control point for how people use cloud services.
The definitions let everyone use the same words for the same things. They name the essential characteristics, the service models and the deployment models. A cloud access security broker then adds visibility and policy between users and cloud applications.
How it works
Know the NIST vocabulary first, and then see where each security solution fits.
Essential characteristics
NIST lists five characteristics that make a service cloud computing.
- On-demand self-service: users provision resources without human help.
- Broad network access: services are available over the network from many device types.
- Resource pooling: the provider shares resources between many customers.
- Rapid elasticity: resources scale up and down quickly.
- Measured service: use is metered, so you pay for what you use.
Service models
| Model | You get | Example idea |
|---|---|---|
| IaaS | Virtual machines, storage and networks | A virtual server you manage yourself |
| PaaS | A platform to build and run applications | A managed database or application runtime |
| SaaS | A finished application | Webmail or a customer relationship tool |
As you move from IaaS to SaaS, the provider manages more, and the customer has less to configure. Each model needs different security controls. IaaS needs host and network protection, and SaaS needs control of users and data.
Deployment models
| Model | Who uses it | Key point |
|---|---|---|
| Public | The general public or many organisations | Owned and run by a provider, shared infrastructure |
| Private | A single organisation | Can be run on site or by a third party |
| Community | A group with shared concerns, such as a regulated sector | Shared by several organisations with common needs |
| Hybrid | Two or more of the above | Linked together, with portable data and applications |
A hybrid cloud is the usual real world case, and it creates a security challenge. Policy, identity and visibility must be consistent across the on-premises and cloud parts. Connectivity between them, such as VPN or private links, also has to be protected.
Why a CASB exists
Staff adopt cloud applications without asking IT, and that is called shadow IT. Data then leaves the network where traditional controls cannot see it. A CASB sits between users and cloud services to restore control.
The four CASB functions
| Function | What it does |
|---|---|
| Visibility | Discovers which cloud apps are used, and rates their risk |
| Compliance | Checks use against regulations and policy |
| Data security | Applies DLP, encryption and sharing controls |
| Threat protection | Detects account takeover, malware and abnormal behaviour |
How a CASB is deployed
A CASB gets its view of the traffic in one of three ways.
| Mode | How it works | Notes |
|---|---|---|
| API based | Connects to the SaaS application API | Sees data at rest and activity, with no impact on user traffic |
| Forward proxy | Users send traffic through a proxy | Works for any app, but needs the traffic to be steered through it |
| Reverse proxy | The proxy sits in front of the application | Can enforce on unmanaged devices, but needs a change to the sign in flow |
Many designs combine API and proxy modes. The API mode reads data that is already in the SaaS app, and proxy modes can act in real time on traffic. Cisco offers API based CASB capability, and Cisco Secure Access also provides cloud application controls.
Choosing a solution
Match the solution to the model.
- IaaS: workload protection, network controls and configuration checks.
- SaaS: a CASB and strong identity controls.
- Hybrid cloud: a way to manage policy consistently.
What to remember for the exam
Six facts cover most questions on this topic.
- NIST 800-145 defines five essential characteristics, three service models and four deployment models.
- The service models are IaaS, PaaS and SaaS.
- The deployment models are public, private, community and hybrid.
- Shadow IT is the use of cloud services without approval.
- The four CASB functions are visibility, compliance, data security and threat protection.
- CASB modes are API based, forward proxy and reverse proxy.
If a question asks about finding unapproved cloud apps, the answer is CASB visibility or discovery.
Common mistakes
These four mistakes appear often.
Confusing community and hybrid clouds. Community is shared by organisations with common needs, and hybrid joins different cloud types.
Thinking a CASB replaces a firewall. A CASB focuses on cloud application use, not general network filtering.
Relying on API mode alone. API mode does not control traffic in real time, so a proxy may also be needed.
Ignoring identity. A CASB cannot help if attackers sign in with valid stolen credentials, so combine it with MFA.
A CASB can only protect the services it is connected to or can see. Unknown applications remain a risk until you discover them.
Check yourself
Work through these three questions.
Which four deployment models does NIST 800-145 define?
Public, private, community and hybrid.
What is shadow IT, and which CASB function addresses it?
Shadow IT is cloud use without IT approval, and the visibility function of a CASB discovers it.
What are the three CASB deployment modes?
API based, forward proxy and reverse proxy.
Topic 2 of 6 in Cloud Security
Test yourself on Cloud Security
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.