Security Architecture · Topic 1 of 6
Cloud and Infrastructure Models
Security+ architecture models: cloud shared responsibility, hybrid, IaC, serverless, microservices, SDN, containers, virtualization and isolation.
- 4 min
- The customer always owns its data and access settings, whatever the cloud model.
- In IaaS the customer manages the operating system. In PaaS the provider does. In SaaS the provider manages the whole application.
- Hybrid combines on premises and cloud, so policy and connections must match.
What it is
Architecture models describe where systems run and how they are built. Each model changes who is responsible for security and where the risks sit.
This page compares cloud service models, deployment choices and modern design patterns such as serverless, microservices and containers. The key skill is knowing which party must secure which layer.
How it works
Cloud service models and shared responsibility
In every cloud model the provider and the customer share the work of security. The more of the stack the provider runs, the less the customer manages.
| Layer | Infrastructure as a service (IaaS) | Platform as a service (PaaS) | Software as a service (SaaS) |
|---|---|---|---|
| Physical data center | Provider | Provider | Provider |
| Operating system | Customer | Provider | Provider |
| Application | Customer | Customer | Provider |
| Data, accounts and access settings | Customer | Customer | Customer |
The customer always remains responsible for its own data and for who can access it. This is the responsibility matrix, and it is a favorite exam topic.
Deployment choices
| Model | Description |
|---|---|
| Public cloud | Shared infrastructure run by a provider |
| Private cloud | Infrastructure used by one organization |
| Hybrid | A mix of cloud and on premises systems |
| On premises | Hardware owned and run by the organization |
| Centralized | Resources and control in one place, easier to manage |
| Decentralized | Resources spread across locations, fewer single points of failure but harder to manage |
Hybrid designs need secure connections between environments and consistent policy on both sides. Third party vendors also add risk, so their access and security must be assessed.
Infrastructure as code
Infrastructure as code (IaC) defines servers, networks and settings in text files that tools apply automatically. It makes builds repeatable and reviewable. A mistake in the code is copied everywhere, so the code needs review and scanning like any software.
Serverless and microservices
Serverless computing lets you run functions without managing servers, because the provider handles the underlying systems. Microservices split an application into small services that talk through application programming interfaces (APIs).
Microservices increase the number of connections to protect, so API security and authentication between services matter. In serverless designs the customer still secures its code, permissions and data.
Software defined networking
Software defined networking (SDN) separates the control plane (decisions) from the data plane (forwarding) and manages the network from a central controller. It allows fast, consistent policy changes, but the controller becomes a high value target.
Virtualization and containers
| Technology | Key point |
|---|---|
| Virtual machine (VM) | A full guest operating system on a hypervisor, with strong isolation |
| Container | Packages an application and its parts and shares the host kernel, so it is lighter but isolated less strongly |
Container images should come from trusted sources and be scanned for vulnerabilities. Many containers share one host, so a host compromise affects them all.
Network isolation
Physical isolation and air gapped networks keep a system completely disconnected from other networks, which suits very sensitive systems. Logical segmentation uses virtual local area networks (VLANs) and firewalls to separate traffic while sharing the same hardware.
What to remember for the exam
- The customer always owns its data and access settings, whatever the cloud model.
- In IaaS the customer manages the operating system. In PaaS the provider does. In SaaS the provider manages the whole application.
- Hybrid combines on premises and cloud, so policy and connections must match.
- Infrastructure as code makes deployment repeatable but must be reviewed.
- Serverless removes server management. Microservices rely on secure APIs.
- SDN separates control and data planes and uses a central controller.
- Containers share the host kernel. VMs have their own operating system.
- An air gap provides physical isolation, and segmentation provides logical separation.
For a responsibility question, start at the bottom of the stack and move up. The provider takes more layers as you go from IaaS to SaaS.
Common mistakes
Assuming SaaS removes all customer responsibility. The customer still manages users, permissions, data classification and configuration.
Confusing containers with virtual machines. Containers share the host kernel, so isolation is lighter than with a VM.
Treating serverless as having no security work. The provider runs the servers, but code flaws and excessive permissions are still the customer's problem.
Calling decentralized always safer. It reduces single points of failure, but more locations mean more systems to patch and monitor.
Forgetting the SDN controller. If it is compromised, the whole network can be reconfigured.
A responsibility matrix question usually hides a trap in the data row. Data and access are always the customer's duty, even in SaaS.
Check yourself
In which cloud model does the customer manage the operating system?
Infrastructure as a service (IaaS).
What does software defined networking separate?
The control plane, which makes decisions, from the data plane, which forwards traffic.
Why is isolation weaker for containers than for virtual machines?
Containers share the host operating system kernel, while each VM has its own guest operating system.
Topic 1 of 6 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.