Security Architecture · Topic 1 of 7
Cloud and Infrastructure Models
Security+ architecture models: cloud deployment models, multicloud, serverless, IaC, OT, on premises, air gaps, microservices and segmentation.
- 6 min
- Includes a diagram
- The customer always owns its data and access settings, whatever the cloud model.
- In IaaS the customer manages the operating system. In PaaS the provider does. In SaaS the provider manages the whole application.
- Public, private, community and hybrid are the four deployment models.
What it is
Architecture models describe where systems run and how they are built. Each model changes who is responsible for security and where the risks sit.
This page compares cloud, on premises, operational technology (OT) and air gapped designs. The key skill is knowing what each model gains and what new risk it brings.
How it works
Cloud and shared responsibility
In every cloud model the provider and the customer share the work of security. The more of the stack the provider runs, the less the customer manages.
| Layer | Infrastructure as a service (IaaS) | Platform as a service (PaaS) | Software as a service (SaaS) |
|---|---|---|---|
| Physical data center | Provider | Provider | Provider |
| Operating system | Customer | Provider | Provider |
| Application | Customer | Customer | Provider |
| Data, accounts and access settings | Customer | Customer | Customer |
The customer always remains responsible for its own data and for who can access it. This split is often written down as a responsibility matrix.
Cloud deployment models
| Model | Description | Security point |
|---|---|---|
| Public | Shared infrastructure run by a provider for many customers | Tenants share hardware, so isolation and configuration matter |
| Private | Cloud infrastructure used by one organization | More control, but the organization carries more cost and work |
| Community | Shared by several organizations with common needs, such as government agencies | Members must agree on policy and share the risk |
| Hybrid | A mix of two or more models, often private or on premises plus public | Needs secure links and the same policy on both sides |
Multicloud means using services from more than one cloud provider. It reduces dependence on a single provider, but each provider has its own tools, settings and identity model, so misconfiguration is easier.
Serverless
Serverless computing lets you run code as functions without managing servers, because the provider handles the underlying systems. The customer still secures its code, the permissions each function has and the data it touches.
Infrastructure as code
Infrastructure as code (IaC) defines servers, networks and settings in text files that tools apply automatically. It makes builds repeatable, consistent and reviewable. A mistake in the code is copied to every build, so the code needs review and scanning like any software.
Microservices
Microservices split an application into small, independent services that talk through application programming interfaces (APIs). A fault or breach in one service can be contained without taking down the rest.
The trade off is that more services mean more connections to protect. Authentication between services and API security matter more than in a single large application.
On premises infrastructure
On premises infrastructure is hardware owned and run by the organization in its own buildings. It gives full control of the systems and data. The organization also carries the full cost and the full security workload, from physical security to patching.
Operational technology
Operational technology (OT) is hardware and software that monitors and controls physical processes, such as factory lines, power grids and water treatment. It includes industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems and programmable logic controllers (PLCs).
In OT, safety and availability usually come before confidentiality. Systems often run old software for many years and cannot be patched without stopping the process. The usual response is to isolate them, limit connections and monitor their traffic.
Air gapped networks and segmentation
| Approach | How it separates | Example |
|---|---|---|
| Air gapped network | No network connection to other networks at all | A sensitive control system or offline backup |
| Physical segmentation | Separate cables, switches and devices for each network | A dedicated OT network on its own hardware |
| Logical segmentation | Shared hardware, separated by virtual local area networks (VLANs), subnets and firewall rules | Guest Wi-Fi on its own VLAN |
An air gap gives the strongest isolation, but data still crosses it on removable media, which can carry malware. Logical segmentation is cheaper and flexible, but a configuration mistake can join the segments again.
How the exam asks about this
- "A company wants to share a cloud with three partner hospitals that have the same compliance rules." -> Community cloud.
- "A web app is being split into small services that each deploy on their own." -> Microservices, with API security between the services.
- "A plant controller cannot be patched and must never lose its connection to the process." -> Isolate it with segmentation and monitoring, not a forced patch.
What to remember for the exam
- The customer always owns its data and access settings, whatever the cloud model.
- In IaaS the customer manages the operating system. In PaaS the provider does. In SaaS the provider manages the whole application.
- Public, private, community and hybrid are the four deployment models.
- Multicloud uses several providers, which reduces lock in but adds configuration risk.
- Serverless removes server management, not code or permission security.
- IaC makes builds repeatable, so errors repeat too unless the code is reviewed.
- Microservices contain faults but add API connections to protect.
- OT puts safety and availability first and is protected mainly by isolation.
- An air gap and physical segmentation separate by hardware. Logical segmentation separates by configuration.
For a responsibility question, start at the bottom of the stack and move up. The provider takes more layers as you go from IaaS to SaaS.
Common mistakes
Assuming SaaS removes all customer responsibility. The customer still manages users, permissions, data classification and configuration.
Confusing hybrid with multicloud. Hybrid mixes deployment models, such as on premises and public cloud. Multicloud uses more than one cloud provider.
Treating serverless as having no security work. The provider runs the servers, but code flaws and excessive permissions are still the customer's problem.
Thinking an air gap needs no other controls. Removable media and maintenance laptops can still carry malware across the gap.
Applying office IT rules to OT. Rebooting a controller for a patch may stop a physical process, so change windows and testing are stricter.
Hybrid and multicloud links are part of the attack surface. Protect them like any other entry point.
Check yourself
In which cloud model does the customer manage the operating system?
Infrastructure as a service (IaaS).
What is a community cloud?
A cloud shared by several organizations with common needs, such as the same compliance rules.
What is the difference between physical and logical segmentation?
Physical segmentation uses separate hardware for each network, while logical segmentation separates traffic on shared hardware with VLANs, subnets and firewall rules.
Topic 1 of 7 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.