Networking and Cloud Security Concepts · Topic 3 of 3
Cloud Security
Cloud characteristics, IaaS, PaaS and SaaS, public, private, hybrid and community clouds, the shared responsibility model, data residency and shadow AI.
- 3 min
- Includes a diagram
- Five characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.
- IaaS, PaaS, SaaS: the customer manages less as you move up.
- Public, private, hybrid and community deployments.
What it is
Cloud computing delivers computing resources over the network on demand. It changes who runs what: some security work moves to the provider, but the customer always keeps important responsibilities. CC tests the basic vocabulary and the shared responsibility model.
How it works
Cloud characteristics
| Characteristic | Meaning |
|---|---|
| On-demand self-service | Customers provision resources themselves, without waiting for staff |
| Broad network access | Services are reachable over the network from many devices |
| Resource pooling | The provider shares resources among many customers (multitenancy) |
| Rapid elasticity | Resources scale up and down quickly with demand |
| Measured service | Use is metered and billed |
Service models
| Model | Provider manages | Customer manages | Example |
|---|---|---|---|
| IaaS (infrastructure) | Hardware, network, virtualization | Operating system, applications, data, access | Rented virtual machines, including GPU servers for AI |
| PaaS (platform) | Infrastructure plus operating system and platform | Applications or models, data, access | Managed databases, machine-learning platforms |
| SaaS (software) | Almost everything | Data and user access | Email, CRM, hosted AI assistants |
Deployment models
| Model | Meaning |
|---|---|
| Public | Shared provider infrastructure open to many customers |
| Private | Used by one organization, on premises or hosted |
| Hybrid | A mix of public and private, connected |
| Community | Shared by organizations with common needs, such as government agencies |
Shared responsibility
The split depends on the service model, but the customer always remains responsible for its data and who can access it. In SaaS, the customer secures the data it enters and user access. In IaaS, it also patches and secures the operating system and software. For a server in its own data center, the company secures every layer.
Moving to the cloud never moves accountability for your data. If a question asks what the customer must still protect in SaaS, the answer is its data and user access.
Cloud risks to know
| Risk | Meaning |
|---|---|
| Misconfiguration | Storage left open to the internet, weak access settings |
| Data residency | Data stored or processed in a country where it is not allowed |
| Vendor lock-in | Difficulty moving to another provider |
| Concentration risk | Several services depend on the same provider, so one outage hits them all |
| Shadow IT and shadow AI | Staff using cloud or AI services the organization has not approved |
A cloud access security broker (CASB) discovers unapproved cloud services and enforces policy on them. A data processing agreement states how a provider may use customer data, for example whether it can be used to train the provider's AI models.
How the exam asks about this
- "Which characteristic lets resources scale quickly with demand?" Rapid elasticity.
- "What must the customer secure in a hosted AI assistant (SaaS)?" Its data and user access.
- "Prompts are processed in data centers abroad, but records must stay in one country." Data residency.
What to remember for the exam
- Five characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.
- IaaS, PaaS, SaaS: the customer manages less as you move up.
- Public, private, hybrid and community deployments.
- The customer always owns its data and access.
- CASB finds shadow IT and shadow AI; contracts govern how providers use your data.
"The provider is certified" does not mean your configuration is secure. Many cloud data exposures come from customer misconfiguration.
Common mistakes
Assuming the provider secures your data in every model.
Confusing PaaS and SaaS responsibilities.
Forgetting where data is processed when laws restrict location.
Check yourself
In IaaS, who patches the operating system?
The customer.
What is concentration risk?
Several services depending on the same provider, so one failure affects them all.
Which tool discovers unapproved cloud services in use?
A cloud access security broker (CASB).
Topic 3 of 3 in Networking and Cloud Security Concepts
Test yourself on Networking and Cloud Security Concepts
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.