Cloud Concepts, Architecture and Design · Topic 1 of 5
Cloud Computing Concepts and Reference Architecture
CCSP cloud basics: NIST and ISO definitions, cloud roles, essential characteristics, building blocks, service categories and deployment models.
- 5 min
- Includes a diagram
- NIST SP 800-145 lists five essential characteristics; ISO/IEC 17788 adds multi-tenancy.
- Customer, provider and partner are the ISO/IEC 17789 roles; a broker adds value between customer and providers.
- Customer responsibility grows from SaaS to PaaS to IaaS; provider responsibility grows the other way.
What it is
Cloud computing is a way of delivering IT resources as a metered service from a shared pool. NIST SP 800-145 defines it as a model for convenient, on-demand network access to a shared pool of configurable resources that can be provisioned and released quickly with minimal management effort. ISO/IEC 17788 gives the international vocabulary and ISO/IEC 17789 gives the reference architecture.
The exam expects you to know these definitions, the roles involved, and how service categories and deployment models change who controls what. Everything else in the CCSP builds on this page.
How it works
Essential characteristics
| Characteristic | Meaning | Security angle |
|---|---|---|
| On-demand self-service | The customer provisions resources without human interaction with the provider | Shadow IT; needs governance of who can provision |
| Broad network access | Reachable over standard networks from many device types | Larger attack surface; strong authentication |
| Resource pooling | Provider serves many customers from shared resources | Isolation between tenants |
| Rapid elasticity and scalability | Capacity grows and shrinks quickly, often automatically | Controls must scale too; cost attacks |
| Measured service | Usage is metered and billed | Metering data is also an audit source |
| Multi-tenancy | Several customers share the same infrastructure | Data leakage between tenants |
NIST lists five characteristics. ISO/IEC 17788 adds multi-tenancy as a sixth key characteristic, which is why the CCSP outline includes it.
Roles and responsibilities
| Role | Who it is |
|---|---|
| Cloud service customer (CSC) | The organization that uses the service and owns the data |
| Cloud service provider (CSP) | The organization that makes the service available |
| Cloud service partner | Supports the provider or customer, for example a developer, auditor or integrator |
| Cloud service broker | Adds value between customer and providers: aggregation, integration, negotiation |
| Regulator | A public body whose rules both parties must follow |
NIST SP 500-292 also names the cloud auditor and the cloud carrier (the network connectivity provider). The customer can delegate tasks to the provider but cannot delegate accountability for its data.
Building block technologies
Cloud services are built from virtualization (hypervisors, containers), storage (block, object, file), networking (software defined networks, virtual switches), databases and orchestration, the automation layer that provisions and coordinates all of the others through the management plane.
Cloud computing activities
ISO/IEC 17789 describes activities for each role. Typical customer activities include using and monitoring the service, administering users and tenancies and requesting audit reports. Typical provider activities include preparing and operating systems, managing assets, providing audit data, handling customer requests and ensuring compliance.
Partners design and build service components, perform audits or broker services.
Capability types and service categories
ISO/IEC 17789 groups what a customer can do into three capability types: application capabilities (use the provider's applications), platform capabilities (deploy and run the customer's own applications using the provider's languages and tools) and infrastructure capabilities (provision processing, storage and networking).
| Category | Customer controls | Provider controls |
|---|---|---|
| IaaS | Guest OS, middleware, applications, data, much network configuration | Facility, hardware, hypervisor, physical network |
| PaaS | Applications, data, application configuration | Everything up to and including the runtime |
| SaaS | Data, user access, application settings offered to it | The whole stack, including the application |
ISO/IEC 17788 also names other categories, such as network as a service and data storage as a service, but the exam focuses on the three above.
Deployment models
| Model | Description | Typical reason |
|---|---|---|
| Public | Open to any customer, owned and run by a provider | Cost, scale, speed |
| Private | Used by a single organization, on or off premises | Control, regulatory need |
| Community | Shared by organizations with common concerns | Shared compliance, for example government agencies |
| Hybrid | Two or more distinct models bound by technology that allows portability | Keep sensitive workloads private, burst to public |
| Multi-cloud | Services from more than one provider | Avoid lock-in, best service per need, resilience |
Multi-cloud and hybrid are not the same: hybrid mixes deployment models, while multi-cloud mixes providers, which may all be public.
A worked example
A hospital wants a patient scheduling system. It has no developers, needs the system in weeks, and must keep patient data protected under health regulation. A SaaS scheduling product fits the speed and skills constraint.
The security architect notes that the provider now runs the application, but the hospital still decides who gets accounts, what data is entered and whether the provider's controls are sufficient. The contract and the provider's audit reports become the main control evidence.
How the exam asks about this
- "Which characteristic MOST directly creates the risk of one customer's data being exposed to another?" Multi-tenancy, with resource pooling.
- "A company runs a private cloud and bursts to a public provider at peak load. Which model is this?" Hybrid cloud.
- "In PaaS, who is responsible for securing the application code?" The cloud service customer.
What to remember for the exam
- NIST SP 800-145 lists five essential characteristics; ISO/IEC 17788 adds multi-tenancy.
- Customer, provider and partner are the ISO/IEC 17789 roles; a broker adds value between customer and providers.
- Customer responsibility grows from SaaS to PaaS to IaaS; provider responsibility grows the other way.
- Hybrid combines deployment models; multi-cloud combines providers.
- Orchestration through the management plane ties the building blocks together.
Responsibility can be shared, but accountability for data stays with the cloud service customer, whatever the service category.
Common mistakes
Calling any hosted server "cloud". A virtual machine rented by monthly contract with no self-service, metering or elasticity is hosting, not cloud.
Assuming SaaS means zero customer duties. In SaaS the customer still manages identities, data and the settings the application exposes.
Mixing up hybrid and multi-cloud. Two public providers is multi-cloud; hybrid needs at least two different deployment models.
Check yourself
Which characteristic does ISO/IEC 17788 add to the NIST list?
Multi-tenancy, the sharing of physical and virtual resources by several customers whose data and processing are kept isolated.
What does a cloud service broker do?
It adds value between customers and one or more providers, for example by aggregating, integrating or negotiating services.
In IaaS, who patches the guest operating system?
The cloud service customer, because the provider's responsibility stops at the hypervisor and physical infrastructure.
Topic 1 of 5 in Cloud Concepts, Architecture and Design
Test yourself on Cloud Concepts, Architecture and Design
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.