-: Cloud computing isn't a single thing, though,
because there are many different ways to implement the cloud.
For the Security+ exam,
you should know that there are four different cloud types.
Public, private, hybrid, and community.
The most common type of cloud architecture
is the public cloud.
Under this model, a service provider makes resources
available to the end user over the Internet.
There are numerous public cloud solutions available today,
including those from Google, Microsoft, and Amazon.
For example, Google Drive is a public cloud service
that's offered both as a free and pay-for-use model.
Public clouds can often be an inexpensive way for
an organization to gain the required capability
and service they need quickly and efficiently.
The second option is what's known as a private cloud.
This service requires that a company create its own
cloud environment that only it can utilize as an internal
enterprise resource to manage its cloud.
With a private cloud, your organization is responsible
for the design, implementation and operation of the
cloud resources, and the servers that host them.
For example, the United States Government runs a
private cloud for use by different organizations
within the government.
But my company and yours can't get access to it,
like we could with Google Drive.
Generally, a private cloud is chosen when security is
more important to the organization than cost.
A hybrid cloud solution combines the benefits of both
the public cloud and the private cloud options.
Under this architecture, some resources are developed
and operated by the organization itself like a private
cloud would be, but the organization can also utilize
the publicly-available resources or outsource services
to another service provider like a public cloud does!
Because of this mixture of private and public cloud
resources, strict rules should be applied for what type
of data is hosted in each portion of this hybrid cloud.
For example, any confidential information should always
be hosted on the organization's private cloud portion.
Our fourth option is known as a community cloud.
Under this model, the resources and cost are shared
among several different organizations who have a common
service need. This is similar to taking several private
clouds and connecting them together.
Now, the security challenge here is that each organization
may have their own security controls.
Remember, if you connect your network to another network,
you inherit their security risks, as well.
This doesn't change just because we've moved
to the cloud environment.
So, which of these four models or combination of models
is right for your organization?
Well, there's no clear-cut answer
because it really depends on your security needs,
your cost restrictions, and your risk tolerance.
Generally, it's cheapest to use a public cloud model,
but this also increases the risk to your information's
confidentiality and availability.
Well, there's many other things you need to consider as
a security practitioner. There is going to be no single right
answer here. Instead, it's our job to weigh the benefits
and the drawbacks of each of these models to decide
which one is right for our organization's security needs
and their concerns.