-: Cloud computing also comes
as four different types of services
according to the Security+ exam.
I like to refer to these
by the generalized term of as a service
because as you're going to see,
everything in the cloud is something as a service.
The four types you need to be aware of
are Software as a Service,
Infrastructure as a Service,
Platform as a Service,
and Security as a Service.
With Software as a Service,
you're going to be provided with a complete solution.
This includes the hardware, the operating system,
the software, the applications,
everything that's needed for that service to be delivered.
For example, if you use Office 365 for Microsoft,
this is considered Software as a Service,
and it allows your end users to access their email,
their Word documents, their PowerPoint presentations,
and all of that directly from within their web browser.
Sometimes, though, you're going to have
to build a customized piece of software
to meet your particular service needs.
In this case, you might only need the service provider
to give you the hardware, the operating system,
and the backend server software.
With Infrastructure as a Service,
you get the benefit of this dynamic allocation
of additional resources known as elasticity,
but you don't have to deal with the headache
of long-term commitments and contracts, buying the hardware,
and installing the underlying operating systems.
For example, you might want a contract
for a new cloud-based web host
to host your company's website upon.
The server might be built and hosted
by the cloud service provider,
and come with a pre-installed Linux operating system
and an Apache web server.
Now, your programmers can simply create
a custom application for your customers
that's run on top of this web server
without having to worry
about the underlying operating system and hardware.
The third type of service is called Platform as a Service.
Under this model, the third party vendor
will provide your organization
with all the hardware and software needed
for a specific service to operate.
For example, if your company is developing a new piece
of software, they might have a development platform
that's provided by a third-party cloud provider.
This might be an example of Platform as a Service.
Now, if we want to summarize these three types,
remember that Infrastructure as a Service,
you're provided with everything you need to run a server,
including the power, the space, the cooling,
the network, the firewalls, the physical servers,
and the virtualization layer.
With Platform as a Service,
the operating system and the infrastructure software
is added to that list I just gave you.
Now, infrastructure software includes things
like an Apache web server, a MySQL database,
programming languages, and lots more.
With Software as a Service,
the hosted application software is added
to the top of this infrastructure and platform portions.
As you can see, Software as a Service is much closer
to your end user than either Platform as a Service,
or Infrastructure as a Service.
Now, at the beginning of this lesson,
I said that there was four types of as a service
that you had to know for the exam.
The fourth one is Security as a Service.
This allows smaller organizations
that don't have the necessary security skills
to essentially outsource them to some larger company.
This can provide them with a lower cost
than trying to hire a team of cybersecurity professionals
to work directly for your organization.
It can give your company an immediate security expertise,
and you can outsource common tasks
and provide the organization's
information technology staff
with a simple interface that they can use.
One of the first security services that began
to be offered in the cloud was anti-malware products.
Instead of installing a traditional antivirus
or anti-malware program on your desktop or your server,
the client was instead configured to utilize the cloud
to provide these protections.
There's a couple of advantages to doing this.
First, it removed the need for installing an antivirus
or anti-malware solution on your end client.
Instead, a small utility was installed.
This utility uses very little processing power
and is always up-to-date
with the latest signatures and definitions.
This is the true power of a cloud-based solution.
Because as soon as the provider
creates a signature for a piece of malware,
all of its registered clients immediately have access
to that new signature and protection.
Unfortunately, though,
there are some downsides to using this approach.
The main one is that it's highly reliant
on a good Internet connection.
Because the scanning engine resides in the cloud
and relies on its processing power,
your machine may be vulnerable when it's offline.
Some of these cloud services are configured
to only scan portions of the computer, as well.
This means that it might look at the core Windows files,
but not all of your users' documents and file storage.
One of the most effective forms
of Security as a Service solutions
is found in the form of anti-spam products.
These products allow all of the organization's email
to be routed through this cloud server first
in order to detect any malware or spam.
Any suspect emails are placed in a quarantine area
that's accessible through a web browser
by the local administrator for review
and possible release to the end user.
Another great cloud-based security solution
that you can utilize is vulnerability scanning.
With traditional vulnerability scanners,
you perform the scan from within your own network.
With the cloud-based scanner, though,
you have the option of using it from within your network
or from the Internet, simulating an attacker's perspective.
There are many advantages to this approach.
First, the installation costs are lower.
Second, your maintenance costs are also lower.
This is because the cloud service provider
is responsible for providing all
of the hardware and software that's necessary
for you to conduct these scans.
Also, the vulnerability scanners always remain up-to-date
under this paid service subscription model.
In most organizations, vulnerability scanners
aren't used 24 hours a day, seven days a week,
so there's a lot of wasted time here.
By utilizing a cloud service provider,
the equipment can be shared across multiple organizations,
and that cost is distributed
amongst all of those clients, saving you money.
Unfortunately, though, there is one major disadvantage here.
Because scanning is being conducted
from the cloud provider's system,
the vulnerability data may be stored
on their systems, as well.
This is the same data that shows all
of your vulnerabilities that are open to exploitation
and therefore, the security of this data
should be a top concern for your organization.
Another security technique that can be provided
by cloud services is the use of sandboxing.
Sandboxing utilizes separate virtual networks
to allow security professionals
to test suspicious or malicious files.
For example, if your organization is conducting
an incident response, your responders
could place a piece of malware
in a cloud-hosted sandboxed environment
to see the effects of the malware as it's run in real time.
This will allow them to do a dynamic analysis of it.
Another type of thing you can do is content filtering.
This is another example of possible security services
that a cloud provider might offer you.
When your organization signs up for content filtering,
all of your organization's traffic
will be diverted from your network
to the cloud provider through a VPN
prior to going out to the larger Internet.
The provider then can be able to give you the ability
to create policies such as time limits,
categories of content that should be blocked,
as well as reporting to see any users
who are attempting to access the websites
that are on your block list.
As you can see, there are a lot
of different options that you should consider
when dealing with cloud-based security offerings.
Other services can include things like data loss prevention,
continuous monitoring, access control,
identity management, business continuity,
disaster recovery, and many others.
If you continue on into your cybersecurity career,
at some point you might even find yourself working
for one of these Security as a Service providers.