Cloud Service Models

Firms that pursue public cloud technologies generally can pursue three different models depending on their needs: Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). Each type entails a different level of service provided by the cloud service provider:¹⁶

• Infrastructure as a Service (IaaS): IaaS refers to a self-service model for accessing basic IT services such as data storage, compute, and networking. These services are typically delivered over the internet via virtualization technology and are highly scalable. The user does not manage the underlying IT infrastructure but does control the layers of technology that run on top, such as the operating system and applications. IaaS essentially provides a flexible hardware resource that can scale rapidly and elastically in response to augmented storage and computational processing needs.¹⁷
   
• Platform as a Service (PaaS): PaaS builds upon IaaS, in which the cloud provider provides an on-demand environment of tools (such as programming languages and libraries) and software for application testing and development. PaaS is also delivered over the internet, thus enabling a virtual product development platform that resides on top of the IaaS layer. In this services model, again the user does not control the underlying infrastructural services nor some of the additional layers, such as the operating system and application tools but has control over the applications that are being developed and deployed.¹⁸
   
• Software as a Service (SaaS): SaaS is a full-service model enabling firms to avail themselves of the full stack of cloud services to distribute software on-demand over the internet to end users. SaaS builds upon PaaS by completing the final step after application development to launch the final product over the web straight to users. In a SaaS model, the cloud provider manages all the layers of software and hardware necessary to host, develop and launch new applications. The firm has the least control of the underlying services and infrastructure and is effectively renting a full IT stack from the cloud provider.¹⁹
   
• Other Services: Many other types of services are emerging in the cloud computing environment. One example is Function as a Service (FaaS)²⁰ where applications can run in a “container”²¹ that limits the need to account for complexities associated with separate operating system (e.g., Windows or Linux).

The following diagram sketches out the various layers of technology offered by cloud providers according to different models. As can be seen in the below Figure 1: Cloud Pyramid, cloud services form a stack, with SaaS built at the top. Division of responsibilities between user and provider also shifts as additional services are added between IaaS and SaaS. At the IaaS level, the cloud service provider manages the infrastructural services but manages the entire stack at the SaaS level. This division of responsibility has important implications for identifying who has what responsibility for securely operating in the cloud, as will be explored later.