We talk a lot about the cloud, and yet it isn’t the most well-understood technical paradigm in business. Most of us are just comfortable or happy to say that “we are on the cloud” and let it go at that. But cloud computing is an immensely robust industry and understanding the differences in available services and products could help you navigate compliance, security and business operations more effectively and efficiently. 

Here we will break down some of the basics of cloud computing and infrastructure. 

What is Cloud Computing?

“Cloud computing” or “the cloud” are buzzwords these days, and for good reason: most modern IT infrastructure is built on cloud technology. However, let’s define this term as it applies to most companies working in regulated industries.

Cloud computing is the use of distributed computing resources or services over internet connections in a “cloud” configuration to increase resiliency and availability while lowering costs. 

This type of computing configuration can actually refer to several types of very common computing functions:

1. Storage: Cloud storage is common, and the most well-known cloud service around. Providers like Google and Dropbox bring large and robust cloud storage to enterprises and consumers alike to increase file recovery, storage space and resiliency against data loss.
2. Computing: Users can actually harness computing power from hosted servers in a cloud environment. Using cloud computing means that you can perform computationally intensive tasks on a shared server without having to field an entire configuration. This kind of computing has changed how businesses access things like machine learning and AI.
3. Services: With advances in real-time web communication and programming languages, many cloud providers offer built-in web apps that mimic already-existing software. Commonly we see this through products like office suites and image editing, but it also extends into things like on-prem security and analytics, logging and compliance. 

Cloud computing is offloading what has typically been limited to on-premises infrastructure. 

What are the Types of Cloud Environments?

You will traditionally see cloud computing divided up into three distinct environments:

1. Public (or “Shared”) Cloud: The most common form of cloud service, public clouds are shared services offered by a provider to multiple users at the same time. Your data will live on a server with other user’s data, even if there is security and SIEM separation between the two. Microsoft and Google are the most well-known public cloud providers.
2. Private Cloud: This type of cloud is when you host a cloud in your business. As in, the servers and infrastructure are located on your premises or several of them in the case of distributed systems. Some providers will also offer private cloud services for increased pricing. You won’t share any server space with other users.
3. Hybrid Cloud: This setup uses a mix of public and private to allow you the flexibility of public infrastructure with secure, and private, cloud space. This can help you stay more responsive in terms of costs, security, compliance and integration with outside vendors and users.

What kind of cloud you need to use depends on your requirements? The public cloud, secured and evaluated, can serve well for most business uses. That being said, some industries (and some client or customer bases) call for private or hybrid cloud environments for handling critical data and creating trust. 

Cloud Computing Products as a Service

When people describe something as “a service”, what they mean is that the provider, in this case, called a Managed Service Provider (MSP), uses cloud computing to offer services that typically would only come as on-prem software solutions. Cloud service can provide real flexibility and resiliency by offloading infrastructural requirements to a dedicated provider without sacrificing quality. 

Several “service” categories relate to different applications:

1. Software as a Service (SaaS): The most common, SaaS refers to the offering of software, typically using a web browser, through the cloud. The most popular of these in the consumer space is probably Google Docs or Dropbox. However, software in the business space to edit images, manage data through analytics dashboards and other complex procedures are also commonly available.
2. Platforms as a Service (PaaS): One step above SaaS, PaaS gives users access to entire operating systems like Windows Server or Linux over the cloud. This way, they can run complex applications, web services or server configurations on a powerful and secure server without having to invest in that infrastructure on their own.
3. Infrastructure as a Service (IaaS): Infrastructure as a Service is exactly what it sounds like: subscribing to servers and virtual machines to build up your own systems, security, programs, operating systems, and so on.
4. Functions as a Service (FaaS): Also known as microservices, this smaller form of cloud computing gives you a small environment within which you can build and run code. Instead of renting out an entire server, you can simply build an app or a small piece of code and pay per execution of that code piece.

Within this hierarchy, many services fall between SaaS and PaaS. One important one that has emerged in the last 10-15 years is Managed Security Services (MSSPs) that provide security and compliance management and auditing over cloud infrastructure. This can include SaaS automated compliance and audit machines, SOC and NOC functions as a service, and more. 

Compliance and Cloud Services

With the increased reliance on cloud services, compliance is always a question. Most cloud providers are themselves compliant when working within a specific industry. So, for example, an MSP offering services to federal agencies will be FedRAMP compliant. 

That means that if you are also working in that industry, and you want to utilize cloud services as part of that work, compliant providers are critical to maintaining your own compliance. Note that outside of some specific examples, you are required to verify your vendors are compliant. If you do not, then you face the penalties of non-compliance. 

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.