In this video, we walk through 5 ISC practice questions on cloud computing models and deployment. These questions are from ISC content area 1 on the AICPA CPA exam blueprints: Information Systems and Data Management.
The best way to use this video is to pause each time we get to a new question in the video, and then make your own attempt at the question before watching us go through it.
Cloud Computing Models and Deployment
Before any of the risk, control, or SOC reporting content makes sense, three things have to be clear: what makes an arrangement a cloud in the first place, what the provider is handing over, and who else is using the same environment.
What Cloud Computing Is
Cloud computing means renting computing resources over the internet instead of buying and running the equipment yourself. The servers, storage, and software sit in a provider’s data center, and the customer pays for what it uses rather than for hardware it owns.
An arrangement qualifies as cloud computing only if all five of these essential characteristics are present:
- On-demand self-service: the customer obtains resources by itself, at any time, without asking a person at the provider to set it up
- Broad network access: those resources are reachable over a network from ordinary devices rather than from one specific computer
- Resource pooling: the provider combines its equipment into a shared pool and assigns pieces of it to customers as they need it, then reassigns those pieces later
- Rapid elasticity: capacity grows and shrinks quickly as demand changes
- Measured service: usage is metered, so what the customer consumes is tracked, reported, and billed
Missing one means the arrangement is something else, regardless of how a vendor markets it. A hosted product that requires calling an account manager to add capacity fails on-demand self-service no matter what it is called.
The Four Layers
Every business system has four layers stacked on each other. At the bottom is the physical equipment: the machines, the storage, the room they sit in, the power and cooling. Above that is the operating system, the software that makes a machine usable and that needs security updates every month. Above that is the business software, whatever the company actually works in. At the top is the data.
Those four layers are always there. The only question is who is responsible for each one, and that is exactly what the service models answer.
The Service Models
The three models differ only in how far up the stack the provider goes.
- Infrastructure as a Service (IaaS): the provider supplies the equipment. The customer supplies the operating system, the software, and the data. The most control, and the most remaining work.
- Platform as a Service (PaaS): the provider supplies the equipment and the operating system. The customer supplies software it wrote itself, plus the data. This is the model for a company building its own application rather than running one it bought.
- Software as a Service (SaaS): the provider supplies the equipment, the operating system, and the software. The customer supplies only the data. Gmail, QuickBooks Online, Salesforce, and Workday are all examples.
Control and convenience trade against each other across the three. A company running a legacy application with unusual configuration requirements needs Infrastructure as a Service, because that is the only model that lets it choose and configure the operating system. A company that just wants working accounting software takes Software as a Service and accepts whatever settings the vendor offers.
One responsibility never moves. Under all three models, the customer owns its data and decides who has access to it. Setting up user accounts, deciding who can post journal entries versus who can only view reports, and removing access when someone leaves are the company’s job in every model.
Deployment Models
Deployment models answer a separate question: who else uses the same environment.
- Public: the provider rents shared infrastructure to anyone. Unrelated organizations run on the same equipment, kept apart by the provider’s software. Cheapest and most elastic.
- Private: the environment serves one organization and nobody else. More expensive, since that organization pays for capacity whether it uses it or not.
- Community: several organizations with the same requirements, usually regulatory, share an environment built to meet them.
- Hybrid: two of these connected together so work can move between them, typically keeping sensitive material private and running everything else publicly.
Private cloud means exclusive use rather than ownership. A provider can own the equipment and dedicate it to a single customer, and a company that owns its own servers is not automatically running a private cloud. The environment still has to meet all five essential characteristics before the question of who shares it comes up at all.
Service models and deployment models are also independent of each other. Any service model can run on any deployment model, so a scenario has to be read for both: how far up the stack the provider goes, and who else shares the environment.
