2 cissp ® Official Study Guide Eighth Edition

Platform as a service Platform as a service (PaaS)
is the concept of providing a comput-
ing platform and software solution stack as a virtual or cloud-based service. Essentially, 
this type of cloud solution provides all the aspects of a platform (that is, the operating 
system and complete solution package). The primary attraction of PaaS is the avoidance of 
having to purchase and maintain high-end hardware and software locally.
Software as a service Software as a service (SaaS)
is a derivative of PaaS. SaaS provides 
on-demand online access to specific software applications or suites without the need for 
local installation. In many cases, there are few local hardware and OS limitations. SaaS can 
be implemented as a subscription service (for example, Microsoft Office 365), a pay-as-you-
go service, or a free service (for example, Google Docs).
Infrastructure as a service Infrastructure as a service (IaaS)
takes the PaaS model yet 
another step forward and provides not just on-demand operating solutions but complete 
outsourcing options. This can include utility or metered computing services, administrative 
task automation, dynamic scaling, virtualization services, policy implementation and man-
agement services, and managed/filtered internet connectivity. Ultimately, IaaS allows an 
enterprise to scale up new software or data-based services/solutions through cloud systems 
quickly and without having to install massive hardware locally.
There are many other “X as a service” offerings available in the marketplace, each with 
its own potential vulnerabilities and advantages. Different cloud computing companies may 
define or label their services differently than others. Thus, it is important to carefully com-
pare and contrast providers with what features and options are available from each.
An 
on-premise solution
is the traditional deployment concept in which an organiza-
tion owns the hardware, licenses the software, and operates and maintains the systems 
on its own usually within their own building. On-premises solutions do not have ongo-
ing monthly subscription costs like a cloud service but may be costlier because of initial 
up-front costs of obtaining hardware and licensing and ongoing operational management 
costs. On-premises solutions offer full customization, provide local control over security, 
do not require internet connectivity, and provide local control over updates and changes. 
However, they also require significant administrative involvement for updates and changes, 
require local backup and management, and are more challenging to scale.
A 
hosted solution
is a deployment concept where the organization must license software 
and then operates and maintains the software. The hosting provider owns, operates, and 
maintains the hardware that supports the organization’s software.
A 
cloud solution
is a deployment concept where an organization contracts with a third-
party cloud provider. The cloud provider owns, operates, and maintains the hardware and 

---

Distributed Systems and Endpoint Security 
355
software. The organization pays a monthly fee (often based on a per-user multiplier) to use 
the cloud solution. Most on-premises environments can be crafted or re-created as a cloud-
only solution.
Cloud services can also be offered in a variety of deployment options, including the 
following: