CC Week 05

Cloud Computing
Week # 05
1
Previous Week
• Risks and Challenges of Cloud Computing
• Roles and Boundaries of Cloud Computing
• Characteristics of Cloud Computing (Multitenancy, Resiliency)
2
This Week
• IaaS, PaaS & SaaS Provisioning
• IaaS, PaaS & SaaS Comparison
• Software as a Service (SaaS)

• Classes of SaaS
• SaaS Examples
• SaaS Software Stack
• SaaS Benefits
3
IaaS, PaaS & SaaS Provisioning
4
IaaS Provisioning
• IaaS: The IT-resources are typically virtualized and packaged in a

preplanned way.
• The IT-resources are usually freshly instanced e.g., VMs.
• The cloud consumer has a high level of control and
configuration-responsibility.
• The cloud consumer also has the duty of configuring these
resources.
• Sometimes a cloud provider will contract IaaS offerings from
other cloud provider to scale its own cloud environment.
• The VMs can be obtained specifying the hardware
requirements such as processor capacity, memory, storage etc.
PaaS Provisioning
• PaaS: Delivers a programming environment containing

preconfigured tools to support the development lifecycle of
custom applications.
• PaaS products are available with different development
stacks such as Google App Engine provides a Python and
Java environment.
• The PaaS is chosen:
• To enhance or substitute the on-premises software
development environment.
• To create a cloud service in order to provide a cloud
service to other cloud consumers.
PaaS Provisioning
• The PaaS saves the consumer from administrative tasks
such as installations and configurations to set up the
software development infrastructure.
• On the other hand the cloud consumer has lower level of
control over the underlying infrastructure.

SaaS Provisioning
• SaaS: Is the software hosted over cloud infrastructure and

offered as a utility services.
• SaaS is provided as a reusable utility service commercially
available to different users.
• A SaaS can be deployed over IaaS and/or PaaS instance.
Whereby the cloud consumer (of IaaS/PaaS) becomes the
provider.
• The service consumer has a very limited control over the
underlying SaaS implementation.
Cloud Computing
IaaS, PaaS & SaaS Comparison
9
Control level:
• SaaS: Usage and usage related configuration
• PaaS: Limited administrative
• IaaS: Full administrative

Functionality provided to cloud consumer:

• SaaS: Access to front-end user-interface
• PaaS: Moderate level of administrative control over

programming platform
• IaaS: Full administrative control over virtual resources of the
VMs
Common activities of cloud consumer:

• SaaS: Use and configure the service
• PaaS: Develop, debug and deploy the cloud services and

cloud based solutions
• IaaS: Installation and configuration of software, configure
the infrastructure of VM
Common Cloud Provider’s Activities:

• SaaS: Implementation, management and maintenance of
cloud service.
• PaaS: Providing the pre-configured programming
platform, middleware and any other IT resource needed.
• IaaS: Provisions and manages the VMs and underlying
physical infrastructure.
• The three cloud models of cloud delivery can be combined
in a way that one delivery model is deployed over another.
Such as:
• PaaS over IaaS
• SaaS over PaaS
• SaaS over PaaS over IaaS
Cloud Computing
Software as a Service (SaaS)
14
• NIST definition of SaaS: “Software deployed as a hosted

service and accessed over the Internet.”
• The SaaS is a software solution having the code and

data executing and residing on cloud.
• A user accesses the SaaS through browser.
• Remember: The cloud service consumer is a temporary

runtime role assumed by a software program when it
accesses a cloud service.
[Thomas Erl [2014], Cloud Computing Concepts, Technology and Architecture, Pearson]
• For the time being we shall assume that the browser acts as
cloud service consumer when accessing a SaaS.
• SaaS solutions eliminate the need of on-premises (data

center based) applications, application administration and
data storage.
• The customer is allowed to adopt pay-as-you-go type
of rental.
• SaaS offers scalability and device-independent access
to the SaaS solution/s.
• SaaS provider assures that the software provided is
solidly tested and supported.
• The notable disadvantage of SaaS is that the data
resides off-premises.
• Therefore the data security is of prime importance

because the customers’ data may be proprietary and
business-sensitive.
• The SaaS provider offers SaaS apps executing over IT-
resources.
• These resources can be from a physical servers or a VM
owned/rented by the provider.
• Each instance of a SaaS app (consumed by a user) is
allocated separate set of IT-resources.
Classes of SaaS:
• Business logic: Connect the suppliers, employees,
investors and customers.
• Example: Invoicing, fund transfer, inventory
management, customer relationship management
(CRM)
• Collaboration: Support teams of people work
together.
• Examples: Calendar systems, email, screen sharing,
conference management and online gaming.

• Office productivity: Office environment support.
• Examples: word processors, spreadsheets,
presentation and database software.

• Software tools: For the support of developing
software and solving compatibility problems.
• Examples: format conversion tools, security scanning,
compliance checking and Web development.

• Software that are not suitable for public SaaS

offerings (according to NIST):
• Real-time software: They require precise response time.
Due to variable response time and network delays, these
software are not suitable to be offered as SaaS. Such as
flight control systems and factory robots etc.
• Bulk-consumer data: When extremely large amount of
data is originating physically at the consumer’s side such as
physical monitoring and patient monitoring data.
• It is not feasible to transfer this data in real time over
WAN to SaaS provider.

• Critical software: A software is labeled critical if its failure or
delay in handling can cause loss of life or loss of property.
• These software are not suitable for SaaS because achieving
a continuous acceptable reliability for critical software in
public SaaS is quite challenging due to (unreliable) public
network based access.

SaaS Examples
1. Salesforce.com SaaS for Customer Relationship

Management (CRM)
• Manage sales contacts and leads.
• Centralize the contact, information and project
details.
• The sales reports from any place any time.
• Manages and syncs sales contacts and meetings
with other tools such as Microsoft Outlook.
SaaS Examples
2. Taleo SaaS for Human Resources Management

(HRM):
• Recruitment tools to manage the applicants’ data
for hiring purposes.
• Performance management and tracking tools for
employees’ evaluation.
• Compensation tools for rewarding the employees
according to performance.
• Workforce training and professional development
tools
SaaS Examples
3. ADP SaaS for Payroll Processing and HRM:

• Cloud solution for time management, employees
benefits calculation, worker compensation and HR
issues.
4. Carbonite SaaS for File Backups:

• Provides backup services for precious business data
and personal data. The data is kept securely and
redundantly.
SaaS Examples
5. Microsoft Office 365 SaaS for Document Creation,

Editing and Sharing:
• In order to provide the documentation tools at affordable
price and to compete with the freeware solutions,
Microsoft offers its flagship software suite on monthly
rental basis.
• The documents are saved in cloud and are shareable
among multiple users.
Cloud Computing
SaaS Software Stack
30
SaaS Software Stack
• The provider controls most of the software stack.
Application
Middleware
Operating
System
Hardware
SaaS Software Stack
• Application: Email
• Middleware: software libraries, run time environments
(Java, Python)
Application
Middleware
Operating
System
Hardware
SaaS Software Stack
• Service provider has admin control over application and

total control over the rest of the layers.
Application
Middleware
Operating
System
Hardware
SaaS Software Stack
• Service consumer has limited admin control over the

application and no control over the rest of the stack.
Application
Middleware
Operating
System
Hardware
SaaS Software Stack
• A consumer can create, send and manage the emails and

even the email accounts.
• But the email provider has absolute control over the SaaS
software stack in order to perform its duties such as
provisioning, management, updates and billing in email
app.
Cloud Computing
SaaS Benefits
36
SaaS Benefits
1. Modest software tool footprint:

◦ There is no need for complex installation procedures
because the SaaS applications and accessible through web
browsers.
◦ This is one of the reasons of widespread use of SaaS
applications.
2. Efficient use of software licenses:
◦ The license issuance and management procedure is quite
efficient.
◦ A single client is issued a single license for multiple
computers.
◦ This is because the software is running directly on
provider’s infrastructure and thus can be billed and
monitored directly.
SaaS Benefits
3. Centralized management and data:

◦ The consumer’s data is stored in cloud.
◦ The provider assures the security and availability of data.
◦ The data seems centralized for the consumer may in fact
be distributed and replicated by the provider.
◦ Data backup is provided at possibly additional charges.
4. Platform responsibilities managed by providers:
◦ Consumer does not has to bother about operating system
type, hardware and software configurations, software
installation and upgrades.
5. Savings in up-front costs:
◦ (As discussed before) the up-front costs such as
equipment acquisition and hardware provisioning etc. are
avoided by SaaS consumer.
SaaS Benefits
The provider is responsible for operational issues such as

backups, system maintenance, security software, upgrades,
trouble shooting in software, physical security and hardware
management etc.
SaaS: Issues and Concerns
40
• The NIST has identified few issues and concerns about SaaS.
• Most of these issues are due to network dependency of
SaaS.
1) Browser based risks and remedies:
• Since the SaaS is accessed through browser installed on
consumers’ device, the inherent vulnerabilities of the web
browsers do have impact over SaaS security.
• Although the browsers apply encryption upon network
traffic, yet various network attacks such as brute force and
man in the middle attacks are possible upon the SaaS data.
• The resources leased by a consumer can be hijacked by
malicious users due to poor implementation of cryptographic
features of browsers.
• If the consumer’s browser is already infected with a security

threat (due to a visit to malicious website) then later, the same
browser is used for SaaS access, then the SaaS data might get
compromised.
• If a single consumer accesses multiple SaaS services using
browser instances, then the data of these SaaS instances may
get mixed up.
A few suggestions by NIST:
• Use different browsers to access each different SaaS.
• Do not use the same web browser for web surfing and SaaS
access.
• Use a VM to access the SaaS.
2) Network dependence:
• SaaS application depends upon reliable and continuously
available network.
• The reliability of a public network (Internet) can not be
guaranteed as compared to dedicated and protected
communication links of private SaaS applications.
3. Lack of portability between SaaS clouds:

• It may not be trivial to import export data among different
SaaS applications deployed over different clouds due to
customized development and deployment of SaaS
applications and data formats.
4. Isolation vs. Efficiency (Security vs. Cost Tradeoffs):

• The SaaS provider has to make a trade-off decision as to
deploy separate IT-resources (such as VMs) for each client or
concurrently serve multiple clients through a single
deployment of SaaS application.
NIST Recommendations for SaaS
46
1. Data protection:
The consumer should analyze the data protection, configuration,

database transaction processing technologies of SaaS provider.
Compare them with the confidentiality, integrity, availability and
compliance requirement of the consumer.
2. Client device/application protection:
The consumer’s client device (browser running over a computer)

should be protected to control the exposure to attacks.
3. Encryption:
Strong encryption algorithm with key of required strength

should be used for each web session as well as for data.
4. Secure data deletion:
The data deletion through consumer’s request should be

reliably done.
Summary
• IaaS, PaaS & SaaS Provisioning
• IaaS, PaaS & SaaS Comparison
• Software as a Service (SaaS)
49

CC Week 05

Uploaded by

Copyright:

Available Formats

CC Week 05

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CC Week 05

Uploaded by

Copyright:

Available Formats

Cloud Computing

• Risks and Challenges of Cloud Computing

• Roles and Boundaries of Cloud Computing

• Characteristics of Cloud Computing (Multitenancy, Resiliency)

• IaaS, PaaS & SaaS Provisioning

• IaaS, PaaS & SaaS Comparison

• Software as a Service (SaaS)

• SaaS Software Stack

• IaaS: The IT-resources are typically virtualized and packaged in a

• PaaS: Delivers a programming environment containing

• The PaaS saves the consumer from administrative tasks

such as installations and configurations to set up the

software development infrastructure.

• On the other hand the cloud consumer has lower level of

control over the underlying infrastructure.

• SaaS: Is the software hosted over cloud infrastructure and

IaaS, PaaS & SaaS Comparison

• PaaS: Limited administrative

• IaaS: Full administrative

Functionality provided to cloud consumer:

• PaaS: Moderate level of administrative control over

Common activities of cloud consumer:

• PaaS: Develop, debug and deploy the cloud services and

Common Cloud Provider’s Activities:

Software as a Service (SaaS)

• NIST definition of SaaS: “Software deployed as a hosted

• The SaaS is a software solution having the code and

• Remember: The cloud service consumer is a temporary

• SaaS solutions eliminate the need of on-premises (data

• Therefore the data security is of prime importance

• Collaboration: Support teams of people work

• Examples: Calendar systems, email, screen sharing,

conference management and online gaming.

• Office productivity: Office environment support.

• Examples: word processors, spreadsheets,

presentation and database software.

• Software tools: For the support of developing

software and solving compatibility problems.

• Examples: format conversion tools, security scanning,

compliance checking and Web development.

• Software that are not suitable for public SaaS

• Bulk-consumer data: When extremely large amount of

data is originating physically at the consumer’s side such as

physical monitoring and patient monitoring data.

• It is not feasible to transfer this data in real time over

WAN to SaaS provider.

• Critical software: A software is labeled critical if its failure or

delay in handling can cause loss of life or loss of property.

• These software are not suitable for SaaS because achieving

a continuous acceptable reliability for critical software in

public SaaS is quite challenging due to (unreliable) public

network based access.

1. Salesforce.com SaaS for Customer Relationship

2. Taleo SaaS for Human Resources Management

3. ADP SaaS for Payroll Processing and HRM:

4. Carbonite SaaS for File Backups:

5. Microsoft Office 365 SaaS for Document Creation,

SaaS Software Stack

• The provider controls most of the software stack.

• Service provider has admin control over application and