6.1 Cloud Models & Enterprise Storage

Cloud Models & Enterprise Storage Architecture

In modern enterprise IT operations, computing workloads and storage repositories have increasingly shifted from on-premises hardware closets to distributed cloud environments and centralized enterprise storage fabrics. IT support professionals and system administrators must understand the foundational service models, deployment topologies, boundary security models, and network storage protocols that power today's hybrid enterprise architectures.

This section covers the official NIST definitions of cloud computing, compares Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), analyzes the Shared Responsibility Model, and details the operation of enterprise storage systems including Network Attached Storage (NAS), Storage Area Networks (SAN), and cloud Object Storage.

---

1. NIST Cloud Computing Framework & Essential Characteristics

The National Institute of Standards and Technology (NIST Special Publication 800-145) defines cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

+-----------------------------------------------------------------------------+
|                   NIST 5 ESSENTIAL CLOUD CHARACTERISTICS                    |
|                                                                             |
|   [1. On-Demand Self-Service]  --> Automated provisioning without human     |
|                                    intervention from the provider.          |
|                                                                             |
|   [2. Broad Network Access]    --> Capabilities accessible over standard    |
|                                    networks via heterogeneous client devices.|
|                                                                             |
|   [3. Resource Pooling]        --> Multi-tenant model pooling physical and  |
|                                    virtual resources dynamically.           |
|                                                                             |
|   [4. Rapid Elasticity]        --> Elastic provisioning and deprovisioning  |
|                                    scaling seamlessly with demand spikes.   |
|                                                                             |
|   [5. Measured Service]        --> Transparent usage metering, resource     |
|                                    telemetry, and pay-as-you-go billing.    |
+-----------------------------------------------------------------------------+

The Five Essential Characteristics:

1. On-Demand Self-Service: A consumer can unilaterally provision computing capabilities, such as server processing time, network interfaces, and storage volumes, automatically without requiring human interaction with the cloud service provider.
2. Broad Network Access: Computing capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and enterprise workstations).
3. Resource Pooling: The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. The customer generally has no control or direct knowledge over the exact physical location of the provided resources (location independence).
4. Rapid Elasticity: Capabilities can be elastically provisioned and released—in some cases automatically—to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.
5. Measured Service: Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage capacity, CPU processing cycles, active user accounts, and bandwidth consumed). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer (utility computing).

---

2. Cloud Service Models: IaaS, PaaS, and SaaS

Cloud computing categorizes services into three primary delivery tiers, each representing a different layer of the technical computing stack and establishing distinct boundaries of administrative control.

+-----------------------------------------------------------------------------+
|                        CLOUD SERVICE MODEL TAXONOMY                         |
|                                                                             |
|   +---------------------------------------------------------------------+   |
|   |                   SOFTWARE AS A SERVICE (SaaS)                      |   |
|   |   - Google Workspace, Microsoft 365, Salesforce, ServiceNow         |   |
|   |   - End-user application layer; consumer manages data & users       |   |
|   +---------------------------------------------------------------------+   |
|                                      ^                                      |
|                                      | Built upon                           |
|   +---------------------------------------------------------------------+   |
|   |                   PLATFORM AS A SERVICE (PaaS)                      |   |
|   |   - Google App Engine, AWS Elastic Beanstalk, Azure App Services    |   |
|   |   - Execution environment; consumer manages application code & data |   |
|   +---------------------------------------------------------------------+   |
|                                      ^                                      |
|                                      | Built upon                           |
|   +---------------------------------------------------------------------+   |
|   |                 INFRASTRUCTURE AS A SERVICE (IaaS)                  |   |
|   |   - AWS EC2, Google Compute Engine (GCE), Microsoft Azure VMs       |   |
|   |   - Raw compute, storage, networking; consumer manages OS upward    |   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

1. Infrastructure as a Service (IaaS)

In the IaaS model, the cloud provider delivers fundamental computing resources—virtualized hardware instances, raw block storage volumes, software-defined networking switches, and firewalls. The consumer does not manage or control the underlying physical datacenter infrastructure, but has complete administrative control over operating systems, storage volumes, installed applications, and network configuration (such as host-based firewalls and routing tables).

• Representative Solutions: Amazon Web Services (AWS EC2), Google Cloud Platform (GCP Compute Engine), Microsoft Azure Virtual Machines, DigitalOcean Droplets.
• Administrative Burden: High. IT administrators must configure the operating system kernel, patch system packages, manage security hardening, install runtimes, and configure backup schedules.

2. Platform as a Service (PaaS)

In the PaaS model, the cloud provider delivers a managed development and deployment environment. The provider completely abstracts and manages the underlying server hardware, virtualization layer, operating system, runtime environment (e.g., Node.js, Python, Java, .NET), database engine, and server middleware. The consumer retains control solely over the deployed applications and application-specific configuration settings.

• Representative Solutions: Google App Engine, AWS Elastic Beanstalk, Microsoft Azure App Service, Heroku.
• Administrative Burden: Moderate. Developers write and upload source code or container images; the platform automatically handles provisioning, load balancing, OS patching, runtime updates, and auto-scaling.

3. Software as a Service (SaaS)

In the SaaS model, the consumer uses the provider's turnkey applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface (such as a web browser) or a program interface. The consumer does not manage or control the underlying cloud infrastructure, operating systems, servers, storage, or application capabilities, with the possible exception of user-specific application configuration settings and access permissions.

• Representative Solutions: Google Workspace (Gmail, Docs, Drive), Microsoft 365, Salesforce CRM, Dropbox, ServiceNow, Zoom.
• Administrative Burden: Low. IT support primarily manages user provisioning, Single Sign-On (SSO), Multi-Factor Authentication (MFA), role-based access control (RBAC), and data retention policies.

Cloud Service Models Comparison Matrix

---

3. Cloud Deployment Models: Public, Private, Hybrid & Multi-Cloud

Organizations deploy cloud services across four primary operational models depending on security requirements, regulatory compliance standards, existing capital investments, and latency tolerances.

+-----------------------------------------------------------------------------+
|                        CLOUD DEPLOYMENT TOPOLOGIES                          |
|                                                                             |
|   [PUBLIC CLOUD]            [PRIVATE CLOUD]         [HYBRID / MULTI-CLOUD]  |
|   - Multi-tenant            - Single organization   - Interconnected mesh   |
|   - Shared physical hosts   - On-prem or hosted     - Cloud bursting        |
|   - Massive scale           - Custom governance     - Multi-vendor sprawl   |
|   - OPEX pricing            - High CAPEX / control  - Vendor independence   |
+-----------------------------------------------------------------------------+

1. Public Cloud: The cloud infrastructure is provisioned for open use by the general public. It is owned, managed, and operated by a business, academic, or government organization (e.g., Amazon, Google, Microsoft). It exists on the premises of the cloud provider and relies on multi-tenancy to achieve high resource utilization and aggressive economies of scale.
2. Private Cloud: The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises (e.g., OpenStack, VMware Cloud Foundation, dedicated hosted private clusters).
3. Hybrid Cloud: The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing across clouds, or hosting sensitive customer database records in an on-premises private datacenter while serving front-end web traffic via public cloud VMs).
4. Multi-Cloud: The strategic deployment of workloads across multiple independent public cloud providers (e.g., hosting microservices in AWS while running big-data machine learning pipelines in GCP and directory identity in Azure). Multi-cloud architectures mitigate vendor lock-in, maximize feature selection, and provide geographic redundancy.

---

4. The Shared Responsibility Model

The Shared Responsibility Model is the foundational cybersecurity framework governing cloud computing. It dictates which security tasks and operational duties belong to the cloud service provider (CSP) and which remain the strict obligation of the customer organization.

+-----------------------------------------------------------------------------+
|                       SHARED RESPONSIBILITY BOUNDARIES                      |
|                                                                             |
|   +---------------------------------------------------------------------+   |
|   |                   CUSTOMER RESPONSIBILITY: SECURITY IN THE CLOUD    |   |
|   |   - Customer Data & Document Classification                         |   |
|   |   - Identity and Access Management (IAM, MFA, Password Policies)    |   |
|   |   - Operating System Configuration & Security Patching (IaaS)       |   |
|   |   - Network Ingress/Egress Rules & Host Firewalls (Security Groups) |   |
|   |   - Client-Side & Server-Side Data Encryption                       |   |
|   +---------------------------------------------------------------------+   |
|   ========================== BOUNDARY OF CONTROL ========================   |
|   +---------------------------------------------------------------------+   |
|   |                   PROVIDER RESPONSIBILITY: SECURITY OF THE CLOUD    |   |
|   |   - Physical Datacenter Security (Biometrics, CCTV, Guards, Power)  |   |
|   |   - Server Hardware Lifecycle & Physical Storage Media Shredding    |   |
|   |   - Hypervisor Patching & Kernel Virtualization Isolation           |   |
|   |   - Core Fiber Infrastructure, Edge Routers & DDOS Mitigation       |   |
|   |   - Environmental Controls (HVAC, Fire Suppression, Diesel GenSets) |   |
|   +---------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------+

Security OF the Cloud (Provider Responsibility):

The CSP is solely responsible for protecting the infrastructure that runs all of the services offered in the cloud:

• Physical Security: Biometric access control, video surveillance, security guards, perimeter fencing, and secure physical hardware disposal/degaussing.
• Environmental Resilience: HVAC climate control, dual redundant electrical grids, uninterruptible power supplies (UPS), backup diesel generators, and FM-200 / water mist fire suppression.
• Core Infrastructure: Physical servers, fiber optic cabling, top-of-rack switches, hardware virtualization hypervisors (e.g., KVM, Nitro), and network border protection (volumetric DDoS shielding).

Security IN the Cloud (Customer Responsibility):

The customer retains sole ownership and responsibility for configuring, securing, and maintaining everything deployed inside their provisioned cloud environment:

• Identity and Access Management (IAM): Enforcing least privilege, mandating Multi-Factor Authentication (MFA), managing API access keys, and deprovisioning departed employees.
• Operating System Management (IaaS): Applying OS security updates, configuring kernel parameters, maintaining endpoint protection, and managing local user accounts.
• Network Security: Defining firewall rules (AWS Security Groups, Azure Network Security Groups), configuring virtual private clouds (VPCs), and managing VPN / TLS encryption.
• Data Governance: Classifying sensitive data, applying cryptographic encryption at rest and in transit, and configuring automated backup snapshots.

---

5. Enterprise Network Storage Technologies: File, Block, and Object Storage

Enterprise IT architectures require robust centralized storage systems capable of serving thousands of concurrent users, virtual machines, and transactional databases. Storage technologies are categorized into three primary architectures: File-Level (NAS), Block-Level (SAN), and Object Storage.

+-----------------------------------------------------------------------------+
|                     ENTERPRISE STORAGE ARCHITECTURE TIERS                   |
|                                                                             |
|   [FILE STORAGE - NAS]        [BLOCK STORAGE - SAN]      [OBJECT STORAGE]   |
|   - Server Message Block      - Fibre Channel (FC)       - HTTP REST APIs   |
|   - Network File System (NFS) - iSCSI / FCoE             - Amazon S3, GCS   |
|   - Tree Hierarchy (Files)    - Raw LUNs (Sectors)       - Flat Key-Value   |
|   - User Home Directories     - Databases, VMs (VMDK)    - Massive Unstruct |
+-----------------------------------------------------------------------------+

1. File-Level Storage & Network Attached Storage (NAS)

Network Attached Storage (NAS) is a dedicated storage appliance connected directly to a standard TCP/IP Ethernet network. NAS devices contain their own stripped-down operating system and filesystem, serving shared files and folder trees to multiple client computers across the local area network.

• File System Ownership: The NAS appliance manages the filesystem internally (e.g., EXT4, ZFS, Btrfs). Clients send file-level read and write requests across the network.
• Primary Protocols:
  • SMB/CIFS (Server Message Block / Common Internet File System): Operates primarily over TCP port 445. SMB is the native network file-sharing protocol for Microsoft Windows environments. It integrates tightly with Active Directory Kerberos authentication and enforces NTFS Access Control Lists (ACLs).
  • NFS (Network File System): Operates primarily over TCP/UDP port 2049. NFS is the native network file-sharing protocol in Linux and UNIX ecosystems. Clients mount remote exports into their local directory tree (e.g., mount -t nfs 192.168.1.100:/exports/data /mnt/nas_share).
• Use Cases: Centralized departmental file shares, user roaming profiles, shared document repositories, media archiving.

2. Block-Level Storage & Storage Area Networks (SAN)

A Storage Area Network (SAN) is a specialized, high-speed network dedicated exclusively to interconnecting servers and enterprise block storage arrays. Unlike NAS, which serves high-level files, a SAN presents raw, unformatted blocks of storage—organized into Logical Unit Numbers (LUNs)—directly to the server's operating system.

• File System Ownership: The client server's operating system owns and formats the filesystem (e.g., NTFS, VMFS, XFS) directly onto the assigned LUN. To the operating system, the SAN volume appears indistinguishable from a physically attached internal SAS or NVMe hard drive.
• Primary SAN Protocols & Fabrics:
  • Fibre Channel (FC): A purpose-built, high-speed optical network protocol operating over dedicated fiber cabling and specialized Fibre Channel switches (8 Gbps, 16 Gbps, 32 Gbps, 64 Gbps). Hosts utilize dedicated Host Bus Adapters (HBAs) identified on the fabric by unique 64-bit hexadecimal World Wide Port Names (WWPN) and World Wide Node Names (WWNN). Highly reliable with zero packet drop, but requires expensive dedicated switching infrastructure.
  • iSCSI (Internet Small Computer Systems Interface): Encapsulates standard SCSI storage commands inside standard TCP/IP packets over standard Ethernet infrastructure (operating over TCP ports 860 and 3260). Servers use software or hardware iSCSI Initiators to connect to storage iSCSI Targets identified by unique iSCSI Qualified Names (IQNs) (e.g., iqn.2026-08.com.example:storage.target01). Inexpensive compared to Fibre Channel because it runs over commodity Ethernet switches.
  • FCoE (Fibre Channel over Ethernet): Encapsulates native Fibre Channel frames directly inside standard 10GbE / 25GbE Ethernet frames using lossless Ethernet standards (IEEE 802.1Qbb Priority-based Flow Control), eliminating the need for separate FC host bus adapters and dedicated optical switches.
• Use Cases: High-transaction SQL databases (Oracle, Microsoft SQL Server), hypervisor virtualization datastores (VMware ESXi VMFS, Microsoft Hyper-V Cluster Shared Volumes), and workloads requiring sub-millisecond I/O latency.

3. Object Storage

Object Storage is a modern storage paradigm engineered for massive scalability, flat data structures, and unstructured data retention. Rather than organizing data into a hierarchical directory tree (File Storage) or fixed raw blocks (Block Storage), object storage manages data as discrete, self-contained units called Objects stored within a completely flat namespace (buckets or containers).

• Object Structure: Each object consists of three components:
  1. Data Payload: The raw binary data (image, video, log file, database backup, virtual machine snapshot).
  2. Metadata: An extensive, highly customizable set of key-value attributes describing the data (e.g., content type, creation timestamp, author, retention policy, custom application tags).
  3. Globally Unique Identifier (Key): A unique alphanumeric string or 128-bit hash used to retrieve the object without requiring knowledge of physical drive locations or directory paths.
• Access Method: Objects are manipulated directly over the Internet via standard RESTful HTTP/HTTPS API calls using standard HTTP verbs:
  • PUT: Upload an object to a bucket.
  • GET: Download or stream an object.
  • DELETE: Remove an object.
  • HEAD: Retrieve object metadata without downloading the full payload.
• Hyperscaler Platforms: Amazon Simple Storage Service (Amazon S3), Google Cloud Storage (GCS), Microsoft Azure Blob Storage.
• Use Cases: Unstructured big data lakes, cloud-native application media hosting, distributed content delivery networks (CDNs), Write Once Read Many (WORM) compliance archives, and automated ransomware-resistant backup repositories.

Enterprise Storage Comparison Matrix