There are three main types of cloud service:
- Software as a Service (SaaS)
- Platform as a Service (PaaS)
- Infrastructure as a Service (IaaS)
Software as a Service (SaaS) is by far the most common model and many people will have personal experience of using cloud-based applications from companies such as Google. Most of these SaaS applications are ‘commodity’ type services where there is little or no differentiation between users in different sectors eg email. PaaS and IaaS are more complex propositions whereby the institution can obtain ‘building blocks’ in order to store data or deploy applications in the cloud.
Software as a Service (SaaS)
Typically pronounced ‘sass': A model of software deployment whereby a provider licenses an application to customers for use as a service on demand. The applications are accessible from various client devices through a thin client interface such as a web browser (eg web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, and application capabilities or maintain applications. There may be some limited user-specific configurable settings. SaaS breaks the link between machines and solutions, theoretically enabling customers to license only what they need. Because many people use the same basic service there is a rich source of ideas for improvements and additional features.
SaaS has its origins in payroll bureaux and HR applications were amongst the first to market. The classic example of SaaS is the e-recruitment service Salesforce which accounts for a significant proportion of the market. This is not mere coincidence: recruitment is a business function where only a small subset of the data requires transfer to your core HR system. Other recent successes, which have had an impact on the education sector, include Google mail. Business functions which require a high degree of integration with other institutional systems may present more interoperability issues.
Another feature which emphasises the end user, commodity nature of these applications (as opposed to previous applications for the corporate market) is that upgrades are rolled out to all users at the same time. The fact that you lose control of new releases to users means an end to the traditional cycle of testing and planned roll-out. The evidence from many social applications suggests that, on the whole, users will probably just get on with this and cope with the changes but the implications for IT support do need to be considered.
A final point is that SaaS and cloud are not necessarily one and the same thing. This resource includes a section on risks of cloud computing that covers issues such as security and data protection. In the light of these issues it is worth noting that a number of trusted SaaS vendors do not actually use cloud hosting. NIST, (Badger et al 2011) the US National Institute of Standards and Technology offers an excellent summary of the architecture and basic operation of SaaS in a cloud computing environment that is of considerable use to anyone trying to understand the operational mechanisms and/or evaluate whether a SaaS cloud offering can satisfy particular reliability, compliance, or security requirements.
Platform as a Service (PaaS)
In this model the consumer creates or deploys applications onto the cloud infrastructure using programming languages and tools supported by the cloud provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage. They will have control over the deployed applications and possibly application hosting environment configurations.
Infrastructure as a Service (IaaS)
In this service model the institution outsources all of its infrastructure including servers, storage, associated networking, etc to an external provider. This model is sometimes referred to as Hardware as a Service. The service provider owns the equipment and is responsible for housing, running and maintaining it. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components, for example, the hosting of firewalls.