A broad array of public cloud computing services are available today, comprising multiple offerings and service models. Almost any service that doesn’t require physical proximity to the hardware that’s hosting it can now be delivered via the cloud.

The three most common cloud service models are as follows:

• Infrastructure-as-a-Service (IaaS): In IaaS, the public cloud provider offers access to fundamental compute, network and storage resources on demand over the public Internet or through dedicated connections. This might consist of direct access to the underlying hardware—a model known as bare metal—but more commonly, it’s access to already virtualized resources.

• Platform-as-a-Service (PaaS): PaaS provides application developers a complete platform—including all necessary hardware, software and infrastructure—upon which applications can be built, run and managed. The entire platform infrastructure is typically managed by the cloud provider, and users need not worry about lower-level details.

• Software-as-a-Service (SaaS): With SaaS, users receive access to cloud-hosted software applications. Instead of being installed on local devices, these applications reside in the cloud and are accessed through a web browser or via an API.

Other service models (which are often more specialized) are also available. These include offerings like Business-Process-as-a-Service (BPaaS), in which an entire horizontal or vertical business process is delivered together as a combination of related IaaS, PaaS and SaaS services; or Function-as-a-Service (FaaS), a subset of SaaS in which application code runs only in response to specific events or requests. However, most of these offerings are subtypes or extensions of the three basic cloud computing service models.

Private cloud is cloud infrastructure operated exclusively for one company. Typically, a private cloud is hosted on-premises, behind the client company’s own firewall, but it can also be hosted on a dedicated cloud provider or third-party infrastructure. In either event, the client company has exclusive, isolated access to the infrastructure.

Private cloud enables a company to take advantage of cloud efficiencies while providing greater control over resources, data security and regulatory compliance, and avoiding the potential performance and security impact of sharing resources with another cloud customer.

One analogy likens private cloud computing to owning a single-family home and public cloud computing to renting an apartment or condominium in a multi-unit building.

In private cloud, the customer is typically responsible for managing and maintaining the infrastructure, which includes capacity planning to ensure that the available hardware can meet present and future needs, software licensing and installation and monitoring and enforcing security policies.

Some possible advantages of private cloud compared to public cloud include the following:

• Greater ability to customize applications and infrastructure.
  
  
• Greater control and security because workloads run behind the tenant’s firewall, though overall security is dependent upon that of the tenant’s own environment.
  
  
• Simplified (or simplified perceived) compliance with industry or government regulations.

Private cloud typically involves higher up-front and ongoing costs than public cloud. But emerging public cloud offerings such as virtual private clouds (VPCs) bring many of the same benefits as private cloud computing without imposing the same cost or management burdens. And new private cloud offerings such as managed private cloud services—in which a third-party vendor steps in to deploy, configure and manage the private cloud on the customer’s behalf—are also making private cloud-like services easier to consume.

In general, public cloud is a better choice if the following are true:

• Scalability and elasticity—the ability to add capacity instantly or automatically in response to unexpected surges in traffic—are important to you.
  
  
• You’d like to avoid upfront capital expenses and prefer more predictable ongoing operating expenses.
  
  
• You want unlimited access to particular resources that are available through a public cloud provider.

However, if you have highly specialized security, regulatory or infrastructure needs, want maximum control over your cloud environment and find that your workloads have predictable usage patterns, a private cloud or private cloud-like service might be a better fit.

Hybrid cloud integrates private and public clouds, using technologies and management tools that allow an enterprise to move workloads seamlessly between both as needed for optimal performance, security, compliance and cost-effectiveness.

For example, hybrid cloud enables a company to keep sensitive data and mission critical legacy applications (which can’t easily be migrated to the cloud) on-premises while leveraging public cloud for SaaS applications, PaaS for rapid deployment of new applications and IaaS for additional storage or compute capacity on demand.

The majority of enterprise cloud adopters turn to hybrid cloud architectures so that they have the flexibility to choose the best cloud environment (public or private) for each of their workloads or move the workloads between clouds as their needs change.

For more background on hybrid cloud, see our video “Hybrid Cloud Explained”:

Traditionally, security concerns have been the number-one obstacle for organizations considering public cloud. In response to demand, however, the security offered by cloud service providers is steadily outstripping on-premises security solutions.

With the growing popularity of containers—which can greatly enhance security in cloud native application architectures—and new public cloud offerings that include vendor-certified compliance with industry standards and regulations, it’s becoming easier than ever to maintain a security posture that’s at least as strong as what can be achieved with on-premises infrastructures.

According to security software provider McAfee, today 52% of companies experience better security in the cloud than on-premises (link resides outside ibm.com). Gartner has predicted that by this year (2020), infrastructure as a service (IaaS) cloud workloads will experience 60% fewer security incidents than those in traditional data centers (link resides outside ibm.com).

Nonetheless, maintaining such security standards in the public cloud demands different governance procedures and employee skillsets than in legacy IT environments. Cloud security requires strong access management, encryption for data at rest, in transit or in use, and excellent visibility to monitor, detect and manage cyberthreats.