Page 602 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

be offered for free. Although an organization’s or individual’s data is
usually kept separated and isolated from other customers’ data in a

public cloud, the overall purpose or use of the cloud is the same for all
customers.

Hybrid A hybrid cloud is a mixture of private and public cloud
components. For example, an organization could host a private cloud
for exclusive internal use but distribute some resources onto a public
cloud for the public, business partners, customers, the external sales

force, and so on.
Community A community cloud is a cloud environment maintained,

used, and paid for by a group of users or organizations for their shared
benefit, such as collaboration and data exchange. This may allow for
some cost savings compared to accessing private or public clouds
independently.

Cloud computing is a natural extension and evolution of virtualization,
the internet, distributed architecture, and the need for ubiquitous

access to data and resources. However, it does have some issues,
including privacy concerns, regulation compliance difficulties, use of
open/closed-source solutions, adoption of open standards, and
whether or not cloud-based data is actually secured (or even
securable).

Cloud solutions often have lower up-front costs, lower maintenance
costs, vendor-maintained security, and scalable resources, and they

usually have high levels of uptime and availability from anywhere
(over the internet). However, cloud solutions do not offer customer
control over the OS and software, such as updates and configuration
changes; provide minimal customization; and are often inaccessible
without internet connectivity. In addition, the security policies of the
cloud provider might not match those of the organization.

Cloud computing and virtualization, especially when you are

virtualizing in the cloud, have serious risks associated with them. Once
sensitive, confidential, or proprietary data leaves the confines of the
organization, it also leaves the protections imposed by the
organizational security policy and resultant infrastructure. Cloud
services and their personnel might not adhere to the same security