What are the three cloud service models and their security implications?

Infrastructure as a Service, or IaaS, provides virtual machines, storage, and networking where the customer manages everything above the hypervisor. Platform as a Service, or PaaS, adds managed operating systems and runtime environments where the customer manages only applications and data. Software as a Service, or SaaS, delivers complete applications where the customer manages only access and data classification. Security responsibility shifts from customer to provider as you move from IaaS to SaaS.