IaaS Tenant Security Controls

Mike Small

Description

Short Summary

Interesting Facts

Notable Quotes

Recommendations

Takeaways

IT Organizations now commonly use multiple cloud services as well as on premises IT. This KuppingerCole Buyer's Compass focusses on the capabilities IaaS services provide to manage the common business risks such as loss of business continuity, data breaches and regulatory compliance failure when using cloud services as part of a hybrid IT delivery model. It will provide you with questions to ask vendors, criteria to select your vendor, and the requirements for successful deployments. This report will prepare your organization to conduct RFIs and RFPs for IaaS as part of a Hybrid IT service delivery model.

The document explains how to use a KuppingerCole Buyer’s Compass to streamline vendor selection by focusing on use cases and a weighted set of functional and non-functional criteria, rather than attempting to evaluate hundreds of requirements at once. The intended process is to identify primary use cases, review and weight functional and non-functional selection criteria, request vendor information, score vendors, ask targeted additional questions, build a shortlist, and then proceed with deeper RFIs and proofs of concept, while ensuring technical and organizational prerequisites are in place.

It defines IaaS market segmentation by provider scale and service richness, noting the growth of non-US entrants and specialized offerings differentiated by geography, regulatory compliance, professional services, and managed cloud services. IaaS is positioned as network-delivered computing and storage that avoids upfront capital expenditure and supports use cases from hosting and disaster recovery to modern application development, with emerging demand for AI/ML and large-scale IoT. Hybrid IT is presented as the dominant operating model, combining multiple cloud services with on-premises systems.

A core theme is shared responsibility for security and compliance: the cloud service provider secures and manages the underlying infrastructure, while the tenant must secure everything above the virtualization layer, including network configuration, operating systems, middleware, applications, data protection, access governance, continuity architecture, and overall compliance with laws and regulations. Risks frequently stem from tenant misconfiguration, so buyers should prioritize capabilities that help detect and remediate control gaps. The top cybersecurity business impacts are loss of continuity, data misuse/leakage, and compliance failures, mitigated through consistent governance across all IT services.

The Buyer’s Compass is described as a starting point for vendor selection rather than a complete guideline.
IaaS provides computing resources over a network to run software and store data without up-front capital expenditure.
Organizations increasingly use multiple cloud services alongside on-premises IT in a hybrid IT service delivery model.
Security and compliance responsibilities are shared between the tenant and the cloud service provider.
The cloud service provider is responsible for the physical infrastructure, including data centers, physical networks, servers, and storage devices.
The tenant is responsible for the in-cloud network, operating systems, middleware, applications, and managing access to the service and data.
Risks often arise because tenants do not properly configure their use of the cloud service.
Three major cybersecurity business impacts are loss of business continuity, misuse or leakage of data, and compliance failures.
Kubernetes is an open-source container orchestration platform developed by Google and open-sourced in 2014.
Certification examples listed include ISO/IEC 2700x standards, SOC reports to SSAE 18 / ISAE 3402, and the CSA STAR program.

“This document is not a complete guideline for selecting vendors but should provide an excellent starting point to streamline the decision-making process.”
“The responsibility for security and compliance in the use of cloud services is shared between the tenant and the CSP (Cloud Service Provider).”
“However, risks frequently arise because the tenant does not properly configure their use of the service.”
“It is important to note that the tenant is always responsible for managing access to the service and the data it contains.”
“Never assume that a service level beyond that specified in the SLA will be achieved.”
“Cloud services are outside the direct control of the tenant organization and their use places control of the service and infrastructure in the hands of the CSP.”
“Separately managing each service that is part of the hybrid IT model can be very burdensome.”
“The compensation provided for missing SLA targets is often quite meagre.”
“The objective of the assurance process is to confirm that the actual cloud service provided conforms to that which was agreed and that the security controls are operating correctly.”
“We see many situations that struggle not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”

Select IaaS vendors by first identifying primary use cases and weighting criteria accordingly rather than treating all requirements as equal.
Score vendors using both functional and non-functional criteria, then validate results through deeper RFIs and proofs of concept.
Ensure technical and organizational prerequisites exist, including architecture, standards, roadmap, skills, governance, procurement, risk assessment, compliance, and assurance.
Treat tenant-side configuration as a central security risk and require tooling that helps identify and remediate control gaps.
Require clear, written documentation defining the division of security and compliance responsibilities for each service.
Evaluate end-to-end continuity beyond the SLA by assessing connectivity dependencies, failover options, and geographic implications for performance and compliance.
Prefer cloud services that integrate with enterprise identity processes to avoid orphan accounts, excessive entitlements, and weak segregation of duties.
Balance the benefits of proprietary cloud capabilities against interoperability needs to reduce technical lock-in risk.
Demand measurable service verification mechanisms, including tools and measurement points for checking SLA adherence in practice.
Use reference customers—ideally in similar regions and industries—to validate operational maturity and real-world SLA performance.

Become a member of the KuppingerCole Community to access this and thousands of other publications.

A use-case-driven, weighted criteria approach is the fastest way to make vendor evaluation rigorous without becoming unmanageable.
Hybrid IT drives requirements for secure connectivity, migration support, and integrated management more than any single feature category.
Tenants remain accountable for access control and compliance even when infrastructure responsibility sits with the provider.
The biggest cloud cybersecurity impacts cluster around continuity, data protection, and compliance, requiring governance-led mitigation.
Contracts, SLAs, certifications, and assurance processes are as important as technical capabilities for risk-managed cloud adoption.

Become a member of the KuppingerCole Community to access this and thousands of other publications.