What is the difference between IaaS, PaaS and SaaS?
They describe how much of the stack the provider runs for you, and therefore how much security work stays with you. With infrastructure as a service (IaaS) you rent virtual servers, storage and networks; you install and patch the operating system, configure firewalls and run your applications, so the security work is close to running your own servers. With platform as a service (PaaS) the provider runs the operating system and runtime, such as a managed database or an application platform; you remain responsible for your code, configuration, identities and data. With software as a service (SaaS) you use a finished application such as e-mail, CRM or accounting; your part is mainly who has access, with what rights and multi-factor authentication, how data is shared, and keeping your own copy of important data. Many companies use all three at once. Map each service to its type, because the questions an auditor or insurer asks differ for each, and so do the logs you can get.