1.1 System and Network Architecture Concepts
Network architecture
📘CompTIA CySA+ (CS0-003)
Network Architecture – On-premises, Cloud, Hybrid
Modern organizations choose how to design and host their IT services based on their business needs, security requirements, and budget. The CySA+ exam expects you to understand the differences, benefits, and risks of on-premises, cloud, and hybrid architectures, and how each affects cybersecurity monitoring and defense.
This section explains these architectures clearly and focuses on what matters for security analysts.
1. On-Premises Architecture
On-premises (on-prem) means all IT resources are hosted inside the organization’s own physical environment.
This includes:
- Servers
- Storage systems
- Network equipment (routers, switches, firewalls)
- Applications
- Security tools
All systems are owned, managed, and secured by the organization’s internal IT and security teams.
Key Characteristics
- The organization has full control over hardware, operating systems, configurations, and security tools.
- All data stays inside the organization’s controlled environment.
- Security teams must maintain everything (patching, updates, monitoring, backups).
Security Responsibilities
CySA+ emphasizes that with on-premises:
- The organization is responsible for physical security (server rooms, access control).
- The organization manages network segmentation, firewall rules, IDS/IPS, logging, and monitoring.
- Incident response is fully internal.
- Compliance controls must be implemented and maintained by the company.
Advantages
- Complete visibility into logs, traffic, and systems.
- Full customization of security controls.
- More predictable performance since the infrastructure is controlled internally.
Disadvantages
- High cost for hardware, maintenance, and staffing.
- Limited ability to scale quickly.
- Internal teams must handle all vulnerabilities and updates.
2. Cloud Architecture
Cloud architecture means IT resources are hosted by a cloud service provider (CSP), such as AWS, Azure, or Google Cloud.
Resources are delivered over the internet and can be scaled or changed rapidly.
Cloud services operate under the shared responsibility model, which is very important for the CySA+ exam.
Shared Responsibility Model
- Cloud provider: secures the underlying cloud infrastructure (hardware, hypervisors, physical data centers).
- Customer: secures what they deploy in the cloud (data, applications, access management, configurations).
The exact responsibilities depend on the cloud service type:
Cloud Service Models (important for CySA+)
- IaaS (Infrastructure as a Service)
- Customer manages: OS, applications, data, configurations.
- CSP manages: virtualization layers, hardware, physical security.
- PaaS (Platform as a Service)
- Customer manages: data, application code.
- CSP manages: OS, runtime, infrastructure.
- SaaS (Software as a Service)
- Customer manages: user access and data.
- CSP manages almost everything else.
Security Considerations in Cloud
CySA+ expects you to understand:
- Identity and Access Management (IAM) is critical.
- Cloud environments require strong API security, key management, and access control.
- Logging and monitoring occur through cloud-native tools (e.g., CloudTrail, Azure Monitor).
- Misconfigurations (e.g., weak storage permissions, open ports) are one of the biggest cloud security risks.
Advantages
- Highly scalable and elastic.
- Lower upfront cost.
- The CSP manages physical and infrastructure security.
- Easy to deploy security tools (virtual firewalls, SIEM, DLP).
Disadvantages
- Data is stored off-site.
- Limited control over underlying infrastructure.
- Requires careful configuration to prevent exposure.
- Relies on CSP availability and connectivity.
3. Hybrid Architecture
A hybrid architecture combines on-premises infrastructure with cloud services.
They work together as a single integrated environment.
For example:
- Sensitive data stored on-premises.
- Applications hosted in the cloud.
- Users access both systems seamlessly.
Hybrid environments are common because many organizations transition to the cloud gradually instead of moving everything at once.
Key Characteristics
- Provides flexibility to keep critical systems on-prem while taking advantage of cloud scalability.
- Requires secure connectivity between the on-prem network and the cloud (VPN, dedicated links).
- Security tools must monitor data flows across both environments.
Security Roles in Hybrid
Hybrid adds complexity:
- The organization must secure on-prem systems and configure security for cloud workloads.
- Cloud and on-prem logs must be collected into a central SIEM.
- Access control must stay consistent across environments.
- Additional security controls are needed for the connection between both environments, such as:
- Encrypted tunnels
- Federated identity management
- Traffic monitoring between cloud and on-prem
Advantages
- Flexibility to deploy workloads where they fit best.
- Can meet strict compliance by keeping sensitive data on-prem.
- Easier gradual migration to cloud services.
Disadvantages
- Higher complexity in security operations.
- Requires expertise in both cloud and on-prem technologies.
- Can create visibility gaps if logging and monitoring are not integrated.
Comparison Summary (CySA+ Exam Focus)
| Feature | On-Premises | Cloud | Hybrid |
|---|---|---|---|
| Control Level | Full control | Limited control | Shared across environments |
| Scalability | Slow, manual | Fast, automatic | Moderate |
| Cost Structure | High upfront cost | Pay-as-you-go | Mixed |
| Primary Risk | Internal vulnerabilities | Misconfigurations, IAM failures | Complexity, integration issues |
| Security Responsibility | Fully internal | Shared responsibility model | Shared + internal responsibilities |
| Monitoring | Internal tools | Cloud-native + SIEM | Unified logging needed |
What CySA+ Wants You to Understand
To pass the exam, be sure you understand:
✔ Major differences between on-prem, cloud, and hybrid
✔ How security responsibilities change in each model
✔ How logging, monitoring, and incident response differ
✔ Which environment provides more control vs. more scalability
✔ Why cloud misconfigurations are dangerous
✔ Why hybrid requires strong integration and visibility
✔ Shared responsibility model and cloud service models (IaaS, PaaS, SaaS)
Final Notes for Students
A security analyst must be able to monitor and protect systems regardless of where they are hosted—on-prem, cloud, or hybrid. Each architecture has different risks and responsibilities, so understanding these differences is essential for the CySA+ exam and for real-world security operations.
