Public cloud vs private cloud vs hybrid cloud.

Public, private and hybrid describe who a cloud is built for. A public cloud is open to any customer, a private cloud serves one organisation only, and a hybrid cloud joins two or more clouds together. The definitions below are those of the US National Institute of Standards and Technology (NIST), which the Australian Signals Directorate (ASD) also uses.

Public cloud

A public cloud is set up for open use by the general public. It sits on the provider’s premises, and anyone can become a customer. The provider’s equipment is pooled and serves many customers at once, with software keeping each customer’s systems and data apart.

Most cloud services a small business signs up for online are public cloud.

Private cloud

A private cloud is set up for the exclusive use of one organisation. Nobody else’s systems run on it.

Private says nothing about where it is. Under NIST’s definition a private cloud may be owned, managed and operated by the organisation, by a third party, or by both, and it may be on or off the premises. A private cloud can therefore live in a provider’s data centre and be run by that provider’s staff.

Hybrid cloud

A hybrid cloud is two or more separate clouds that stay separate but are tied together by technology that lets data and applications move between them. NIST’s example is an application that normally runs in one cloud and spills into a second when demand peaks.

The word is often used more loosely, for an office server that works alongside a cloud service. If a supplier offers you a hybrid setup, ask which two environments they mean and what actually moves between them.

The real difference

The models differ in who shares the equipment and who it is built for. They do not differ in who is accountable for the data. ASD’s guidance says the customer always carries the risk of its data being stolen, changed or made unavailable, and cannot outsource that risk to a provider.

Keeping systems in house is not automatically the safer option either. ASD asks organisations to weigh cloud risks against an honest assessment of their own systems, which may be poorly secured or less available.

How to choose

• Public cloud suits most small businesses. There is no hardware to buy and capacity is available on demand. ASD advises favouring services where the provider carries more of the security work.
• Private cloud fits when a contract or a regulator requires that your systems are not shared with other customers. Someone has to build and run it for you alone, so expect to pay for that.
• Hybrid cloud fits when some systems have to stay where they are and others can move, and the two need to work together.

Before choosing, list what each system needs: who uses it, how sensitive the data is, and which country it must stay in. When the cloud is the right choice, and when it isn’t goes through those questions, and IT consulting is the service to ask about a plan.