Explain the shared responsibility model in cloud computing. What security responsibilities belong to the cloud provider, and what belongs to the customer?

Question

Accepted Answer

The shared responsibility model is a fundamental security concept that defines how security obligations are divided between the cloud provider and the customer. Understanding this model is essential because misunderstanding where your responsibilities begin is one of the most common causes of cloud security breaches.

The cloud provider is responsible for security of the cloud. This includes the physical security of data centers, including access controls, environmental protections, and surveillance. It covers the hardware infrastructure including servers, networking equipment, and storage devices. The provider manages the virtualization layer, ensuring isolation between tenants. They also handle the availability and patching of their managed services and the global network infrastructure that connects their regions and availability zones.

The customer is responsible for security in the cloud. This encompasses everything the customer deploys and configures on the cloud platform. It includes identity and access management, determining who can access what resources and with what permissions. Customers must configure network security including security groups, network ACLs, and VPN connections. Data protection through encryption at rest and in transit is the customer's responsibility, as is choosing appropriate encryption keys and managing their lifecycle. Operating system patches and updates on customer-managed instances, application security, and firewall configuration all fall under customer responsibility.

The boundary between provider and customer responsibility shifts depending on the service model. In Infrastructure as a Service like EC2 or virtual machines, the customer has the most responsibility. You manage the operating system, middleware, runtime, and application. The provider only manages the infrastructure below the hypervisor level.

In Platform as a Service like AWS Elastic Beanstalk, Azure App Service, or managed databases, the provider takes on more responsibility including the operating system, runtime, and platform patches. The customer focuses on application code, data, and access controls.

In Software as a Service like Microsoft 365 or Salesforce, the provider manages nearly everything. The customer is primarily responsible for data, user access management, and application configuration.

A practical example illustrates the model well. If you run an EC2 instance and it gets compromised because the operating system was not patched, that is the customer's failure. If the underlying hypervisor has a vulnerability that allows cross-tenant access, that is the provider's failure.

Cloud providers publish detailed shared responsibility documentation. AWS, Azure, and GCP each have clear guides outlining exactly what they manage and what the customer must handle for each service. Reviewing these guides for every service you use is a security best practice that prevents dangerous assumptions about who is protecting what.