Stop 09 · Cloud SecurityTopics · 1/9

Shared Responsibility Model

In short

In the cloud, security is split. The provider guards the building, but you lock your own flat. Many breaches happen because someone thought the other side had it covered.

The cloud provider secures the underlying infrastructure; you're responsible for securing what you configure and deploy on top of it — misunderstanding this split is a common source of real cloud breaches.

The blob locks its own flat door while a guard watches the society main gate behind.

Think of it like this

Renting a flat in a gated society

The society guards the main gate, the boundary wall and the lift. But your own flat door is your job. If you leave it wide open, the guard at the gate cannot help. Cloud security splits duties the same way.

Watch it happen

Who secures what

Provider

Physical data centres
Host hardware and network
Core service uptime

You

Your data and access rules
App config and patching
Who can log in and how

The provider secures the cloud itself; you secure what you put in it. The exact line shifts between service types, so always check it.

The big ideas

What you need to know

The line moves

For raw servers you patch the OS; for a managed database the provider does more. Know the split per service.

Your config, your risk

Most cloud breaches are customer side: an open storage bucket or a too powerful access key, not a provider fault.

Data is always yours

No matter the service type, protecting your data and controlling access stays on your side of the line.

Read the model

Every provider publishes its shared responsibility chart. Read it before assuming anything is handled for you.

Save yourself the pain

Common mistakes

Oops

Assuming the cloud provider secures everything.

Do this instead

They secure the infrastructure. Your data, access rules and app config are yours, and that is where most breaches start.

Oops

Using the same split for every service.

Do this instead

A managed service shifts more to the provider than a raw VM. Check the responsibility line for each service you use.

Your mission

Draw your responsibility split

~25 min

Quick check

A customer's storage bucket is left public and data leaks. Whose responsibility is that in the shared model?

Go deeper

1Read your target cloud provider's official shared responsibility model diagram.
2List 3 specific things that remain your responsibility even on a fully managed cloud service.
3Learn why 'the cloud got hacked' is almost always actually a customer misconfiguration.