Shared responsibility model

The shared responsibility model is the split of security duties between a cloud provider and its customer. The provider secures the buildings, the machines and its own software. The customer secures everything it puts inside: its accounts, its settings, its programs and its data. Every large cloud provider publishes a chart that shows where this line falls for each of its services.

Here is how it works in general. The line moves with the kind of service the customer rents. If the customer rents a bare virtual server, the provider secures the hardware and the network, and the customer must patch the operating system, set the firewall rules and protect the data. If it rents a managed database, the provider also patches the database software, but the customer still decides who may read the data. If it rents a finished app, called SaaS, the provider runs almost everything. Even then, the customer still controls its users, their permissions and the app's settings. Three things always stay with the customer: its data, its users' logins and who may access what.

Most cloud breaches happen on the customer's side of the line. The usual causes are a storage folder left open to the internet, a permission wider than needed, or a leaked access key. The provider did nothing wrong in these cases. Regulators take the same view. In India, the RBI expects a bank to remain responsible for its data even when a cloud provider runs the systems.

Take, for example, a storage bucket, a folder of files in the cloud, that a developer opened to the internet for a quick test. Cloud security posture management checks every account's settings and flags the open bucket.

Consider a sales team that uses a rented customer-records app. The app itself is the provider's job, but a setting that lets guest users read records is the customer's. SaaS security posture management finds settings like this.

Say a company runs an old version of its web software on a cloud server. Patching it is the company's job, and cloud workload protection watches that program while it runs.

How is the shared responsibility model different from a managed service? In a managed service, a company pays another firm to do certain jobs for it by contract, such as watching its alerts at night. In the shared responsibility model, the line is set by the kind of cloud service bought. In both cases, the responsibility for the data stays with the company. Confidential computing goes one step further: it keeps data hidden even from the cloud provider.