What is the shared responsibility model in cloud security?

What is the shared responsibility model in cloud security?

• A. Security is not needed.
• B. Cloud security is the same as on-prem.
• C. Provider handles all layers.
• D. Provider handles some layers; customer handles others.

Answer: (D)

Security duties are shared between you and the cloud provider. The provider takes care of security “in the cloud” for the underlying infrastructure—physical data centers, network, virtualization, and foundational services. You handle security “in the cloud” for what you put on top of that: your data, how it’s accessed, who can use it, how applications are configured, and how you monitor and respond to threats. The exact split depends on the service model. In infrastructure as a service, the provider handles the hardware, virtualization, and core services, while you manage guest operating systems, installed software, data, encryption, and access controls. In platform as a service, the provider takes on more of the stack, and you focus mainly on data and user access/configuration. In software as a service, the provider manages most of the stack, and you mainly govern data, permissions, and usage policies. A practical takeaway is to always know which parts you’re responsible for in your setup, and ensure proper configurations and access controls to avoid common risks like misconfigured storage or weak identity management. For example, with object storage, the provider may handle encryption and basic access, but you must set proper access policies and manage keys. With a SaaS app, the provider secures the app itself, while you ensure correct user access and data handling.

Security duties are shared between you and the cloud provider. The provider takes care of security “in the cloud” for the underlying infrastructure—physical data centers, network, virtualization, and foundational services. You handle security “in the cloud” for what you put on top of that: your data, how it’s accessed, who can use it, how applications are configured, and how you monitor and respond to threats.

The exact split depends on the service model. In infrastructure as a service, the provider handles the hardware, virtualization, and core services, while you manage guest operating systems, installed software, data, encryption, and access controls. In platform as a service, the provider takes on more of the stack, and you focus mainly on data and user access/configuration. In software as a service, the provider manages most of the stack, and you mainly govern data, permissions, and usage policies.

A practical takeaway is to always know which parts you’re responsible for in your setup, and ensure proper configurations and access controls to avoid common risks like misconfigured storage or weak identity management. For example, with object storage, the provider may handle encryption and basic access, but you must set proper access policies and manage keys. With a SaaS app, the provider secures the app itself, while you ensure correct user access and data handling.