What is the shared responsibility model in the cloud?
Options
- The provider secures the cloud; you secure what you put in it (Correct option)
- The provider is responsible for everything that runs in the cloud
- The customer is responsible for the data centers and hardware
- There is no division of duties, so each case is negotiated
Answer
The provider secures the cloud itself (hardware, data centers, core services); you secure what you put in it (data, identities, configuration, your code)
Why
Security of the cloud (provider): physical data centers, hardware, hypervisor, managed service internals.
Security in the cloud (you): who has access (IAM), how storage and networks are configured (public S3 buckets are a classic mistake), patching your VMs, encrypting data, your application code.
The more managed the service (SaaS over IaaS), the more the provider handles.
Remember
Provider secures the cloud; you secure what is in it.