Shared Responsibility Model
Definition
The cloud security split where the provider secures the underlying infrastructure (security of the cloud) and the customer secures their data, identity, configurations and workloads (security in the cloud). Boundary shifts between IaaS, PaaS and SaaS.
- Provider covers
- Security of the cloud (infrastructure)
- Customer covers
- Security in the cloud (data, identity, config, workloads)
- Boundary varies by
- IaaS, PaaS, or SaaS deployment
- Context
- Cloud security architecture
Common questions
How does the responsibility split shift between IaaS and SaaS?+
In IaaS the customer manages more of the stack, including the OS and application configuration, while in SaaS the provider manages nearly everything except the customer's own data and access controls, so the customer's security burden shrinks as service abstraction increases.
Why does misunderstanding this model create incident response problems?+
Organisations sometimes assume the provider secures something that is actually their own responsibility, such as bucket permissions or identity configuration, and that gap in ownership is a common root cause of cloud data breaches.
Related terms
- BYOK / HYOK
- Bring Your Own Key lets the customer supply the master key to a provider KMS, the provider stores it. Hold Your Own...
- Hypervisor
- Software or firmware that creates and runs virtual machines. Type 1 runs on bare metal (ESXi, Xen, KVM, Hyper-V Server). Type 2...
- MeghRaj
- The Government of India cloud initiative launched in 2014 as the GI Cloud, providing shared cloud infrastructure for central and state government...
- MeitY Empanelment
- The Indian Ministry of Electronics and IT framework that certifies cloud service providers fit for government workloads. AWS, Azure, GCP and OCI...
- NIST SP 800-145
- The 2011 NIST Special Publication that codified the definition of cloud computing as five essential characteristics, three service models (IaaS, PaaS, SaaS)...