Skip to content

Beginner · What cloud computing is · topic 5 of 50 · 25 min

The shared responsibility model

Explanation

Security in the cloud is split. The provider secures the cloud itself: buildings, hardware, network and the virtualisation layer. You secure what you put in the cloud: your data, who can log in, your settings and, on IaaS, the operating system. The more managed the service, the less you do, but your data and access are always yours.

Why it is shared

When you rent a server in someone else's data centre, you cannot guard their building, and they cannot decide who in your company gets a password. So the work is split. Every big provider publishes a shared responsibility model that draws the line. AWS sums it up in a phrase worth remembering: the provider is responsible for security OF the cloud, and the customer is responsible for security IN the cloud.

Think of it like this: Think of renting a flat in a gated society. The society guards the gate, maintains the lift and fixes the building wiring (security of the building). You lock your own door, decide who gets a key and do not leave your cash on the balcony (security in your flat). If you leave your door open, the guard at the gate cannot save you.

The provider: security OF the cloud

  • Physical security of data centres: guards, cameras, access control.
  • Hardware: servers, disks, network equipment, and destroying old disks safely.
  • The global network between data centres.
  • The virtualisation layer (the hypervisor), which keeps one customer's VMs separate from another's.
  • The software of managed services, such as patching the database engine in a managed database.

The customer: security IN the cloud

  • Your data: what you store, how sensitive it is, and whether it is encrypted.
  • Identity and access: users, passwords, MFA (a second login check, such as a code from a phone app), and permissions.
  • On IaaS: patching the guest OS and the software you install on it.
  • Network rules: firewalls such as security groups, and which ports are open to the internet.
  • Configuration: for example whether a storage bucket is public or private.
  • Encryption choices: turning encryption on and managing keys where the service leaves that to you.

How the line moves with the service model

TaskIaaS (EC2)PaaS (RDS, App Service)SaaS (Microsoft 365)
Physical data centre and hardwareProviderProviderProvider
Guest OS patchingCustomerProviderProvider
Application codeCustomerCustomerProvider
Network controls (firewall rules)CustomerSharedProvider
User accounts and permissionsCustomerCustomerCustomer
Your dataCustomerCustomerCustomer

"Shared" means both sides have a part. On a PaaS, for example, the provider runs the network underneath, but you still decide which IP addresses may reach your database. Exact splits differ slightly between providers and services, so read the model for the service you use.

Real breaches are usually the customer side

Most cloud data leaks reported in the news were not the provider being hacked. They came from customer settings. Common patterns over the years: a storage bucket of customer records left open to the public internet; access keys pasted into code and pushed to a public GitHub repository, where bots find them within minutes; a database port open to the whole internet with a weak password; and a server role with far more permissions than it needed, which turned one small bug into a large leak. In each case the provider's part worked; the customer's part did not.

Careful: Common mistakes: (1) "AWS will patch my EC2 server." It will not; on IaaS the guest OS is yours. (2) "My data is in the cloud, so it is backed up." Backups and their retention are your setting on most services. (3) "Using SaaS means security is not my job." You still manage users, MFA, sharing settings and data. (4) Making a bucket public "just for testing" and forgetting it.
Tip: India's CERT-In directions of April 2022 require organisations to report certain cyber incidents to CERT-In within 6 hours of noticing them, and to keep logs for 180 days. Providers give you logging tools, but turning them on and keeping the logs is part of security IN the cloud.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

The shared responsibility model · 1/6

Shared responsibility

Security in the cloud is shared between the provider and you, the customer.

Prefer a video by a teacher? Find free videos on “AWS shared responsibility model explained” on YouTube ↗

In real life: A coaching institute's leaked student list

A coaching institute in Kota stores a spreadsheet of student names and phone numbers in a cloud storage bucket so a vendor can download it. The developer makes the bucket public to "save time". Weeks later, a security researcher finds the file through an automated scan and emails the institute. The provider's data centre was never breached: the setting was the customer's responsibility. The fix: make the bucket private, give the vendor a time-limited download link instead, turn on the provider's "block public access" setting for the whole account, and follow the DPDP Act and CERT-In steps for a personal data incident.

Practice (0/3 done)

Task 1 · Question

You run a website on an EC2 virtual machine. Who must install security updates for its Linux operating system?

Task 2 · Code · Python

Write responsibility(task, model) that returns "provider", "customer" or "shared". model is "IaaS", "PaaS" or "SaaS". Use this table: "physical security" is provider in all models; "data" and "user accounts" are customer in all models; "os patching" is customer on IaaS and provider on PaaS and SaaS; "application code" is customer on IaaS and PaaS and provider on SaaS; "network controls" is customer on IaaS, shared on PaaS and provider on SaaS.

Task 3 · Code · Python

A quick audit script. buckets is a list of dicts like {"name": "kyc-docs", "public": True, "purpose": "private"}. Only buckets whose purpose is "website" may be public. Write risky_buckets(buckets) that returns the names of buckets that are public but whose purpose is NOT "website", in the order given.

Quick quiz

Question 1

1.In AWS's phrase, what is the customer responsible for?

Question 2

2.Which task stays with the customer in IaaS, PaaS AND SaaS?

Question 3

3.A company's storage bucket of invoices was left public and was downloaded by strangers. Whose responsibility was that setting?

Question 4

4.Under CERT-In's April 2022 directions, how quickly must certain cyber incidents be reported?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

In AWS's phrase, what is the customer responsible for?

Answer: Security IN the cloud

The provider handles security OF the cloud; the customer handles security IN the cloud.

Which task stays with the customer in IaaS, PaaS AND SaaS?

Answer: Managing who can access the data

Data and user access are always the customer's job.

A company's storage bucket of invoices was left public and was downloaded by strangers. Whose responsibility was that setting?

Answer: The customer's

Bucket access settings are configuration, which is security IN the cloud.

Under CERT-In's April 2022 directions, how quickly must certain cyber incidents be reported?

Answer: Within 6 hours of noticing them

CERT-In asks for reporting within 6 hours, and for logs to be kept for 180 days.

In every cloud model, who is responsible for the customer's data and user access?Related

Answer: The customer

Data and identities are always on the customer side.

From The shared responsibility model

In IaaS, who patches the guest operating system of a VM?Related

Answer: The customer

In IaaS the provider runs the hardware and virtualisation; the OS and above are yours.

From IaaS, PaaS, SaaS and serverless

Who empanels cloud service offerings for Indian government departments?Related

Answer: MeitY

The Ministry of Electronics and Information Technology (MeitY) runs the empanelment.

From Public, private, hybrid and multi-cloud

Gmail used by a company is an example of which service model?Related

Answer: SaaS

With SaaS you only use the finished software; the provider runs everything else.

From Virtualisation, VRFs and cloud networking

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: Creating and securing an AWS account →

Next steps

  1. This is the last topic of “What cloud computing is”. The module exam comes next.
  2. Module 1 exam: What cloud computing is · 13 questions · 20 min, without help. 5 topics of this module still to finish first.
  3. Then the next module, AWS account, IAM and billing. 50 topics left in the course before the final exam.

← Previous: Regions, availability zones and edge locations