AiVibeShared Responsibility Model
The shared responsibility model defines which security and operational duties a cloud provider handles and which remain with the customer, with the split shifting according to whether the service is IaaS, PaaS or SaaS.
The shared responsibility model describes how security and operational duties are divided between a cloud provider and its customer. The provider is responsible for security of the cloud: physical data centres, hardware, networking and the virtualisation or managed-service layer. The customer is responsible for security in the cloud: identities and access, data, configuration and, depending on the service, operating systems and application code. AWS, Microsoft Azure and Google Cloud each publish their own description of the model.
The split moves with the service model. With IaaS the customer manages the guest operating system and everything above it; with PaaS the provider also runs the operating system and runtime; with SaaS the customer mainly controls users, data and settings. Organisations use the model to assign ownership in contracts, architecture reviews and audits, and to avoid the false assumption that the provider secures everything.
Many cloud data exposures trace back to customer-side misconfiguration, such as publicly accessible storage buckets or over-permissive access policies, rather than failures of the provider's infrastructure. Cloud security posture management tools and the CIS Foundations Benchmarks published for the major clouds help customers check their side. ISO/IEC 27017, a code of practice for cloud security controls, reflects the same division of roles between provider and customer.
Key points
- The provider secures the cloud itself; the customer secures what it puts in the cloud
- Customer duties shrink from IaaS to PaaS to SaaS but never disappear
- Identity, data and configuration always remain customer responsibilities
- Customer-side misconfiguration is a common cause of cloud data exposure
Where AiVibe comes in
AiVibe Software Services delivers cloud solutions on AWS, Microsoft Azure, Google Cloud or on-premise, together with cloud security, legacy modernisation, data analytics and AI and machine learning services.
Related terms
- Infrastructure as a Service (IaaS)Cloud & AI Infrastructure
- Platform as a Service (PaaS)Cloud & AI Infrastructure
- Software as a Service (SaaS)Cloud & AI Infrastructure
- Identity and Access Management (IAM)Cloud & AI Infrastructure
- ISO/IEC 27001Cybersecurity & Compliance
- Zero Trust Architecture (ZTA)Cybersecurity & Compliance