Shared Responsibility model

The shared responsibility model is a security framework that outlines the division of responsibilities between cloud service providers (CSPs) and their customers. It defines which security tasks are handled by the CSP and which are the responsibility of the customer. This model helps organizations understand their role in securing their data and applications in the cloud.

💡 Why it matters

It clarifies the roles and responsibility between the cloud service provider, whoever that is, and the end customer, which makes sure that everything runs smoothly and also reduces potential risks.

• ⚙️ Efficiency and convenience The cloud provider handles duties of physical security, power, and network connectivity, with the customer managing their own data and also user access.

• 🔐 Data privacy The shared responsibility model makes sure that only the customer has access to data stored in the cloud, which helps maintain privacy and security.

• 🎛️ Flexibility A level of flexibility in which the customer can choose how much they want to be responsible for, versus how much they want the cloud vendor to handle.

Different cloud service types allow the customer to choose how much they are responsible for versus what responsibilities they want to hand off to the vendor to provide.

By defining what exactly both the vendor and customer are accountable for, we can reduce confusion and potential security gaps as a result.

First, we have areas that the cloud provider or cloud vendor will always be responsible for, regardless of our cloud solution. This is going to include anything that requires managing physical access to resources like physical hosts, physical networks, and the physical data center facility itself.

Regardless of our cloud service type, the cloud provider is always going to handle securing the physical assets.

On the other hand, the customer will always be responsible for managing access to information and data, the devices these cloud services run on, and also the accounts and identities of users who will access these different services.

And finally, somewhere in the middle, we have different types of responsibilities that will vary depending on the specific type of cloud service we're talking about. These responsibilities include managing identity and directory infrastructure, applications, network controls, and operating system management. Those services can be Software as a Service Platform as a Service, Infrastructure as a Service, and also on‑premises or traditional computing as a point of comparison.

In this case, in the diagram, we can see that our far left cloud service type, Software as a Service, or SaaS for short, offloads most of our responsibilities to the cloud vendor to manage.

Whereas by comparison, our Infrastructure as a Service cloud service type, or IaaS for short, hands more responsibilities to the customer versus the cloud vendor.

If you look at the far right section of the graph under On‑premises, you can see that compared to our cloud service types, the customer is 100% responsible for the entire stack, including managing access to Physical Hosts, Physical Network, and the Physical Datacenter facility itself.

---

📌 In summary

The shared responsibility model is yet another foundational cloud concept that clearly divides responsibility between what the cloud vendor is responsible and what the customer is responsible for, which has different areas of responsibility depending on the specific cloud service type we are using. Understanding these responsibilities is important to determine the correct service for your specific needs and to prevent unintended security gaps.