Cloud security
What is Shared responsibility model?
Definition
The division of security duties between a cloud provider and its customer: the provider secures the cloud itself, and the customer secures what they put in it.
How it works
The provider is responsible for physical data centres, hardware and the core services. The customer is responsible for their data, identities, access permissions and configuration. Exactly where the line falls depends on the service: more for infrastructure, less for software as a service.
Misunderstanding this split is a common cause of cloud incidents.
Key points
- The provider secures the cloud
- The customer secures data, identities and configuration
- The split varies across IaaS, PaaS and SaaS
- Identity and configuration are always the customer’s job
Common questions
Is Microsoft 365 data backed up by Microsoft?
Microsoft provides resilience for the service, but retention and backup of your data are largely your responsibility.
Who is responsible for a misconfigured bucket?
The customer.
Talk to someone who does this every day
Questions about Shared responsibility? Our team will give you a straight answer.