Who Secures What In A Cloud Environment? – Shared Responsibility Model

Have you been wondering who secures what in the cloud environment? Then you’ve been wondering about the Shared Responsibility Model.

Full Course

Video Summary

Here are the key points from the video:

• Types of Cloud Services: There are three main types: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Each type varies in management responsibilities between you and the cloud provider.
• On-Premises Management: In an on-premises setup, you manage everything from storage to the data center, networking, and applications.
• Shared Responsibility Model: Security in the cloud is a shared responsibility between the cloud provider and the customer. The provider secures the base infrastructure, while you manage identities and application settings.
• Responsibilities by Service Type:
  • IaaS: You manage the operating system, applications, and data.
  • PaaS: You manage the applications and data, while the provider handles the infrastructure.
  • SaaS: The provider manages most security settings, but you are responsible for accounts, identities, and data.
• Importance of Security: It’s crucial to understand your security responsibilities for each cloud service type. Even with SaaS, you need to secure accounts and data, and enable features like multi-factor authentication to protect your environment.

For more information, read the transcript blog below, or watch the video above!

Video Transcript

Let’s start by talking about the shared responsibility model or who secures what in a cloud environment. If we take a step back and look at cloud computing in general, there are multiple types of computing services. The three main ones are Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). What really differs between those deployment models is how much you manage versus how much the cloud vendor manages. Let’s start with on-premises, where it’s pretty easy: you’re the one that manages everything from storage to the data center, networking, virtualization, and applications on top of it. Infrastructure as a Service delivers cloud computing infrastructure to organizations, including things such as servers, networks, and storage via virtualization technology. You, as the client, still manage the operating system, the applications, the data, and all of that. Platform as a Service provides cloud components to certain software, mainly for applications. It provides a framework for developers to build upon to create customized applications. All of the servers, storage, and networking are managed by the cloud provider, while the developer can maintain management of the applications and data on top of it. Our last option is Software as a Service, in which you simply enjoy the service, pay a fee, but you don’t really manage anything at all. Everything is managed by the vendor. A majority of Software as a Service applications run directly through web browsers and don’t even require any downloads or installations from the client.

Something to also be aware of is that while we separate the workloads into different service types, most organizations will actually use products from each service type. For example, your organization might be using Azure Virtual Machines and Azure Storage, which would be in Infrastructure as a Service. You are also probably using Azure Logic Apps, Azure Functions, Azure Web Apps, or Azure Automation, which are Platform as a Service solutions. If your company also uses productivity solutions such as SharePoint Online, OneDrive for Business, and Microsoft Teams, you’re also leveraging Software as a Service solutions, all while in the Microsoft cloud.

Now, why is this important for security? Security in the cloud is a partnership between the cloud provider and you. At a high level, the cloud provider operates and secures the base infrastructure and most of the time the host operating system layers, while you control and secure identities as well as additional application settings, for example, turning on multi-factor authentication or turning it off. This is not a set-in-stone list; the responsibility highly depends on the service type that you have hosted. For example, in Infrastructure as a Service, the customer has more responsibilities than in Software as a Service.

So, let’s take a look at who secures what in the cloud based on the three cloud service types that we talked about. This is also called the shared responsibility model. Let’s start with on-premises, which is the easiest because, basically, on-premises, the customer is responsible for securing everything from the physical data center to the network, host, applications, all the way to the information and data. If we move on to Infrastructure as a Service, the cloud provider now takes care of the physical data center, the physical network, and host. However, everything over it, such as the operating system, applications, accounts, and identities, falls under your responsibility as a client. Moving on to Platform as a Service, the customer has fewer things to worry about, and some of them are even a split responsibility. Remember that Platform as a Service allows customers to put their own code on a platform run by the provider. So, for the application part, if the code that you add contains vulnerabilities, it’s your responsibility, not the cloud provider’s. Different things such as accounts and identities, devices, and information and data are still the responsibility of the customer. Lastly, in Software as a Service, the cloud provider hosts and is therefore responsible for most security settings. Even in this service type, security will always be a partnership, and the customer is responsible for accounts and identities, devices, data governance, and information as well as the data.

As you can see, even if from a hosting perspective, Software as a Service is the one where the cloud provider hosts everything, from a security perspective, it’s still a partnership. To give you an example, if an employee gets their device stolen and it doesn’t have a password, and then the person that steals the device has access to the data, that is your responsibility, not the cloud provider’s. The same thing applies if somebody clicks a ransomware link and accidentally gives their password away to a bad actor. It’s not the cloud provider’s responsibility that the user got hacked and sensitive data was accessed; it’s your responsibility. Of course, cloud providers will offer you multiple ways to help you secure your cloud workloads, such as multi-factor authentication, but it’s your responsibility to turn those features on for your users. If there’s something important to remember, it’s that it’s really your duty to understand and know what your security responsibilities are for each type of product and workload that you leverage in the cloud. The shared responsibility model is your guide to who secures what, but never forget that some things will always be your own responsibility.