What is shared responsibility model?
One of the most dangerous assumptions a business can make is: "I'm in the cloud, so the cloud provider is handling my security."
While cloud providers (AWS, Azure, Google Cloud) are incredibly secure, they aren't responsible for everything. To clarify who does what, the industry uses the Shared Responsibility Model.
The simplest way to remember it is: The provider is responsible for the security of the cloud, and you are responsible for security in the cloud.
Think of moving into a high-end apartment complex:
The Landlord's Responsibility: They ensure the building's structural integrity, maintain the front door locks, install security cameras in the lobby, and make sure the electricity and plumbing work.
Your Responsibility: You have to lock your own front door, choose a strong passcode for your alarm, and be careful about who you give your spare key to. If you leave your balcony door wide open and get robbed, it’s not the landlord's fault.
The line of responsibility shifts depending on whether you are using IaaS, PaaS, or SaaS, but the general split looks like this:
The provider manages the physical and foundational layers. They take care of:
Physical Security: Guards, cameras, and biometric locks at the data centers.
Hardware: Maintaining the physical servers, hard drives, and cables.
Software Layer: The "Hypervisor" (the software that runs Virtual Machines) and the basic networking infrastructure.
You manage everything you put onto those servers. This includes:
Data Protection: Encrypting your files so that even if they are stolen, they can't be read.
Identity & Access Management (IAM): Ensuring that only the right employees have access to the "Delete" button.
Patching: If you run a Virtual Machine, you are responsible for updating its Operating System (like Windows or Linux).
Configuration: Making sure your "S3 Buckets" or storage folders aren't set to "Public" by accident.
The more "managed" the service is, the more the provider takes off your plate:
| Service Type | You Manage | Provider Manages |
| On-Premises | Everything (The whole building) | Nothing |
| IaaS (e.g., EC2) | OS, Apps, Data, Firewalls | Physical hardware & Hypervisor |
| PaaS (e.g., Heroku) | App Code and Data | OS, Hardware, Runtime |
| SaaS (e.g., Gmail) | Your data and User access | Everything else |
The vast majority of cloud security breaches are not caused by hackers "breaking into" AWS or Google. They are caused by misconfigurations on the user's side—like leaving a database password-less or failing to update a server's software.
Understanding the Shared Responsibility Model ensures that there are no "gaps" in your armor. If you assume the provider is backing up your data and they aren't, a single server failure could wipe out your business.
The Shared Responsibility Model is about accountability. The cloud provider gives you a secure "box," but it is up to you to make sure what you put inside that box is locked up tight.