Shared Responsibility Model

Moving to the cloud does not hand over all security. The provider looks after the underlying infrastructure: data centres, physical hardware, and the core software that runs the platform. The customer remains responsible for what it puts on top, such as its data, user accounts, configuration and access settings. Where the line falls depends on the service. With infrastructure services the customer manages operating systems and applications; with software services the provider runs most of the stack, and the customer still manages users and data. Most cloud providers publish their version of the split. Many breaches come from customer-side errors, such as open storage or weak access settings, not from provider failure. In an incident review, the first question is often which side owned the failed control, and the model supplies the answer if it was written down beforehand.

A healthcare start-up runs its patient app on a cloud platform. The provider secures the data centre and virtualisation software. The start-up must encrypt the database, restrict who can log in, and apply patches to the servers it manages. A review shows no one owned patching, so the engineering lead takes it on and records it.