The shared responsibility model

1. Understanding the shared responsibility model #

The cornerstone of cloud security: knowing who is responsible for what.

Who does what? #

The shared responsibility model is a fundamental concept in cloud security. It states that the cloud service provider (CSP) is responsible for security OF the cloud (physical infrastructure, host network, virtualization, core services), while the customer is responsible for security IN the cloud (data, service configurations, identity and access management, deployed applications).

Why this distinction matters #

Misunderstanding this model is the main cause of many cloud security breaches. Customers sometimes assume the provider handles all security, which is not the case. It is crucial to clearly delimit responsibilities to avoid security gaps and ensure a robust defense posture.

2. Breakdown by service model (IaaS, PaaS, SaaS) #

The customer's level of responsibility varies considerably depending on the service consumed.

IaaS (Infrastructure as a Service) #

• Provider responsibility: physical infrastructure, virtualization, core network.
• Customer responsibility: operating systems (OS), middleware, applications, data, network configuration, identity and access management (IAM). The customer has almost full control over the software stack.

PaaS (Platform as a Service) #

• Provider responsibility: physical infrastructure, virtualization, OS, middleware, runtime.
• Customer responsibility: applications, data, configuration of PaaS services, identity and access management (IAM). The customer focuses on developing and deploying their applications.

SaaS (Software as a Service) #

• Provider responsibility: the whole software and hardware stack, from infrastructure to application.
• Customer responsibility: data (content), user and access management (IAM), configuration of the SaaS application's security features. The customer uses the application without worrying about the underlying infrastructure.

3. Governance, compliance and tools #

Ensuring compliance and security with the right practices and tools.

Regulatory frameworks and certifications #

Even if the cloud provider is certified (HDS, PCI-DSS, ISO 27001, GDPR), it is up to the customer to ensure that their own configurations and use of the services comply with these standards. Compliance is a shared responsibility that requires ongoing diligence from the customer.

Security best practices and tools #

Encryption (data at rest and in transit), strict identity and access management (IAM) with the principle of least privilege, network segmentation and regular configuration audits are imperative. Tools such as Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platforms (CWPP) help automate the detection of misconfigurations and strengthen security.

4. Challenges and evolution of the model #

Pitfalls to avoid and future trends in shared responsibility.

Gray areas and common mistakes #

The complexity of cloud services can create gray areas where responsibility is not clearly defined, especially with managed services or multi-cloud architectures. Common mistakes include insecure default configurations, overly permissive access management and unencrypted sensitive data.

The impact of new technologies #

The emergence of technologies such as serverless, edge computing and containers keeps changing this model. Each new abstraction moves the responsibility boundary, requiring constant monitoring and adaptation of security strategies by IT teams.