Security Foundations • 09 / 09

The Shared Responsibility Model

In cloud environments, security is not the provider's problem alone. Responsibility is explicitly divided — and the gap between the two parties is where most breaches happen.

As organizations move workloads to cloud services, a fundamental question arises: who is responsible for securing what? The Shared Responsibility Model provides the answer — it explicitly divides security obligations between the cloud provider and the customer based on the service model in use. Neither party can assume the other has it covered.

Customer Customer's responsibility to secure
Provider Cloud provider's responsibility
Shared Shared — both parties contribute
IaaS
Infrastructure as a Service
e.g. AWS EC2, Azure VMs, GCP Compute
Data & ClassificationCustomer
ApplicationsCustomer
Runtime & MiddlewareCustomer
Operating SystemCustomer
Identity & AccessCustomer
Network ConfigShared
Physical ServersProvider
Data Center & NetworkProvider
Physical SecurityProvider
PaaS
Platform as a Service
e.g. Azure App Service, Google App Engine
Data & ClassificationCustomer
ApplicationsCustomer
Identity & AccessCustomer
Runtime & MiddlewareShared
Operating SystemProvider
Network ConfigProvider
Physical ServersProvider
Data Center & NetworkProvider
Physical SecurityProvider
SaaS
Software as a Service
e.g. Microsoft 365, Salesforce, Google Workspace
Data & ClassificationCustomer
Identity & AccessCustomer
Endpoint DevicesCustomer
ApplicationsProvider
Runtime & MiddlewareProvider
Operating SystemProvider
Network ConfigProvider
Physical ServersProvider
Physical SecurityProvider

Key pattern: As you move from IaaS → PaaS → SaaS, the provider takes on more responsibility — and the customer's surface area shrinks. But customers never escape full responsibility for their data classification, identity management, and endpoint security regardless of service model.

The gap is where breaches happen. Most cloud security incidents are not provider failures — they are customer misconfigurations, identity failures, or assumptions that the provider was covering something the customer actually owns. Before deploying any cloud workload, explicitly document where the handoff occurs. Gaps at that boundary are where attackers find their way in.