What is the Shared Responsibility Model?
The shared responsibility model is a concept commonly used in cloud computing to define the division of management responsibilities between a cloud service provider (CSP) and its customers.
Cloud Service types, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), however, play a huge role in deciding the division of responsibilities.
Here we have a generalized view of the shared responsibility model:
Cloud Service Provider (CSP) Responsibilities:
Physical Security: The CSP is responsible for the security and protection of the physical infrastructure, including data centers, networking equipment, and servers.
Network Security: The CSP manages and secures the network infrastructure, ensuring proper isolation and protection between different customer environments.
Hypervisor Security: In virtualized environments, the CSP is responsible for securing the hypervisor layer that enables virtual machine deployment and management.
Patching and Upgrades: The CSP is responsible for keeping the underlying infrastructure up to date with security patches and updates.
Availability and Resilience: The CSP ensures that the cloud services are available and resilient, often by employing redundancy, backup systems, and disaster recovery measures.
Customer Responsibilities:
Data Security:
Customers are responsible for protecting the data they store or process within the cloud environment.
This includes data encryption, access controls, and data classification.
Application Security:
Customers are responsible for securing the applications they develop and deploy in the cloud, including coding practices, vulnerability management, and access controls.
Identity and Access Management (IAM):
Customers are responsible for managing user access to their cloud resources,
This includes user authentication, authorization, and access control policies.
Configuration Management:
Customers are responsible for properly configuring their cloud resources and services using firewall rules, network settings, and storage access controls.
Data Backup and Recovery:
Customers are typically responsible for backing up their data and implementing appropriate disaster recovery measures.
Now, let’s understand the model service-wise!
Infrastructure as a service:
Resources, that are built on top of the physical layer are managed by the customer.
The physical layer is managed by the CSP.
Platform as a service:
Here, as we get the desired platform on demand, its security, maintenance, runtime, and everything is managed by CSP.
Software as a service:
As we get the software on demand, we are just concerned with the high availability of software.
Here you do not manage most of the elements of stack, sometimes you do not control anything!
*Note= This is a generalized article on the model, This can vary from CSP to CSP.
