The Shared Responsibility Model

What it is

The shared responsibility model defines the security boundary between what a cloud provider secures and what the customer is responsible for securing — a foundational concept for reasoning about cloud risk correctly.

Key points

• Provider responsibility: physical data center security, hardware, and the underlying infrastructure (varies by service model — more for managed services, less for raw compute).
• Customer responsibility: data, identity and access configuration, network configuration, and application-level security — always the customer's responsibility, regardless of service model.
• Shifts by service model: with IaaS the customer secures much more (OS patching, network config); with SaaS, the provider handles more, and the customer's responsibility narrows mostly to access control and data.
• The overwhelming majority of real-world cloud security incidents are on the customer's side of this line — misconfiguration, not a provider infrastructure failure — which is exactly why cloud security engineering exists as a discipline.