Select Page

What is the shared responsibility model?

The Shared Responsibility Model is a cloud security framework that dictates the security obligations of the cloud provider and its users for accountability. The framework defines which components is the cloud service provider (CSP) responsible for and which need to be protected by the user/customer.

It generally states that the CSP is responsible for the security of the cloud while the client is responsible for the security of the data in the cloud.

For services, applications, and controls between these ownership levels, security responsibility varies by cloud provider and service type. For example, a cloud client has more security responsibilities in an Infrastructure as a Service (IaaS) model than in a Software as a Service (SaaS) model.

Shared Responsibility Model Explained Using AWS EC2 Example

For example, a service such as Amazon Elastic Compute Cloud (Amazon EC2) is classified as Infrastructure as a Service (IaaS) and requires the customer to perform all necessary security and management tasks.

When customers deploy Amazon EC2 instances, it manages the guest operating system, any applications they install on those instances, and the firewall configuration provided on those instances.

Customer is responsible for and manages the configuration of the guest operating system (including updates and security patches), other related application software, and AWS-provided security group firewalls. To ensure security in this cloud environment, the client configures and manages the security of the guest operating system and other applications, including updates and security patches, as well as security group firewalls.

Moreover, the client is also responsible for data control, asset classification, and implementing appropriate permissions to manage identity and access. This puts the primary responsibility for properly configuring the security of the provided service on the client, such as applying permissions at the IAM platform and user/group level.

Shared Responsibility of PaaS versus IaaS

Under PaaS, the provider also assumes full responsibility for hosting the physical infrastructure and network security, while sharing responsibility with the customer at the application and access control level.

While IaaS clients retain most of the control, they can rely on the CSP to manage physical, infrastructure, network, and virtualization security. If you use your CSP applications in a SaaS model, you are not responsible for the security of the applications. For example, if you use your applications in the cloud as PaaS or IaaS, you are responsible for their security. You are responsible for protecting your data and identities, on-premises resources, and the cloud components you manage (depending on the type of service).

User/Customer Responsibility: Traditional Data Center versus Cloud

In the traditional data center model, you are responsible for securing the entire operating environment, including applications, physical servers, user controls, and even the physical security of buildings. Your operations team must work closely with security professionals to maintain policy-based control over how and when cloud resources are provisioned. By partnering with a cloud service provider and sharing some of the responsibility for security, you can maintain a secure environment with lower operating costs.

By outsourcing responsibilities to a cloud service provider, organizations can achieve greater security, allowing them to reallocate security resources and budget to other business priorities. In the cloud, your provider offers valuable assistance to your teams by taking on many of the operational burdens, including security. Control over the security of your cloud workloads makes your organization more prepared to detect threats and resolve issues quickly.

How to leverage the shared responsibility model for your workloads

Putting the concept of shared security into practice for cloud workloads requires evaluating the details of how these workloads are configured. The key to successfully implementing security in the cloud is understanding where your vendor’s responsibility ends and yours begins. Understanding customer security responsibilities is the first step to protecting your data in the cloud.

In order to fully take into account, the overall responsibility for security, it is necessary to maintain complete transparency of the cloud environment.

In a shared security responsibility model, when you move applications, data, containers, and workloads to the cloud, your security team is responsible for security, and the provider has some, but not much, responsibility.

When it comes to “shared responsibility,” it’s important to understand that you and your cloud service provider will never share responsibility for any aspect of your security operations. Additionally, you remain responsible for securing everything in your organization that connects to the cloud, including the on-premises infrastructure stack and user devices, your own network and applications, and the communication layer connecting internal and external users.

Essentially, your cloud provider is responsible for ensuring that your infrastructure built on its platform is secure and reliable from the outset. But in either model, you need to take an active role in your cloud deployment, setting up your CSP security controls and monitoring your cloud solution to ensure your data is protected.

In the case of IaaS, the CSP is typically responsible for protecting the physical aspects of managing the infrastructure, while the customer is responsible for protecting the configuration and internal operation of the provisioned cloud resources. Under IaaS, the cloud service provider is solely responsible for the physical resources and shares responsibility for infrastructure and host network security with the customer; everything else is the responsibility of the customer.

Interested in using cloud storage that leverages the shared responsibility model? Talk to StoneFly pre-sales engineers today to discuss your projects.

The Spear Phishing Survival Guide

The Spear Phishing Survival Guide

Spear phishing stands as the favored gateway for ransomware delivery and infiltrating corporate networks. Shockingly, 36% of data breaches in 2022 involved phishing, with 25% utilizing email as the ransomware attack vector. Guarding against cyber threats and...

Understanding Detection and Response: EDR vs MDR vs XDR vs NDR

Understanding Detection and Response: EDR vs MDR vs XDR vs NDR

In a digitally transformed landscape fraught with ever-evolving cyber threats, the acronyms EDR (Endpoint Detection and Response), XDR (Extended Detection and Response), MDR (Managed Detection and Response), and NDR (Network Detection and Response) have become...

Trigona Ransomware: What is it and How to Defend Against it

Trigona Ransomware: What is it and How to Defend Against it

In an ever-evolving digital landscape, the specter of ransomware looms large, and Trigona stands as a significant player in the realm of cyber threats. This blog delves into the multifaceted world of Trigona ransomware, unraveling its origins, unique characteristics,...

Lockbit Ransomware: Inside the Cyberthreat and Defense Strategies

Lockbit Ransomware: Inside the Cyberthreat and Defense Strategies

In the constantly evolving arena of cybersecurity, the digital landscape is fraught with adversaries lurking in the shadows, ready to exploit vulnerabilities and disrupt the operations of organizations. Among these threats, LockBit ransomware has emerged as a...

What Defending Against Ransomware-as-a-Service (RaaS) Entails

What Defending Against Ransomware-as-a-Service (RaaS) Entails

Ransomware has evolved, becoming a thriving business model for cybercriminals. Ransomware-as-a-Service (RaaS) exemplifies this transformation—a lethal alliance between the creators and distributors of ransomware. It’s no longer a threat relegated to tech...

You May Also Like

WordPress PopUp Plugin

Subscribe To Our Newsletter

Join our mailing list to receive the latest news, updates, and promotions from StoneFly.

Please Confirm your subscription from the email