Cloud fundamentals
Moving to the cloud doesn't make security someone else's problem — it splits the problem in two, and where the line falls depends on what you're buying.
The provider's job: physical data-center security, host hardware, the virtualization layer, and the global network — the infrastructure everything else runs on top of. Customers can't inspect or change this layer, and generally don't need to.
The customer's job: what you configure and put on top — data, access permissions, network rules, and (depending on the service) the OS and application code. Most real-world cloud breaches trace back to a misconfiguration here, not a failure of the provider's infrastructure.
The more managed the service, the more the provider absorbs — but the customer is never fully off the hook.
| Model | Provider handles | Customer handles |
|---|---|---|
| IaaSAWS EC2 · Azure VMs · GCP Compute Engine | Physical hosts, hypervisor, networking, storage hardware, facility security | Guest OS patching, runtime, applications, data, network/firewall config, IAM |
| PaaSAWS RDS · Azure App Service · GCP Cloud SQL | Everything in IaaS, plus the OS, runtime patching, and platform availability | Application code, data, access configuration, and how the service is used |
| SaaSGoogle Workspace · Microsoft 365 · Salesforce | Nearly the entire stack, including the application itself | Data entered into the service, user access, and account-level configuration |
The underlying split is nearly identical — the language and emphasis differ slightly.
Calls it the "Shared Responsibility Model" — AWS is responsible for security of the cloud, the customer is responsible for security in the cloud.
Uses the same "Shared Responsibility Model" name and the same of/in split, with a chart showing responsibility shifting further toward Microsoft as you move from IaaS to SaaS.
Uses "Shared Fate" — framing security as a partnership rather than a strict handoff: Google takes on more operational responsibility (e.g. secure-by-default infrastructure) and provides guidance/tooling to help customers hold up their side, rather than leaving them fully on their own.
Think of it like renting an apartment. The landlord secures the building — the foundation, the locks on the main entrance, the fire suppression system. You secure your own unit — you lock your door, you don't prop a window open, and you decide who gets a key. If someone walks in because you left the door unlocked, that's not a building failure.
See shared responsibility model and IAM in the Glossary, and least-privilege IAM in Production Security & Deployment Models.
