Shared Responsibility Model
What the Shared Responsibility Model Means
The shared responsibility model is the framework that divides security and operational duties between a cloud provider and its customer. In short, the provider secures the cloud itself, and the customer secures what it builds and stores in the cloud.
A cloud provider such as Amazon Web Services, Microsoft Azure or Google Cloud owns the data centers, physical servers, storage hardware and core networks. Customers rent access to these resources but cannot control the buildings or the underlying hardware. Because of that split, both parties have clear duties, and security gaps tend to appear when one side assumes the other is handling a task.
The exact boundary is not fixed. It moves depending on the type of service, so the same task can belong to the provider in one service and to the customer in another. Check the provider's documentation for each service you use, rather than relying on a general rule. For a general overview, browse all cloud computing articles.
Who Manages What in IaaS, PaaS and SaaS
The more of the technology stack the provider runs, the fewer tasks the customer has to handle. The three main service models divide the duties roughly as follows:
- Infrastructure as a Service (IaaS): the provider runs the physical hardware, facilities and virtualization layer. The customer manages the operating system, applications, data and network configuration. See what IaaS is and how it works.
- Platform as a Service (PaaS): the provider also runs the operating system and runtime environment. The customer manages its application code, its data and how users access the app.
- Software as a Service (SaaS): the provider runs the complete application. The customer still manages user accounts, permissions and the data it puts into the software.
Across all three models, the customer keeps responsibility for its data and for who can access it. Providers offer encryption and access tools, but choosing and configuring them usually falls to the customer. For a side-by-side view, see how the three service models compare.
A Common Example: A Publicly Readable Storage Bucket
Imagine a small company that stores customer invoices in cloud object storage, a service that keeps files in containers called buckets. An employee sets a bucket's access rule to public so a partner can download one file, and nobody changes the setting back.
The provider's storage service works as designed. It did what the setting told it to do. Under the shared responsibility model, the provider secures the storage platform, while the customer decides who may read the data. The exposure is therefore the customer's responsibility, even though the provider's service was involved.
The same logic applies to an open firewall rule on a virtual server or a weak password on a SaaS account. The tool itself may be secure; the configuration is the customer's job.
Frequently asked questions
Who is responsible for data security in the cloud?
The customer is responsible for its own data in every cloud service model. That includes deciding who can access it, classifying sensitive information and using the encryption and access controls the service provides. The provider protects the underlying infrastructure and the services it operates.
Is backing up data the cloud provider's job?
Usually not, or not completely. Providers build storage for durability, which means files are protected against hardware failure. That does not protect against accidental deletion, faulty code or ransomware. Customers should decide what to back up, how often and where copies are kept, and confirm they can restore from them.