Cloud Shared Responsibility Model

Overview

The Cloud Shared Responsibility Model defines the division of security and operational duties between cloud service providers and their customers. It is foundational for understanding how cloud infrastructure, platforms, and services are secured and managed, clarifying which party is accountable for various layers of the environment.

Core Components

• Cloud service layers: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)
• Provider-managed components: physical data centers, hardware, network infrastructure, and foundational software
• Customer-managed components: operating systems, applications, data, identity and access management, and network configurations

How It Works

The model operates by delineating control boundaries where the cloud provider secures the underlying infrastructure, while customers secure their data, applications, and access controls. Data flows through provider-managed networks and hardware, but customers maintain responsibility for configuring and protecting their workloads and identities within the cloud environment.

Trust & Security Model

• Authentication and authorization are jointly managed, with providers controlling infrastructure access and customers managing user identities and permissions within their environments
• Trust boundaries separate provider-controlled infrastructure from customer-controlled workloads and data
• Use of cryptographic keys, credentials, and identity tokens is split accordingly, with providers securing platform keys and customers managing application and data encryption keys

Common Misconfigurations & Weaknesses

• Misconfigured access controls leading to excessive permissions or exposed resources
• Failure to apply security patches or updates on customer-managed components
• Neglecting to encrypt sensitive data or improperly managing encryption keys
• Over-reliance on default security settings without customization

Attack Surface & Abuse Scenarios

• Exploitation of misconfigured identity and access management policies
• Compromise of customer workloads due to insecure application or data configurations
• Abuse of provider APIs or management interfaces if improperly secured
• Cross-tenant risks in multi-tenant environments due to isolation failures

Visibility & Monitoring

• Provider-generated logs and telemetry for infrastructure and platform activities
• Customer-generated logs for application, network, and identity events
• Challenges include limited visibility into provider-managed layers and integration of disparate log sources
• Operational observability requires coordinated monitoring strategies across shared boundaries

Hardening & Security Controls

• Implementing least privilege access and role-based access controls
• Encrypting data at rest and in transit with customer-managed keys where possible
• Regular patching and vulnerability management of customer-managed components
• Utilizing provider security features such as network segmentation, firewalls, and intrusion detection
• Continuous monitoring and automated alerting for anomalous activities

Operational Considerations

• Clear processes for onboarding, configuration changes, and decommissioning of cloud resources
• Ensuring high availability and disaster recovery through provider and customer controls
• Managing dependencies between cloud services and on-premises systems
• Scaling security controls in line with dynamic cloud resource provisioning

Related Domains & Dependencies

• Identity and Access Management (IAM) systems used by customers
• Network protocols and security controls spanning cloud and on-premises environments
• Integration with SaaS platforms and digital identity systems
• Dependency on cloud provider security posture and compliance frameworks

Standards & References

• ISO/IEC 27017: Code of practice for information security controls based on ISO/IEC 27002 for cloud services
• Cloud Security Alliance (CSA) Cloud Controls Matrix
• NIST Special Publication 800-210: General Access Control Guidance for Cloud Systems
• Relevant RFCs on network security and identity management protocols