Security Shared Responsibility Model

Security is shared, not outsourced

Providers secure the cloud—physical data centers, hardware, and the global infrastructure. You secure what you put in the cloud—accounts, identities, data classification, network rules, guest OS patching on IaaS, and application code.

Responsibility shifts by service

On IaaS you patch the operating system. On managed databases or PaaS, the provider patches more of the stack, but you still configure access, encryption keys you manage, and application logic. On SaaS you mainly manage users, data, and sharing settings.

Baseline habits

• Turn on MFA and avoid shared passwords
• Encrypt sensitive data at rest and in transit
• Restrict network access with security groups and private subnets
• Log admin actions and review them
• Apply least privilege in IAM

Assume breaches in design

Ask what happens if one key leaks or one VM is compromised. Segmentation, short-lived credentials, and backups matter as much as firewalls.