Moving a workload to the cloud does not transfer every security duty to the provider. The shared responsibility model divides work between the cloud provider and the customer. The provider generally secures the underlying cloud infrastructure, while the customer remains responsible for how services, identities, data and applications are configured and used.
The boundary changes with the service model. Understanding it prevents a common mistake: assuming that a technically secure platform automatically makes every deployed workload secure.
Security of the cloud
Cloud providers operate physical data centres, networking equipment, storage hardware and the software layers that deliver managed services. They protect facilities, maintain core infrastructure and provide service-level controls.
Customers do not normally patch a physical host or inspect a data-centre door. They rely on provider documentation, certifications and contractual commitments for those layers.
Security in the cloud
Customers control identities, permissions, data classification, application code and many network settings. They decide who can access a storage bucket, whether sensitive data is encrypted appropriately and which workloads are exposed to the internet.
Provider tools help, but the customer must configure and monitor them. A publicly accessible database caused by a permissive rule remains a customer risk even if the managed database engine is fully patched.
How IaaS changes the boundary
Infrastructure as a Service provides virtual machines, networking and storage primitives. The customer usually manages the guest operating system, patches, installed software, host firewall, application and data. The provider manages physical infrastructure and the virtualisation layer.
This model offers flexibility but creates more operational responsibility. Secure templates, patch schedules and configuration monitoring are essential.
Responsibility in PaaS
Platform as a Service removes some operating-system and runtime management. The provider may patch the managed runtime, while the customer deploys code, manages identities, protects secrets and configures connectivity.
Teams should read service-specific documentation. “Managed†does not always mean that backups, retention, key rotation or private access are enabled by default.
Responsibility in SaaS
Software as a Service shifts more of the application stack to the provider. Customers still manage user lifecycle, access roles, data sharing, endpoint security and organisational settings. Former employees retaining accounts is not solved by the SaaS provider’s infrastructure controls.
Data governance also remains important: what information may be uploaded, where it is stored and how long it should be retained.
Build a responsibility matrix
For each workload, list control areas such as identity, network, operating system, application, data, encryption, logging, backup, incident response and compliance. Assign provider, customer and shared duties. Add an internal owner and evidence source for every customer-controlled item.
Avoid one matrix for the whole cloud. Responsibilities differ by service. A virtual machine, serverless function and managed database need separate assessments.
Common customer-side gaps
- Excessive administrator permissions and unused accounts.
- Public network exposure without business need.
- Secrets embedded in code or images.
- Logs enabled but never reviewed.
- Backups created without restore testing.
- Default encryption or retention settings assumed rather than verified.
Use least privilege, multi-factor authentication, secure configuration standards and regular access reviews. Test incident contacts and escalation paths before a real event.
Career practice exercise
Choose one three-tier application and map it to virtual machines, a managed database and object storage. Build a control matrix for provider and customer duties. Then redesign it with a serverless service and explain how the boundary changes.
Build practical foundations in the Cloud Computing Training in Vizag. Apply the responsibility model to cloud networking fundamentals and protect recovery obligations using the cloud disaster recovery guide.
Final takeaway
Cloud security is a partnership with a service-specific boundary. Providers protect the cloud platform; customers must securely use what they provision. Document the boundary, name internal owners and verify controls with evidence.