The Importance of the Shared Responsibility Model for Your Data Security Strategy

Originally published by Dig Security.

Written by Sharon Farber.

A shared responsibility model is a cloud security framework that outlines the distribution of security and compliance responsibilities between the cloud service provider (CSP) and the customer.

There has been a long debate about who shares what type of responsibilities between CSPs and cloud service consumers.

Both parties share responsibilities related to the security, privacy, and management of data throughout its lifecycle within the cloud environment. But what happens in the event of a data breach? Who will be held accountable? It might not be who you think.

Gartner estimates that through 2025, 99% of cloud security failures will be the customer's fault. The good news is that you can prevent cloud security failures by following the shared responsibility model.

Let’s dig a bit deeper into the key responsibilities of both CSPs and cloud service consumers.

Who’s Responsible for What?

Here is a detailed breakdown of the various responsibilities both CSPs and customers have.

Different Types of Shared Responsibility Models

There are three main variations of the shared responsibility model; IaaS, PaaS, and SaaS. Here is a detailed breakdown of each cloud delivery model:

IaaS (Infrastructure as a Service) - Here, the service provider is responsible for the virtualization layer along with the physical data centers. Customers are responsible for securing the operating systems (OS) of the virtual machines they deploy in the cloud, middleware such as implementing proper access controls, data management, and container security.

PaaS (Platform as a Service) - In this model, the CSP is accountable for securing the PaaS platform itself. This includes securing the databases, middleware, development frameworks, runtime environments, and operating systems (OSes). Customers are responsible for developing and maintaining their applications running on the PaaS platform. This includes writing secure code, regularly updating and patching application components and data protection.

SaaS (Software as a Service) - In a SaaS model, the provider controls virtually all aspects of application security, while customers are faced with the task of protecting a user's login credentials and data from phishing or social engineering tactics, which account for an astonishing 98% of cyber attacks.

‍

Shared Responsibility Model in Cloud Service Providers

Let’s take a closer look at how the shared responsibility model applies to major cloud service providers such as AWS, Azure, and Google Cloud Platform (GCP).

‍

Shared Responsibility Best Practices

Thoroughly examine SLAs - Take the time to carefully review your SLAs with cloud vendors. When organizations change cloud providers or shift to a different cloud delivery model, it is imperative to reevaluate the fine print of the SLA to avoid any misunderstandings and ensure that customer data is protected in accordance with privacy laws.

It’s All About the Data - Regardless of chosen CSP, the organization bears complete responsibility for the handling and management of the data. Data classification is a fundamental component of shared responsibility best practices. Organizations must categorize their data based on sensitivity level. Regular data backups are also critical for data resilience and for ensuring that data can be recovered in the event of accidental deletion, system failure, or other security incidents.

Make IAM Policy Enforcement a Priority - IAM enforcement provides organizations with granular control over user access to cloud resources. IAM policies leverage the principle of least privilege, empowering admins to define and control access policies based on user roles, granting each individual precisely the required permissions to perform their tasks effectively. It also enhances data confidentiality and minimizes the potential for data exposure due to inadvertent user actions.

Arm Yourself with the Right Security Tools - Security tools such as DLP solutions help prevent the unauthorized exfiltration of sensitive data from their cloud environment. Organizations can take their security to the next level by adopting a mix of advanced security tools such as Data Security Posture Management (DSPM) and Data Detection & Response (DDR) which can enhance your security posture beyond traditional firewalls.

‍

Shared Responsibility Model FAQ

1. What is a shared responsibility model? The shared responsibility model is a cloud security framework that defines the division of security responsibilities between the Cloud Service Provider (CSP) and the customer.
2. What is the shared responsibility model in AWS? AWS is responsible for protecting the infrastructure supporting all services available in the AWS Cloud. This includes hardware, software, networking, and facilities.‍
3. What are the different types of shared responsibility models? The different types of shared responsibility models include Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).