Cloud Security · Topic 1 of 6
Shared Responsibility, Security Frameworks and Policy Management
Learn the cloud shared responsibility model for IaaS, PaaS and SaaS, security capabilities such as CSPM, security frameworks and policy management.
- 4 min
- The provider secures the cloud itself. The customer secures what they put in it.
- Data and identity are always the customer responsibility.
- Responsibility for the operating system and application shifts to the provider from IaaS to PaaS to SaaS.
What it is
The shared responsibility model says which security tasks belong to the cloud provider and which belong to you.
The provider secures the cloud itself, which means the facilities, hardware and core services. The customer secures what they put in the cloud, which means data, identities and configuration. The split moves as you go from infrastructure services to software services.
How it works
Learn the model by service type, then add frameworks and capabilities that help you meet your side.
Responsibility by service model
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Data and its classification | Customer | Customer | Customer |
| Identities and access | Customer | Customer | Customer |
| Application | Customer | Customer | Provider |
| Operating system | Customer | Provider | Provider |
| Network controls | Customer | Shared | Provider |
| Virtualisation and hardware | Provider | Provider | Provider |
| Physical facilities | Provider | Provider | Provider |
The exact lines differ slightly between providers, so read each provider documentation. Some points stay the same. The customer always keeps responsibility for their data, and for who can access it.
Many cloud breaches come from the customer side, for example open storage, weak identity controls and misconfiguration.
Security capabilities
Cloud security tools address risks at different levels.
- CSPM (Cloud Security Posture Management): finds misconfiguration against a standard.
- CWPP (Cloud Workload Protection Platform): protects workloads such as virtual machines and containers.
- CIEM (Cloud Infrastructure Entitlement Management): finds excessive permissions.
- CASB: controls the use of cloud applications, covered on a later page.
- CNAPP (Cloud Native Application Protection Platform): combines several of these in one platform.
Logging and monitoring are also needed. Cloud audit logs show who did what, and must be turned on, protected and sent to a central place.
Deployment choices for security tools
A security control can be deployed in several ways.
- Virtual appliance: a firewall image that runs in the cloud network.
- Cloud native control: a built in service, such as a security group.
- Cloud delivered service: for example a secure web gateway, which needs no appliance.
- Agent: runs on the workload and gives deep visibility.
- Agentless: reads the cloud APIs and is quick to deploy.
Cloud security frameworks
A framework gives a structured list of controls, so you can design, assess and show compliance.
| Framework | Purpose |
|---|---|
| CSA Cloud Controls Matrix | Cloud specific control objectives from the Cloud Security Alliance |
| NIST Cybersecurity Framework | Organises security work into functions such as identify, protect, detect, respond and recover |
| CIS Benchmarks | Detailed hardening settings for cloud platforms and services |
| ISO 27017 | Cloud specific guidance that adds to ISO 27001 |
| SOC 2 | An audit report on the controls of a service provider |
| FedRAMP | A United States government programme for cloud service authorisation |
Frameworks help you choose what to do. A customer still has to apply them to their own cloud configuration.
Policy management
Policy management means writing down rules once and applying them consistently. In the cloud, policies are enforced in several places.
- Identity policies: control which principals can perform which actions on which resources.
- Organisation level guardrails: restrict what accounts or subscriptions may do, such as blocking public storage.
- Network policies: security groups and firewall rules.
- Tagging: labels that policies can use to apply controls to groups of resources.
- Policy as code: policies kept in version control, tested and applied by automation.
In a multicloud setup, each provider has its own policy language. A central tool can give one view of policy and posture across all of them.
What to remember for the exam
Six facts cover most questions on this topic.
- The provider secures the cloud itself. The customer secures what they put in it.
- Data and identity are always the customer responsibility.
- Responsibility for the operating system and application shifts to the provider from IaaS to PaaS to SaaS.
- CSPM finds misconfiguration, and CWPP protects workloads.
- CNAPP combines several cloud security capabilities.
- Frameworks such as the CSA Cloud Controls Matrix and CIS Benchmarks guide control selection.
If a question asks who is responsible for the operating system patching in IaaS, the answer is the customer.
Common mistakes
These four mistakes appear often.
Assuming SaaS removes all customer duties. You still manage users, data and settings.
Treating a framework as a tool. A framework is guidance, and you still need controls to meet it.
Leaving audit logging off. Without logs, you cannot investigate an incident.
Managing each cloud separately. Inconsistent policy across providers creates gaps.
Do not assume a default configuration is secure. Check storage access, network rules and identity settings in every new account.
Check yourself
Work through these three questions.
Who is responsible for the operating system in IaaS?
The customer, while the provider is responsible for the hardware, virtualisation and physical facilities.
What does CSPM do?
It checks cloud configuration against a standard and finds misconfiguration.
Which responsibility never moves to the provider in any model?
The customer always keeps responsibility for their data and for identities and access.
Topic 1 of 6 in Cloud Security
Test yourself on Cloud Security
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.