Shared responsibility model
noun · Microsoft Learn: Shared responsibility in the cloud
The split of security duties between a cloud provider and its customer, which shifts depending on whether the service is IaaS, PaaS or SaaS.
Moving to the cloud does not hand all of security to the provider. The provider always secures what only it controls: physical datacenters, hardware and the underlying network. The customer always remains responsible for its data, its accounts and identities, and the devices that access the service. Everything in between depends on the service model:
- Infrastructure as a service (IaaS), such as virtual machines: the customer also patches the operating system and configures the network and applications.
- Platform as a service (PaaS), such as managed databases: the provider handles the operating system, the customer handles the application and its access.
- Software as a service (SaaS), such as Microsoft 365: the provider runs almost everything, but who can sign in, what they can share and how data is classified remain the customer's job.
Example
A company stores customer files in a cloud storage account and sets it to allow anonymous public access for convenience. The provider's infrastructure works exactly as designed, yet the files leak. The misconfiguration sits on the customer's side of the model.
Why it matters for a SOC analyst
Many cloud incidents come from the customer's side: weak identity controls, overly broad sharing and misconfigured services. Knowing where responsibility lies tells you which logs you own, which controls you can change, and when an issue is actually the provider's to fix.
Related terms
- Defense in depth
Protecting systems with several independent layers of controls, so that when one layer fails, the others still stop or detect the attack.
- Identity and access management
The processes and tools that manage digital identities and decide what each one can access, from account creation to removal.
- Zero trust
A security model that grants no implicit trust based on network location: every access request is verified, limited and continuously evaluated.
- Data breach
A confirmed incident in which protected data, such as personal or confidential information, was accessed, disclosed or stolen without authorization.