1.5 The shared responsibility model
Describes the cloud landscape as of August 2026
What this is and why it exists
Every cloud service splits security duties between provider and customer, and the split is written down. Most real cloud breaches happen on the customer's side of the line — not because the line is unclear, but because nobody on the customer's side read it. This lesson is about reading it.
The vocabulary
- Security OF the cloud — the provider's half: the buildings, the hardware, the hypervisor, the services themselves.
- Security IN the cloud — your half: your data, your access control, your configuration, your code.
- Misconfiguration — the customer-side failure mode: a storage bucket set public, a database open to the internet, a credential in a repository.
- The line — where duties split for a given service; it moves with the service model.
The mental model
A rented flat. The landlord is responsible for the building standing, the wiring being safe, the front gate locking. Whether YOUR door is locked, who you gave keys to, and what is lying visible on your balcony — that is you, and no landlord can fix it. The provider patrols the building; the open door is still yours.
The line moves with the service model, and it only ever moves one way: the higher the model, the more the provider takes. Under IaaS, the operating system and everything above it is yours to patch and configure. Under PaaS, the platform is theirs; your code, data and access rules remain yours. Under SaaS, nearly everything is theirs — except your data's classification, your users' access, and your account's credentials, which are yours in every model, always.
The best-known cloud data leaks of the last decade were customer-side: storage buckets configured public, credentials committed to public repositories, admin consoles without multi-factor authentication. The provider's half held; the customer's half was never written down. So write yours down: before deploying anything, one page that says what is ours to secure on this service — and who owns each line.
What you should now be able to explain or do
For any service you use, say which failures are yours to prevent. State what stays the customer's in every model. Produce the one-page "our half" list for a service before deploying on it.
Check yourself
What is the difference between security OF the cloud and security IN the cloud?
OF — the provider's infrastructure and services. IN — your data, configuration, access and code. The provider secures the building; you secure your flat.
How does the line move between IaaS, PaaS and SaaS?
Upward with the model: IaaS leaves you the OS and above; PaaS takes the platform and leaves you code, data and access; SaaS takes nearly everything else.
What remains the customer's responsibility in EVERY service model?
Their data, who can access it, and the account credentials — no model takes those over.
Where did the well-known cloud data leaks mostly happen?
On the customer's side of the line — public storage buckets, leaked credentials, unprotected admin access. The infrastructure held; the configuration did not.
Go deeper
We haven't checked most of these for screen reader use yet.
Back to The shared responsibility model: work through the checklist