After learning about IaaS, PaaS, and SaaS, I came across another important cloud concept:
The Shared Responsibility Model.
At first, I assumed that once a company moves to the cloud, the cloud provider handles all security.
It turns out that’s not true.
Cloud security is a partnership between the cloud provider and the customer.
A Simple Example: Renting a Bank Locker
Imagine you rent a locker at a bank.
The bank is responsible for:
- The building
- Security guards
- CCTV cameras
- The vault itself
But you’re responsible for:
- What you store inside the locker
- Who has the key
- Who is allowed to access it
Cloud computing works in a very similar way.
Security OF the Cloud vs Security IN the Cloud
This is the most important idea to remember.
Security OF the Cloud
This is the cloud provider’s responsibility.
Google Cloud is responsible for protecting:
- Data centers
- Physical security
- Servers and hardware
- Networking infrastructure
- Storage infrastructure
Think:
Google protects the building.
Security IN the Cloud
This is the customer’s responsibility.
Organizations are responsible for protecting:
- Their data
- User accounts
- Access permissions
- Configurations
- Applications they create
Think:
You protect what you put inside the building.
How Responsibility Changes Across Cloud Service Models
As we learned earlier, cloud services come in different levels:
- IaaS
- PaaS
- SaaS
The more management the cloud provider takes over, the less you need to manage yourself.
However, one responsibility never goes away:
You are always responsible for your data and who can access it.
IaaS: More Control, More Responsibility
With Infrastructure as a Service (IaaS), the provider gives you infrastructure such as:
- Virtual machines
- Storage
- Networking
You still manage much of the environment yourself.
Think of it like renting an empty house.
You have a lot of freedom, but also a lot of responsibility.
PaaS: Shared Management
With Platform as a Service (PaaS), the provider manages:
- Infrastructure
- Operating systems
- Runtime environments
You focus on:
- Applications
- Data
Think of it like moving into a house where the utilities and foundation are already taken care of.
SaaS: Least Management
With Software as a Service (SaaS), the provider manages almost everything.
Examples include:
- Gmail
- Google Docs
- Microsoft 365
You simply use the application.
Think of it like staying in a fully serviced apartment.
Even here, you’re still responsible for things like:
- Strong passwords
- User access
- Sensitive data
Easy Way to Remember
| Service Model | Customer Responsibility |
|---|---|
| IaaS | High |
| PaaS | Medium |
| SaaS | Low |
As you move from IaaS → PaaS → SaaS:
- Management decreases
- Control decreases
- Responsibility decreases
But it never reaches zero.
Quick Knowledge Check 🧠
Question 1
A company accidentally gives every employee access to confidential customer records.
Who is responsible?
✅ Customer
Question 2
A physical server inside a cloud provider’s data center fails.
Who is responsible?
✅ Cloud Provider
Question 3
A company stores sensitive information in the cloud but forgets to secure user permissions.
Who is responsible?
✅ Customer
Exam Memory Trick
When you see:
- Data
- Permissions
- User access
- Passwords
- Configurations
👉 Think Customer Responsibility
When you see:
- Data centers
- Hardware
- Physical security
- Networking infrastructure
👉 Think Cloud Provider Responsibility
My Biggest Takeaway
Before learning about the shared responsibility model, I assumed cloud providers handled all security.
What I learned today is that moving to the cloud doesn’t remove responsibility—it changes it.
The cloud provider secures the infrastructure, while customers remain responsible for protecting their data, users, and configurations.
And that’s why cloud security is called a shared responsibility model.
