The cloud security model, usually called the shared responsibility model, splits security duties between the cloud provider and the customer. The provider secures the physical data centres, hardware and core platform. The customer secures its own data, user access and the configuration of the services it uses. The split moves depending on whether you use IaaS, PaaS or SaaS.
Who secures what in the cloud
The provider is responsible for the security of the cloud, which means buildings, hardware, networking and the virtualisation layer. You are responsible for security in the cloud, which means what you run on it and how you set it up. No service model passes responsibility for your data or your user accounts to the provider.
How does the split change by service type
The more the provider manages, the less you secure yourself.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Physical and network | Provider | Provider | Provider |
| Operating system | You | Provider | Provider |
| Runtime and application | You | You | Provider |
| Data and access | You | You | You |
Your share of data and access never drops to zero, which is why identity and permissions need attention in every model.
What are the most common failures
Most incidents come from configuration, not from attacks on the provider. Public storage buckets, permissions that are wider than needed, unused access keys and missing logging appear again and again. Secrets in code repositories are another frequent cause.
What controls should every team have
A short list covers most of the risk.
- Single sign-on and multi-factor authentication for all users.
- Least-privilege permissions, reviewed on a schedule.
- Encryption of data at rest and in transit, with managed keys.
- Central logging and alerts for unusual activity.
- Infrastructure defined as code, so that settings are reviewed like any other change.
- Regular backups with a tested restore.
How does this relate to a migration
A migration moves systems into a model where these duties apply on day one. Plan the account structure, access rules and logging before the first workload moves, as the guide to a cloud migration describes. The choice between hosting forms also changes your share, covered in pros and cons of web hosting forms.
How do you start securing a new cloud account
Begin with the account structure. Separate production from test, give each its own accounts or projects and turn on logging before anything runs. Create roles for people and for services, and remove long-lived access keys wherever a role can replace them.
Then add guardrails that apply to everything, such as blocking public storage by default and requiring encryption. Guardrails stop a mistake before it reaches production, which is cheaper than finding it in a review afterwards.
How do you know it is working
Test your controls on a schedule. Try restoring a backup, review who holds administrator rights, run a scan for public resources and rehearse the steps for a leaked credential. A control that has never been tested is an assumption.
Keep a short written runbook for the first hour of an incident, including who decides, which keys to revoke and where the logs are.
What does this mean when you hire engineers
Cloud security needs engineers who treat configuration as code and review it carefully. Miyagami places senior engineers through the DevOps engineers and AWS engineers pages, full-time from €5,600 a month on a three-month minimum. Every engineer is tested by an AI-native tech lead who works with AI every day, explained on how we vet. We hold ISO 27001 and work to GDPR with EU data residency.
Short answers
What is the shared responsibility model?
It is the split of security duties between the cloud provider and the customer. The provider secures the platform and the customer secures what it puts on it.
Who is responsible for data in the cloud?
The customer, in every service model. The provider does not manage who in your company can see your data.
What causes most cloud security incidents?
Misconfiguration and weak access control, such as public storage buckets and over-broad permissions.
Does the model change by service type?
Yes. You carry the most responsibility with IaaS and the least with SaaS.
