Shared Responsibility Model
The division of duties between provider and customer, which shifts with the service model and is routinely misunderstood in the customer's disfavour.
The provider secures the infrastructure of the cloud; the customer secures what they build in it. The line moves depending on what is consumed:
IaaS — the provider handles physical infrastructure and the hypervisor; the customer handles the operating system, patching, network configuration, identity and data.
PaaS / managed services — the provider additionally handles the operating system, the service runtime and its patching; the customer handles configuration, access control, and data.
SaaS — the provider handles nearly everything technical; the customer still owns identity, access control, configuration and data governance.
The customer's share never becomes nothing, and the items that remain are exactly where most breaches occur: misconfiguration and identity. Nearly every well-known cloud data breach was a customer-side configuration or permissions failure, not a provider failure.
Two things consistently assumed to be the provider's and are not. Backup: many managed services provide snapshots but not the retention, immutability or cross-account isolation a real backup strategy requires. And availability beyond the SLA: the provider's SLA bounds their liability, not your outage — designing for their published availability is your responsibility, and the credit does not cover your loss.