Where Does the Line Fall?

About this interactive

When you hire out part of your infrastructure, you hire out part of its security too. The shared responsibility model is where your job ends and the provider's begins, and your contract spells out the details. Picture the stack from the bottom: the building, power and cooling, the network, storage and servers, the hypervisor, then the operating system, middleware and runtime, then the application, and on top your data and who can use it. In IaaS the provider runs everything up to the hypervisor. You run the operating system and everything above it. In PaaS the provider also runs the operating system and the runtime, as RDS runs the database engine for you, and you bring the application and its data. In SaaS the provider runs the application too, as with Microsoft 365 or Zoom, and you are left with the settings: who gets an account, what they can reach, and the data you put in. To place a card, find its layer in the stack, then ask in which models that layer is still yours.

What you'll learn

Apply the shared responsibility model: for a given security job, say whether the customer or the cloud provider does it in IaaS, PaaS and SaaS
Recognize that the provider takes on more of the stack from IaaS to PaaS to SaaS, while user access and the customer's own data stay with the customer in every model

Aligned to

CompTIA Security+

3.1 Compare and contrast security implications of different architecture models.

Key terms

Shared Responsibility Model: A framework that defines how security responsibilities are divided between a cloud service provider and its customers across different service and deployment models.
Infrastructure as a Service: A cloud service model that provides virtualized computing infrastructure over the internet.
Platform as a Service: A cloud service model that provides a platform for developing, running, and managing applications without managing infrastructure.
Software as a Service: A cloud service model that delivers software applications over the internet on a subscription basis.
Access Control: A security mechanism that restricts access to resources based on policies, roles, or identity.
Multi-Factor Authentication: An authentication method that requires users to provide two or more verification factors to gain access.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →