TechKnowSurge
CompTIA Security+ 3.1 ISC2 CISSP 3.2 CompTIA SecurityX 3.2 EC-Council CEH 8.1 CompTIA Security+ 5.3 ISC2 CISSP 1.11 NIST CSF GV.SC-06 NIST 800-53 SA-9
TechKnowSurge Catalog Videos Cloud Hosting Considerations
VideoSecurityFree

Cloud Hosting Considerations

The shared responsibility model defines how security duties are divided between cloud service providers and their customers, varying based on the service model in use. Understanding this division is essential when handling sensitive data in cloud environments.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The shared responsibility model is a foundational concept in cloud security that defines which security obligations belong to the cloud provider and which belong to the customer. Cloud providers typically own the physical and infrastructure layer — data center facilities, power redundancy, cooling, networking hardware, and virtualization — while customers are responsible for what runs on top of that foundation, including operating systems, middleware, applications, and the data itself. The precise division of responsibility is not fixed; it shifts significantly depending on the cloud service model being used. On-premises deployments place the entire security stack in the hands of the organization, while colocation arrangements transfer only the physical facility to a third party. Infrastructure as a Service platforms such as AWS extend provider responsibility to include servers, storage, and virtualization, leaving the customer to manage the OS and above. Platform as a Service reduces that customer burden further, handling runtime and middleware so that organizations focus primarily on their applications and data. Software as a Service providers manage nearly everything, with customers responsible only for the data they upload and how they configure the application. In practice, some layers — particularly OS-level security in certain IaaS arrangements — may involve shared or overlapping responsibility rather than a clean handoff. When sensitive data is involved, vendor evaluation becomes a critical part of cloud security governance. Storing data with a SaaS provider such as a cloud productivity or file-sharing platform introduces risk that must be assessed before any agreement is signed. The risk escalates further when a provider requires direct access to internal network resources, such as when a firewall exception is opened to allow data synchronization. In these cases, organizations should conduct thorough due diligence — reviewing SOC audit reports, monitoring for security incidents in public reporting, and confirming that the vendor meets the security standards required to protect both customer data and the broader network environment.

What you'll learn

What's covered

Cloud Security Shared Responsibility

Aligned to

CompTIA Security+
3.1 Compare and contrast security implications of different architecture models.
5.3 Explain the processes associated with third-party risk assessment and management.
ISC2 CISSP
3.2 Understand the fundamental concepts of security models.
1.11 Apply Supply Chain Risk Management (SCRM) concepts.
CompTIA SecurityX
3.2 Explain the security requirements and considerations of cloud deployment models.
EC-Council CEH
8.1 Cloud Computing.
NIST CSF
GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
NIST 800-53
SA-9 External System Services.

Key terms

Infrastructure as a Service
IaaS
A cloud service model that provides virtualized computing infrastructure over the internet.
Platform as a Service
PaaS
A cloud service model that provides a platform for developing, running, and managing applications without managing infrastructure.
Software as a Service
SaaS
A cloud service model that delivers software applications over the internet on a subscription basis.
Shared Responsibility Model
A framework that defines how security responsibilities are divided between a cloud service provider and its customers across different service and deployment models.
Cloud Computing
The delivery of computing services including servers, storage, and software over the internet on a pay-as-you-go basis.
Encryption
The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
Vendor Evaluation
The process of objectively assessing potential product suppliers against defined requirements to select the best solution for an organization's needs.

Topics

Cloud Security Shared Responsibility Model Cloud Service Providers Iaas Paas Saas Vendor Evaluation Cloud Computing

Transcript

If we're going to be purchasing cloud services, there's some extra considerations around that, especially if we're going to end up with some sensitive data and services in that cloud.

The Shared Responsibility Model

When we're moving services up to the cloud, we're relying on those cloud providers to do security right. We're also relying on ourselves to make sure that we're doing security. We're sharing the responsibility, and we call this a shared responsibility model.

Shared responsibility is just this idea that we are going to be responsible for some of security, and then the service provider is going to be providing a certain level of security with what they have. Maybe they have power — do they have redundant power with that? — they have cooling, they're providing the space, they're providing the processing power, they're providing the networking. They're providing these services and making sure that they're providing them at the level that we need. Then we come on top of that, and we're going to make sure that we have the encryption, or that we are installing the proper software, or that the data that we're storing is secure. There's an element that we're responsible for the security as well.

How the Model Varies

Some of it depends on which model you have. You've got an on premise model. This means that we're hosting everything internally. We have the whole stack right here that we are in charge of, and we're not relying on anybody else unless we have some sort of managed service provider that's servicing some of this. Essentially we're responsible for everything here.

Then you've got colocation. This is where I'm renting space, so they give us the data center, but the rest of it is really on us. They give us a rack, we go set everything up, and we're responsible for everything else from a security perspective.

Then you have infrastructure as a service. Infrastructure as a service provides quite a bit more. They have the data center, and a lot of times they're providing the network, storage, servers, virtualization. AWS does an amazing job at delivering their infrastructure as a service. Then on top of that, what you do is you choose which OS you want, and you manage the OS and the middleware and the runtime and the data and the application.

Then platform as a service — WordPress hosting would be an example of this. They're doing everything with WordPress, they're managing all of that, up until the point where you have your own data and application. With WordPress, for instance, I've got a hosting site with WordPress and they're managing everything, except that I set up the actual web pages and get the web pages going, and any plugins and stuff that I want to set up after that.

And then you have software as a service, so a SaaS company, which pretty much provides everything, all the support in there, except that you're just uploading the data and you're running everything in their application.

What this does is it draws clearer lines of exactly who is responsible for what. You can see in the red here, this is the cloud hosting provider, who they're responsible for, and the rest of it we're responsible for. Although at times you will see that you do sometimes share kind of half and half responsibility, so it's not always as clear-cut as this. Maybe there are times when, for instance, AWS does share some of the responsibility around the OS and the security of the OS, but then we share the other part of this responsibility here.

Evaluating a Provider

Ultimately, from my client's perspective, they want to know that I am managing security correctly, and as part of that they also have a lot of questions about how I'm choosing my vendor and the security levels of my vendor. So I have to do a lot of research to make sure that they're performing security well.

Let's take a look at an example here. Let's say we're working with some sort of cloud service provider, or want to work with some sort of cloud service provider. Maybe it's a SaaS company — SaaS is software as a service — so think of some sort of services up in the cloud. Office 365, Google Drive, Dropbox might be a few examples of this.

In those scenarios that I just gave, we're actually storing data up in the cloud, we're storing data with the SaaS company, and that data could be very sensitive. So we want to evaluate that SaaS company to make sure that they're going to handle our data in a secure manner.

Not only that, but there are times when we open ourselves up for even more risk. Let's say there's some local data that we have that this SaaS company needs to access for us to get the full features of the SaaS, and what we're going to do is maybe open up a hole in our firewall to allow that SaaS company to come in and grab that information. Obviously we'll want to take this evaluation to the next level to make sure that this is going to be a secure company, if you're opening up a portion of our network to this company. So I go through the process of checking news reports, looking at their SOC reports, making sure that they are performing the level of security.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →