A common misunderstanding when adopting the cloud is thinking the provider handles all of security. It handles an important part, but not all of it. Knowing where the provider's responsibility ends and yours begins avoids gaps that go unnoticed.
The core idea
The cloud provider, whether AWS, Azure or Google Cloud, is responsible for security of the cloud: data centers, hardware, physical network and the infrastructure that runs the services. You are responsible for security in the cloud: your data, your settings, your access and your code.
The exact line shifts depending on the type of service you use.
How the split changes by service
- Infrastructure (IaaS): you manage more, including the operating system, patching and the network configuration of the machines.
- Platform (PaaS): the provider handles the operating system and platform, and you focus on the application, the data and access.
- Software (SaaS): the provider manages almost the whole stack, but you still own who has access, how data is used and the settings the tool offers.
Notice that in every model, access and data stay with you. That is the part that is never outsourced.
What usually falls on your side
Some points are the customer's responsibility in most services:
- Identity, permissions and MFA management.
- Correct configuration of resources, with no unnecessary exposure.
- Classifying and protecting data, including encryption where it applies.
- Reviewing activity logs and responding to alerts.
Why it matters in practice
Many incidents happen exactly in the area that was the customer's responsibility, not the provider's. Storage set to public or an overly broad permission are not cloud failures, they are settings only you control. Understanding the model helps direct effort to where it is truly yours.
Conclusion
Shared responsibility is not about splitting blame, it is about clarity. When each side knows what it owns, the gaps shrink. It is worth reviewing, for each service the company uses, what belongs to the provider and what is yours.
Cloud Minds Trusted helps map those boundaries and close what is left on your side.