Lesson 4.75: Shared responsibility in the cloud
In the cloud the provider secures the buildings, hardware and its own software, and you secure what you put there and how you configure it. Where the line falls depends on the service: you patch the operating system of a virtual machine yourself, while a managed database's engine is patched by the provider. Most cloud breaches come from the customer's side: public storage, missing MFA, open management ports. In the lab you read a responsibility matrix, check Northwind's cloud account and list who must fix what.
15 min
You will learn to
- Explain the shared responsibility model
- Tell IaaS, managed services and SaaS apart by who patches what
- Spot common customer-side misconfigurations
- Read a cloud configuration export with jq
- Assign actions to the customer or the provider
Key terms
- Shared responsibility model
- The split of security duties between the cloud provider and the customer.
- IaaS
- Infrastructure as a service: virtual machines and networks; you manage the OS and above.
- Managed service / PaaS
- The provider runs the platform (e.g. a database engine); you manage data, access and settings.
- SaaS
- Software as a service, e.g. web e-mail; you manage users and data.
- Root account
- The cloud account's all-powerful owner identity.
- Misconfiguration
- A setting that weakens security, e.g. public storage or open ports.
← Final mission: map and assess the Northwind office network · All lessons · Tabletop exercises →