Shared responsibility model

When you run something in the cloud, keeping it safe is split between two parties. The shared responsibility model is the rule book for that split. The provider is responsible for the security of the cloud: the buildings, the hardware, the network and the software that runs its services. You are responsible for security in the cloud: your data, who can log in, and how you configure what you rent.

Where the line falls depends on the kind of service. With a virtual machine, the provider looks after the physical server and the virtualization layer, but you patch the operating system, set the firewall rules and manage the accounts. With a managed database, the provider also patches the database software. With a finished app like email, the provider handles almost everything, yet who has access and what data you put in it is still on you.

It matters because many cloud breaches are not the provider being hacked. They are customer mistakes: a storage bucket left public, a key with too much power, a database open to the whole internet. The provider gives you the locks, but you decide whether to lock the door. AWS, Microsoft Azure and Google Cloud each publish their own version of the model, and auditors often ask which side handles each control.