The cloud shared responsibility model
In short: The cloud provider secures the cloud itself; you secure what you put in it. How much is yours depends on the service type, but your data, identities and access settings are always your job.
Who is responsible for what
| Layer | IaaS (virtual machines) | PaaS (managed platforms) | SaaS (ready-made apps) |
|---|---|---|---|
| Data and access settings | You | You | You |
| Identities and permissions | You | You | You |
| Application | You | You | Provider |
| Operating system and patching | You | Provider | Provider |
| Network controls | Mostly you | Shared | Provider |
| Physical data centres and hardware | Provider | Provider | Provider |
Mistakes that cause most cloud incidents
- Public storage: buckets or blobs left open to the internet.
- Over-permissive identities: users or services with admin rights they don't need.
- No MFA on admin and root accounts.
- Leaked keys: access keys committed to code repositories.
- Logging turned off, so nobody notices an attack.
- Open management ports such as SSH or RDP exposed to the whole internet.
Starter checklist
- Protect the root or global admin account with MFA and stop using it day to day.
- Give people roles with least privilege; review them regularly.
- Block public access to storage by default.
- Turn on audit logging and billing alerts.
- Restrict management access to known IPs or use a bastion or VPN.
Key takeaways
- The provider secures the cloud; you secure what you put in it.
- Data, identities and access are always the customer's job.
- Most breaches come from misconfiguration, not provider failures.
Tracks your learning on this device only. See your progress on the learning paths.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.