As more and more organizations migrate to the cloud, it drives cloud service customers to consider how the cloud will impact their privacy, security, and compliance. First, cloud service customers must understand how their cloud service provider delivers a secure solution. Second, cloud service customers must consider their new role in cloud security. Some cloud service customers mistakenly believe that when they migrate to the cloud, their cloud security responsibilities also shift. Some important questions you should be asking when considering this shift are: Who’s responsible for cloud security? Why do you even need security in the cloud? Let’s discuss the shared responsibility model and help you understand which elements of cloud security that customers are responsible for and which fall under the responsibility of the provider.

What is the Shared Responsibility Model?

The shared responsibility model is a method for determining which roles cloud service providers and cloud service customers play in cloud security. In general, the shared responsibility model outlines that providers are responsible for the security of the cloud, and customers are responsible for security in the cloud. Cloud service providers and customers must work together to meet cloud security objectives.

The model varies with the provider and the service being offered. What this means is the cloud service provider takes responsibility for specific elements of the security related to the storage and physical security of the servers, and the customer takes responsibility for other specific elements. The line between who has responsibility for the different elements is dependent on the provider and the services being used. 

To understand the shared responsibility model, let’s think about security requirements as a spectrum. Cloud service customers add together all of the regulatory, industry, and business requirements (GDPR, PCI DSS, contracts, etc.) that apply to their organization and the sum equals all of that organization’s specific security requirements. These security requirements will help ensure that data is confidential, has integrity, and is available. On one end of the security requirement spectrum is cloud service providers and on the other is cloud service customers. The provider is responsible for some of these security requirements, and the customer is responsible for the rest, but some should be met by both parties. Cloud service providers and cloud service customers both have an obligation to protect data.

Microsoft Azure’s guidance on the shared responsibility model states, “The importance of understanding this shared responsibility model is essential for customers who are moving to the cloud. Cloud service providers offer considerable advantages for security and compliance efforts, but these advantages do not absolve the customer from protecting their users, applications, and service offerings.”

Shared Responsibility Model Across Service Models

When choosing which service model (IaaS, PaaS, or SaaS) your organization needs, you should consider which security responsibilities will apply to you. Technology stacks are a great way to see the shared responsibility model across service model types.

• For IaaS solutions, the elements such as facilities, data centers, network interfaces, processing, and hypervisors should be managed by the cloud service provider. The cloud service customer is responsible for securing and managing the virtual network, virtual machines, operating systems, middleware, applications, interfaces, and data.
• PaaS solutions shift the cloud service provider’s responsibilities and add a few elements to their duties. The customer is still responsible for securing and managing applications, interfaces, and data.
• For SaaS solutions, the responsibilities shift again. Now, the cloud service customer is responsible for the security of interfaces and data.

Cloud service providers and cloud customers both have a responsibility to protect data. It’s also important to note that the execution of individual security management tasks can be outsourced, but accountability cannot. The responsibility to verify that security requirements are being met always lies with the customer.

Physical Security in the Cloud

Physical security in the cloud sounds like an oxymoron, right? Isn’t less management of a physical environment a major benefit of migrating to the cloud? We often hear this case from organizations who haven’t or don’t want to implement cloud security best practices. But…not everything is in the cloud. Everything can’t possibly be in the cloud. Office locations, employees, servers, heating and cooling systems, power regulation, device management—these things don’t exist in the cloud. That’s why physical security must be a major aspect of cloud security.

Best Practices for Managing the Shared Responsibility Model

If you’re a cloud service provider, we believe these best practices will help you better manage the shared responsibility model:

• Consider risks from your customers’ perspectives, then implement controls that will demonstrate you’re doing everything you can to mitigate those risks.
• Document the internal controls you use to manage risks.
• Provide ample documentation on how your customers can use the security features that you provide in your solution. AWS does a great job of this through its educational programs.
• Create a responsibility matrix that defines how your solution will help your customers meet their various compliance requirements.
• Turn to the CSA’s CAIQ and CCM as starting points for establishing the shared responsibility model.

If you’re a cloud customer, consider these best practices:

• Define your cloud security requirements before selecting a cloud service provider. If you know what you’re looking for in a cloud service provider, you can better prioritize your needs.
• Harmonize your corporate governance program between traditional and cloud-based IT delivery. Migrating systems and applications into the cloud is going to require a difference in policy.
• Establish contractual clarity on the roles and responsibilities of each party, especially when you get into the public cloud. Who’s responsible for cloud security? How far does the cloud service provider go?
• Develop a responsibility matrix that defines the security roles and responsibilities for you and for each vendor, including cloud service providers.

Who’s responsible for cloud security? Does your organization understand the security requirements of your cloud provider? Do you understand what your own role is in cloud security? For more information on how to secure the cloud, contact us today.

Is your small business considering migrating to the cloud? Has your large business seen more and more competition from small businesses? Cloud computing is essential for businesses of all sizes, but small businesses have seen an endless amount of benefits from cloud computing, including financial, operational, and security benefits. Let’s discuss how each of these items related to cloud computing is changing small business.

Affordable Investment

There’s been an enormous change in IT spending, shifting away from traditional IT offerings (enterprise software, data center systems, etc.) to cloud services. In fact, Gartner research shows that more than $1 trillion in IT spending will be directly or indirectly affected by the shift to cloud by 2020, making cloud computing one of the most disruptive forces of IT spending since the early days of the digital age.

So much money is being poured into cloud computing because there are so many financial benefits for small companies. The cost of cloud computing gives small businesses and start-ups access to the same software tools that larger competitors have. In the past, sophisticated software tools were only available in expensive, large packages. Now, cloud products are specifically designed to be used in the cloud and by businesses of all sizes and budgets. Instead of a huge annual fee, priced for hundreds of employees, small businesses can pay monthly fees and pay per user. This gives the users the ability to predict how much their cloud solution is going to cost and how to budget accordingly. Additionally, cloud solutions allow small companies to save on the cost to physically store servers and network equipment or pay for IT support.

Flexibility

Cloud computing gives small business the opportunity to be virtual instead of physical – think of all the ways this can positively impact a business. Employees have on-demand access the cloud environment anywhere, any time and the environments are readily available and dependable, which could improve overall team performance. Contractual agreements are also likely more flexible, solutions are customizable, which is important for a small business; you don’t want to get locked into a contract that doesn’t fit your needs. As your business grows, so can your cloud solutions.

Easy to Use

There’s a cloud service for everything: web hosting, email hosting, application hosting, productivity solutions, infrastructure, business support, and many more. No matter what type of service it provides, a well-designed, quality cloud solution should be user-friendly and customizable to your business. Cloud computing solutions usually easily integrate with other applications that you use, don’t require manual software updates, and increase overall productivity.

Security

People often say that cloud computing makes security easier or less costly. On one hand, yes, cloud computing enables small businesses to scale back on their information security resources if they use a secure cloud provider. What is a secure cloud provider? A provider who can assure their clients that their information is secure, available, and confidential through validation. If you’ve chosen a cloud provider whose cost is low, but they have not gone through an information security audit, you’ve chosen a solution that doesn’t make securing your data easy. It’s vital to choose a provider who’s invested in providing secure solutions. Your reputation, business continuity, competitive advantage, and branding depend on the quality and security of your cloud computing provider.

Preparing for the Future

Cloud computing helps small businesses prepare for the future. As the business grows, scalable cloud solutions can also grow and enhance.

In Gartner’s research, Ed Anderson states, “Cloud shift is not just about cloud. As organizations pursue a new IT architecture and operating philosophy, they become prepared for new opportunities in digital business, including next-generation IT solutions such as the Internet of Things. Furthermore, organizations embracing dynamic, cloud-based operating models position themselves better for cost optimization and increased competitiveness.”

Cloud computing is giving small businesses more opportunities to compete and grow their business. Is your small business considering migrating to the cloud?  Do you know which cloud security threats may impact you? To learn more about cloud adoption and how to empower your cloud environments through security audits, contact us today.

More Cloud Computing Resources

How Can a SOC 2 Bring Value to Your SaaS?