What is the Shared Responsibility Model in Cloud Computing?

The shared responsibility model outlines the security duties by specifying the rights and responsibilities of both the cloud service provider and the client. In essence, it clarifies who is responsible for each aspect of security to ensure effective protection of the cloud environment. The specifics of this division are a little different depending on the service model (SaaS, PaaS, IaaS).

The differences between the three models include:

• SaaS (Software-as-a-Service): The provider handles the underlying infrastructure, the application, and the data, while the customer is in charge of user access and data classification.
• PaaS (Platform-as-a-Service): The provider is responsible for the supporting system, including Web service, operative system, etc., while the customer is responsible for all applications and data.
• IaaS (Infrastructure-as-a-Service): The provider controls the physical layer while the customer controls applications, operating systems, and data.

Here are the detailed responsibilities of SaaS providers:

• Physical security: Protect data centers and hardware.
• Network security: Protection against the threats posed by unauthorized access or cyber-attacks.
• Application security: Updating software to fix security weaknesses or bugs to prevent breaches
• Data security: Encrypting data both when it’s stored and during transmission, and making sure there are backups or disaster recovery.
• Operational security: Detecting threats and responding to security occurrences.

The SaaS customer should consider:

• Device security: Protecting the device that is being used in accessing the SaaS application.
• Access management: Managing the right limitations of the users and their ability to access an application, the procedures to verify their identity, and the authorization to access the application.
• Security awareness training: Training of the employees on security measures and phishing risks.
• Data classification: Identifying sensitive data and putting measures in place to protect it.
• Incident response: Having a contingency plan as to how the security threats could be handled.

Organizations and Software as a Service providers and suppliers should:

1. Regularly review the SaaS provider’s security documentation and certifications: Learn about their security practices and make sure that they meet your organization’s standards.
2. Establish clear communication channels: Maintain clear communication with your SaaS provider to discuss security concerns, report any issues, and stay updated on security changes.
3. Participate in security awareness programs: Encourage your employees to take security training that is provided by the SaaS provider.
4. Conduct joint security assessments: Collaborate to identify and reduce risks in the shared environment.
5. Establish a Service Level Agreement (SLA): Establish the security requirements and duties in a contractual document that is signed by both parties.