Cloud security starts with a question: which parts of this stack are yours? The answer changes with the service model, and getting it wrong is a common cause of exposure.
The models
| Model | You manage | Provider manages | Example |
|---|---|---|---|
| IaaS | OS, runtime, app, data, identity | Hardware, network, hypervisor | Virtual machines |
| PaaS | App, data, identity/config | OS, runtime, platform | Managed app platform |
| SaaS | Users, data, configuration | Application, platform, infrastructure | Email or CRM |
Even in SaaS, you own who can access the data and how it is configured. The provider cannot decide that for you.
The responsibility boundary
For an IaaS virtual machine:
- Provider: physical security, hardware, hypervisor, network backbone.
- You: guest OS patching, application, identity, data, backups, logging.
For object storage:
- Provider: durability, physical media, platform.
- You: bucket policy, public access, encryption choices, access logging.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.