A shared responsibility model is a framework used in the cloud computing world to define the respective security responsibilities of the customer and the cloud provider. In this model, the cloud service provider is obligated to secure the underlying infrastructure of the cloud, including physical security, network security, and hypervisor security. The customer, on the other hand, retains the responsibility for securing the data and applications they store and use in the cloud environment, including access control, data encryption, and security configuration.
The shared responsibility security model helps guarantee that cloud security benefits from a collaborative effort between the customer and cloud vendor or provider. By clearly defining each party's responsibilities, it can help to minimize security risks and ensure that cloud resources are protected against emerging threats and vulnerabilities.
The exact division of responsibilities might differ depending on the type of cloud service being used, such as IaaS (infrastructure as a service), SaaS (software as a service), or PaaS (platform as a service). The following diagram from the Center of Internet Security (CIS) illustrates the differences in division of responsibility across different cloud models.