Allocate Shared Responsibility Across IaaS, PaaS, and SaaS
The cloud shared responsibility model divides security and operations controls between the provider and the customer across IaaS, PaaS, and SaaS. This interactive lesson shows which storefront controls stay customer-owned as services become more managed. Covers: OS and runtime patching, identity and access, data protection, configuration and hardening, monitoring and incident response, and when not to choose managed services. Practice: What still stays my responsibility. Prerequisites: IaaS, PaaS, and SaaS service models.
“Let’s use managed services everywhere. Then reliability and security are solved.” In an interview, we should correct that claim by separating provider-operated infrastructure from controls that the workload owner must still design, configure, and verify. Shared responsibility allocates ownership of controls between a cloud provider and the customer. It does not describe whether a service is public, private, reachable, or secure by default.
The core categories are operating system and runtime patching, application code, identity and access, data classification and protection, configuration and hardening, and monitoring and incident response. Infrastructure as a Service (IaaS) leaves more of those controls with us. Platform as a Service (PaaS) moves operating system, runtime, and much scaling work to the provider. Software as a ...