Cloud security basics · Lesson 1 of 5
Who secures what in the cloud?
Cloud security is shared work. The provider secures parts of the platform, while the customer remains responsible for important decisions about workloads, identities, configurations, and data.
Divide the work explicitly
Example: an ordinary customer-managed AWS EC2 virtual machine.
| Security task | Owner here | Example scope |
|---|---|---|
| Physical data center | Provider | Physical facilities and underlying infrastructure |
| Guest operating system | Customer | Configure and patch the guest OS |
| Application and data | Customer | Application configuration and data handling |
| Workload permissions | Customer | Choose who can do what |
Read the visualWho patches the guest OS in this example?
The customer. Check the responsibilities for the exact service instead of generalizing this table to all cloud products.
Start with the service
Responsibilities vary between infrastructure, managed platforms, and software services.
Make ownership explicit
For each task, identify who implements the control and who verifies it.
Do not outsource assumptions
A provider’s security capabilities do not automatically make every customer configuration safe.
Put it in context
For an AWS virtual machine, the provider operates the underlying infrastructure. The customer typically manages the guest operating system, its updates, and application configuration. A managed service shifts some of those tasks, but not all customer duties.
Ask which party owns each specific control for the service you are actually using.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.