In the shared responsibility model for cloud security, which statement is true?

In the shared responsibility model for cloud security, which statement is true?

• A. Cloud provider secures the infrastructure; customer is responsible for data, identities, access control, and configurations.
• B. Cloud provider secures all aspects including data and identities.
• C. Customer is responsible for security of the underlying hardware.
• D. Security is solely the provider's responsibility.

Answer: (D)

The key idea is that security is shared between the cloud provider and you as the customer. The provider is responsible for securing the underlying infrastructure—everything that makes the cloud service run, like the physical hardware, networking, and the basic platform services. You are responsible for what you put in the cloud: your data, how you manage identities and access, and how you configure services and applications. So the statement that the provider handles everything, including data and identities, isn’t accurate. You still own responsibility for protecting your data and controlling who can access it, as well as setting the configurations and access policies that govern how your resources are used. For example, with a cloud storage service, the provider ensures the storage hardware and base services are secure, but you decide how data is stored, who can access it, and how it’s encrypted. This division of responsibilities is the essence of the shared responsibility model.

The key idea is that security is shared between the cloud provider and you as the customer. The provider is responsible for securing the underlying infrastructure—everything that makes the cloud service run, like the physical hardware, networking, and the basic platform services. You are responsible for what you put in the cloud: your data, how you manage identities and access, and how you configure services and applications.

So the statement that the provider handles everything, including data and identities, isn’t accurate. You still own responsibility for protecting your data and controlling who can access it, as well as setting the configurations and access policies that govern how your resources are used.

For example, with a cloud storage service, the provider ensures the storage hardware and base services are secure, but you decide how data is stored, who can access it, and how it’s encrypted. This division of responsibilities is the essence of the shared responsibility model.