Mirco Cloud Primer
Photo by Bia Limova on Pexels
One of the most common misunderstandings about cloud computing is the idea that moving to the cloud means security becomes entirely someone else's job. It does not. Every major cloud provider operates under what is called the shared responsibility model, which splits security duties between the provider and the customer rather than handing the whole job to either side.
A simple way to picture this is an apartment building.
The apartment-building analogy
A landlord is responsible for the building itself: the foundation, the roof, the fire alarm system, the main entrance locks, and the structural safety of the whole property. A tenant, on the other hand, is responsible for their own apartment: locking their own door, not leaving valuables in plain sight near an open window, and deciding who gets a spare key.
If the building's main door lock fails and a burglar gets into the hallway, that is the landlord's problem. If a tenant leaves their own apartment door wide open and something goes missing, that is the tenant's problem, even though it happened inside the same building. Cloud security works the same way: the provider secures the building — the physical data centers, the core infrastructure, the hardware — while the customer secures their own apartment — their own accounts, data, and configuration choices.
What the provider typically secures
Across most cloud services, the provider is generally responsible for:
- The physical security of data centers, including who can physically access the buildings.
- The underlying hardware, including servers, storage devices, and networking equipment.
- The software that manages and isolates different customers sharing the same physical infrastructure.
- Maintaining the availability of the core service itself, often backed by commitments tied to an uptime target.
What the customer typically secures
What falls on the customer's side depends heavily on which type of service they use. As a general pattern, customers are usually responsible for:
- Who has access to their account, and how strong that access control is.
- How data is configured — for example, whether a storage location is set to private or accidentally left open.
- What software or settings they add on top of the service.
- Their own passwords, credentials, and everyday account hygiene.
How responsibility shifts across service models
The split between provider and customer is not fixed — it moves depending on how much of the stack the provider manages. This is one of the clearest ways to understand the difference between IaaS, PaaS, and SaaS, covered in more depth in the Service and Deployment Models category.
| Service type | Provider typically secures | Customer typically secures |
|---|---|---|
| IaaS | Physical hardware, networking, virtualization layer | Operating system, applications, data, access control |
| PaaS | Hardware, virtualization, and the platform/runtime | Application code, data, and how access is granted |
| SaaS | Almost the entire technology stack, including the application itself | User accounts, data entered into the service, access settings |
Notice that the customer's responsibility shrinks as the provider manages more of the stack, but it never disappears entirely — even with fully finished software, someone still has to manage who is allowed to log in.
Why this matters for beginners
Many early cloud security problems happen not because a provider's infrastructure was broken into, but because a customer left something configured incorrectly — a storage location set to "public" by mistake, or an account without basic protections like a strong password or multi-factor authentication. Understanding the shared responsibility model helps beginners know exactly which part of security is actually theirs to manage.
A quick way to check your own share
A practical habit is to periodically ask a simple question about anything you set up in the cloud: "If this were misused, would that be a problem with the provider's infrastructure, or with how I configured it?" In most real incidents involving cloud services, the honest answer points to configuration, access, or account security — the customer's side of the model — rather than a flaw in the provider's underlying systems.
This does not mean providers are flawless or that customers should feel solely blamed when something goes wrong. It simply means that treating cloud security as entirely outsourced is a misunderstanding of how the model actually works, and correcting that misunderstanding early tends to prevent some of the most common, avoidable incidents.
Common mistakes beginners make
- Assuming the provider automatically secures everything simply because it is a reputable, well-known company.
- Not realizing that a single misconfigured setting can expose data even though the provider's own infrastructure is secure.
- Treating all cloud services as having the same split of responsibility, when it actually shifts depending on IaaS, PaaS, or SaaS.
- Ignoring basic account security, like weak passwords, because "the cloud handles security."
Frequently asked questions
Who is responsible for security in the cloud: me or the provider?
Both. The provider secures the underlying infrastructure, while you remain responsible for how you configure, access, and use the service on top of it.
Does the shared responsibility model change depending on the type of service I use?
Yes. The more a provider manages for you, such as with software as a service, the fewer security tasks fall on you — but you never reach zero responsibility.
If my data is stolen because I misconfigured a setting, is that the provider's fault?
Generally no. Most providers are clear that customer-side misconfiguration, such as leaving something open that should be restricted, falls under the customer's share of responsibility.
Does the shared responsibility model mean the cloud is less safe than my own servers?
Not inherently. It simply means security is a shared job rather than something you can fully hand off, regardless of whether you use the cloud or your own hardware.
Related reading
Sources
- NIST Special Publication 800-145 — The NIST Definition of Cloud Computing
- Documentation published by major public cloud providers (consulted October 2026)