Shared Responsibility Model

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with

Already have an account? Sign In »

45 minutes
Video Transcription
Hello, everybody. And welcome to the introduction to Cloud Security. My name is Nicholas Moy. If you are new to the cloud, this is something that you want to get a really good understanding on. That way, when you move into the cloud, you don't have any surprises. You understand exactly what you are responsible for versus what the cloud vendor
is responsible for. And this is all based on the service is that you sign up for.
So basically, this charts which is actually offered by eight of us is on their website is a really good depiction of the things that you'll be responsible for, especially if you're using their service is so as we can see here,
Here's the customer in blue. These are all the things that you're responsible for, and three orange is eight of us, and these are the things that they are responsible for.
Things to keep in mind is that no matter what you're doing, you're responsible for your data. If you're using an I ask, you're going for your own server and eight of us cloud or Google Cloud or azure, whatever, you're gonna be responsible for the data in that in that platform.
Uh, you know, if you're dealing with the platform, the applications, the
identity and access management basically the management of the users of that data you're responsible for that they're not gonna They're not gonna create new users for you. They're not gonna manage password policies. They're not going thio, you know, handle the deployment of applications, the updating of applications, things like that. That is something that you have to handle.
And they have their hands off that
if you're going for I asked like you're starting an easy to instance in eight of us or you're starting an instance up in in Azure. You're gonna be responsible for the operating system, making sure that that stays patched. You're gonna be responsible for the networking If you have your own private network within the cloud
and for Pharrell Configurations making sure that's
whatever inbounds protocols and outbound protocols leaving that networker, leaving that server instance,
making sure that all of that state's secure, that's that's all on us, the customer. And that's not gonna fall on the cloud provider.
Ah, client side data encryption data, integrity, authentication, server side encryption. So, you know, like for file systems or for the data, the networking, traffic protection. That's, you know, your encryption, your integrity, identity, things like that. All that's going to fall within the responsibility of you, as the customer
thinks that eight of us is responsible for, would be the software. So
you know, things like dynamodb things like s3. Ah, the hyper visor. So when it comes to compute storage, database networking, things like that, anything within their infrastructure right here big and bold,
their infrastructure, they're going to handle it. If it's has to do with hardware, they're going to handle it. It has to do with networking. Ah, fault tolerance, Um, the accessibility or the distribution across the globe. You know, your regions, your Philip availability zones,
availability zones, edge locations, et cetera.
That is going to be handled by eight of us. So basically any applications, anything you deploy anything you handle, anything you spend up you spend down in the cloud that is on you, that's what you're gonna be handling. And that is what you're responsible for.
And anything that's it has to do with providing the service is in order for you to do the spinning up in order for you to do the
uploading and downloading things like that
that will be handled by eight of us. I do encourage you to take a look at the shared responsibility model and confirm with whatever call provider that you choose to go with. Whether that's Google, Azure, Alibaba, IBM, whatever. Make sure that the responsibility model is going to fit your needs
as an organization is gonna fit your business goals as an organization.
That way you don't deal with any security issues in the future. You don't deal with any group sees or what just happens. I have no idea type of situation so
but ultimately the responsibility model will pretty much stay the same. You will be responsible for your data. You will be responsible for your applications and for your access to those applications into the platforms that things like that. So just keep that in mind. Alright, guys, that about wraps up this lecture. I will see you and the next one
Up Next
Cloud Fundamentals for Security Practitioners

In this course, you will learn the fundamentals of Cloud services and concepts through the lens of a security practitioner.

Instructed By