L10. Cloud Security & the Shared Responsibility Model
Course outlineLesson 10 of 20
Cloud adoption has fundamentally changed the security perimeter. Understanding who is responsible for what under each cloud service model is one of the most frequently tested Security+ topics.
Shared Responsibility Model
The shared responsibility model defines which security controls the cloud provider handles and which the customer must manage.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Physical/hardware | Provider | Provider | Provider |
| Hypervisor/networking | Provider | Provider | Provider |
| Operating system | Customer | Provider | Provider |
| Runtime/middleware | Customer | Provider | Provider |
| Application code | Customer | Customer | Provider |
| Data | Customer | Customer | Customer |
| User access/IAM | Customer | Customer | Customer |
Common Cloud Misconfigurations
Most cloud breaches stem from customer misconfigurations, not provider vulnerabilities:
- Public S3 buckets or Azure Blob containers (data exposed to internet)
- Overly permissive IAM roles (wildcards, admin to all services)
- Unencrypted data at rest or in transit
- Publicly accessible database snapshots
- No MFA on cloud console root/admin accounts
Key Cloud Security Tools
CSPM (Cloud Security Posture Management): continuously scans cloud environments for misconfigurations against best-practice benchmarks (CIS, NIST). CASB (Cloud Access Security Broker): sits between users and cloud services; provides visibility into shadow IT usage, enforces data policy, and detects threats. Four pillars: discovery, compliance, data security, threat protection. CWPP (Cloud Workload Protection Platform): protects workloads (VMs, containers, serverless) at runtime.- ✓In IaaS the customer owns OS, middleware, apps, and data; the provider owns hardware through the hypervisor
- ✓In SaaS the customer is responsible only for data and user access management; the provider handles everything else
- ✓Most cloud breaches result from customer misconfigurations (public storage, over-permissive IAM), not provider failures
- ✓CASB provides visibility and control over cloud service usage including shadow IT discovery
- ✓CSPM continuously scans cloud environments for misconfigurations against CIS and NIST benchmarks
1. A company uses a SaaS email platform. A data breach exposes customer emails. Who is most likely responsible for the breach under the shared responsibility model?
2. Which cloud security tool continuously scans cloud environments for misconfigured storage buckets, overly permissive IAM roles, and open security groups?
3. Under the IaaS model, which of the following is the cloud provider's responsibility?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.