Awareness of shared-responsibility model is critical to cloud success
When companies move to the cloud, it’s paramount that they know where the provider’s security role ends and where the customer’s begins.
The shared-responsibility model is one of the fundamental underpinnings of a successful public cloud deployment. It requires vigilance by the cloud provider and customer—but in different ways. Amazon Web Services (AWS), which developed the philosophy as it ushered in public cloud, describes it succinctly as knowing the difference between security in the cloud versus the security of the cloud.
And that model, which can be radically different from how organizations are used to securing their own data centers, often creates a disconnect for newer cloud customers.
“Many organizations are not asking the right question,” said Ananda Rajagopal, vice president of products at Gigamon, a network-monitoring company based in Santa Clara, Calif. “The right question is not, ‘Is the cloud secure?’ It’s, ‘Is the cloud being used securely?'”
And that’s a change from how enterprises are used to operating behind the firewall, said Abhi Dugar, research director at IDC. The security of the cloud refers to all the underlying hardware and software:
- compute, storage and networking
- AWS global infrastructure
That leaves everything else—including the configuration of those foundational services—in the hands of the customer:
- customer data
- apps and identify and access management
- operating system patches
- network and firewall configuration
- data and network encryption
Public cloud vendors and third-party vendors offer services to assist in these areas, but it’s ultimately up to the customers to set policies and track things.
The result is a balancing act, said Jason Cradit, senior director of technology at TRC Companies, an engineering and consulting firm for the oil and gas industry. TRC, which uses AWS as its primary public cloud provider, turns to companies like Sumo Logic and Trend Micro to help segregate duties and fill the gaps. And it also does its part to ensure it and its partners are operating securely.
“Even though it’s a shared responsibility, I still feel like with all my workloads I have to be aware and checking [that they] do their part, which I’m sure they are,” Cradit said. “If we’re going to put our critical infrastructure out there, we have to live up to standards on our side as much as we can.”
Trevor Jones is a news writer with SearchCloudComputing and SearchAWS. Contact him at [email protected].