CRISC Certified in Risk and Information Systems ControlInformation Technology and SecurityEasy
A cloud service provider (CSP) is offering an Infrastructure as a Service (IaaS) solution. A customer is concerned about the security responsibilities for the operating system and applications running on the provisioned virtual machines. According to the shared responsibility model, who is primarily responsible for securing these components?
- ABoth the CSP and the customer share equal responsibility.
- BThe cloud service provider (CSP) is solely responsible.
- CThe customer is solely responsible.
- DThe responsibility depends on the specific service level agreement (SLA).
Show answer & explanationAnswer & explanation
Correct answer: C. The customer is solely responsible.
In an IaaS model, the CSP is responsible for the 'security of the cloud' (physical infrastructure, virtualization layer). The customer is responsible for the 'security in the cloud,' which includes the operating system, applications, data, and network configurations within their provisioned virtual machines.
Why the other options are wrong
- A. While there's a shared model, the responsibility for the OS and applications in IaaS specifically falls to the customer.
- B. The CSP is responsible for the underlying infrastructure, not the guest OS and applications in IaaS.
- D. While the SLA details specifics, the fundamental division of responsibility for OS and applications in IaaS is consistently with the customer.
Shared Responsibility Model (IaaS)
A framework outlining the security obligations of both the cloud service provider (CSP) and the customer when using cloud services, particularly for Infrastructure as a Service (IaaS).
- CSP is responsible for 'security OF the cloud' (physical, network, hypervisor).
- Customer is responsible for 'security IN the cloud' (OS, applications, data, network config).
- The division of responsibility shifts with different cloud service models (IaaS, PaaS, SaaS).
Memory trick: Cloud is 'Shared' but 'You' still 'Own' Your 'Stuff'.