Overview

Security management is risk management. Moving to the cloud does not eliminate security risks or transfer all security responsibility to the cloud provider.

The shared responsibility model

Cloud security operates on a shared responsibility model — a clear division between what the cloud provider secures and what you must secure yourself.

• Security of the cloud — The cloud provider is responsible for the underlying infrastructure: hardware, software, networking, and the facilities that run cloud services. The provider also makes security capabilities and products available to customers.

• Security in the cloud — You are responsible for using those capabilities to build a security system that protects your applications and business.

This boundary is not a simple binary split. Controls fall into three categories:

• Inherited — Controls fully managed by the cloud provider (for example, physical access and environmental controls)

• Shared — Controls that apply to both layers, but each party implements independently (for example, patch management and configuration management)

• Customer-specific — Controls that are solely your responsibility, based on the applications you deploy (for example, data classification and access authorization)

Plan security before migration

As cloud migration accelerates, the cost of network attacks falls — but security investment often lags behind business growth. Build your security system before your workloads go live, not after.

Start by asking:

• Do your defenses make it meaningfully harder and more costly for attackers to compromise your workload?

• If an incident occurs, do your controls limit the blast radius?

• Do you know what value an attacker would gain by taking control of your workload — and what the business impact would be?

• Can your workload detect, respond to, and recover from disruptions quickly?

These questions map abstract security goals to concrete gaps you can act on now.