Cloud security is a shared responsibility

Cloud security is the discipline of securing cloud computing systems keeping data private and safe across infrastructure, applications and platforms that you don't fully control. Securing it is a joint effort between the provider and whoever is using the service, whether that's an individual, a small business or a large enterprise.

Providers host services on always-on infrastructure, and their business depends on customer trust — so a meaningful share of cloud security is built into the platform by default. But not all of it.

Cloud security also partially rests in the client's hands. Understanding both halves is pivotal to a healthy cloud security posture.

Ownership of any given control varies with the service model — what the provider secures under infrastructure-as-a-service is different from what they secure under software-as-a-service. That's why the first real step in cloud security isn't a tool, it's a clear answer to the question: for this specific service, which controls are ours to configure, and which are the provider's?