Shared Responsibility Model Flashcards
What is Security “of” the Cloud?
Security “of” the Cloud – AWS manages, operates, and controls the host operating system, virtualization layer, as well as the physical security of its data centers. These data centers are physical facilities that house all the resources, and they require security measures to protect the IT assets inside, as customer data is stored in the storage volumes within the data center or across multiple availability zones. Additionally, AWS is responsible for maintaining the physical servers, including tasks such as applying OS patches, installing firmware updates, and implementing physical and environmental controls for its data centers to guarantee the availability, reliability, and scalability of its cloud service.
What is Security “in” the cloud?
Security “in” the Cloud – the customer is responsible for configuring the AWS-provided security group and virtual firewall, as well as managing the guest OS and related applications. Take note that the level of responsibility for cloud security and maintenance varies depending on the type of service used by the customer, such as Infrastructure as a Service (IaaS) or abstracted services. For example, Amazon EC2 is classified as IaaS, which means you must perform all the necessary security configuration and management tasks. However, for abstracted services such as Amazon S3 and DynamoDB, AWS handles almost everything from the infrastructure layer, and you are only responsible for managing the data, classifying their assets, and applying the fine-grained permissions using IAM tools to meet the compliance requirements.
What are Inherited Controls?
The customer fully inherits certain items from AWS, such as the physical and environmental controls of the data centers and their related assets.
What are Shared Controls?
applies to both the AWS infrastructure and the customer layers. AWS provides the core infrastructure, and customers can add their own set of controls to AWS services.
What are examples of Shared Controls?
-Patch Management
-Configuration Management
-Awareness & Training
Why is Patch Management a Shared Control
AWS is responsible for patching the host OS and resolving issues within the AWS infrastructure, while the customer is responsible for patching the guest OS and their applications.
Why is Configuration Management a Shared Control
AWS manages the configuration of its infrastructure devices and servers, while the customer is responsible for configuring their guest OS, databases, and custom applications.
Why is Awareness & Training a Shared Control
AWS trains its employees, while customers are responsible for training their own employees.
