Cloud and Hybrid Security: Understanding Shared Responsibility

The shared responsibility model

Every major cloud provider operates on a shared responsibility model: the provider secures the infrastructure, and the customer secures what they put on it. The provider protects physical data centres, hypervisors, and the underlying network. Configuration, identity, and data protection remain yours.

This distinction matters because the overwhelming majority of publicised cloud incidents are not provider compromises. They are storage left publicly readable, over-permissive access roles, exposed management interfaces, and credentials committed to code repositories. All of those sit firmly on the customer side of the line.

Why hybrid adds difficulty

Hybrid environments run workloads across on-premise infrastructure and one or more clouds. The challenge is rarely any single environment; it is the seams between them. Identity systems that do not fully synchronise, inconsistent logging, and network paths that bypass controls tend to live at those joins.

Controls that carry the most weight

• Infrastructure as code, so configuration is reviewable and repeatable rather than clicked into a console
• Automated posture checks that flag public exposure and over-broad permissions continuously
• Centralised logging covering every environment, not just the primary one
• Encryption at rest and in transit, with keys managed deliberately rather than by default
• Consistent identity across environments, so access decisions are made in one place

The visibility problem

Cloud environments change constantly, and anyone with permissions can create infrastructure in minutes. That speed is the commercial appeal and the security difficulty. An asset inventory taken quarterly is out of date almost immediately, which is why continuous discovery matters more in cloud environments than it ever did on-premise.

Related in the Knowledge Base

• IAM and PAM: Controlling Who Can Reach What
• Continuous Threat Exposure Management (CTEM): Beyond Periodic Scans
• Confidential Computing: Protecting Data While It Is In Use