Service Models (IaaS, PaaS, SaaS) and Shared Responsibility
Which security belongs to whom
The shared responsibility model defines, for each type of cloud service, which part of security the provider manages and which part falls to the customer, and not understanding it correctly is one of the most frequent causes of breaches in cloud environments. In IaaS, the provider secures the physical hardware and virtualization, but the customer remains responsible for the operating system, patches, network configuration and data. In PaaS the customer's responsibility shrinks to the application code and its configuration, and in SaaS the provider manages almost everything except the data entered and users' access management. This nuance matters because many organizations wrongly assume that contracting a cloud service transfers all security responsibility to the provider. A frequent case is a misconfigured, publicly exposed IaaS database, where the provider is in no way to blame because that specific configuration was always the customer's responsibility.