Helpful first: Data protection and resilience: why encryption is not a backup plan · Identity, authentication, authorization, and recovery
Key points
- Draw the exact responsibility line between cloud provider and customer across IaaS, PaaS, and SaaS models
- Explain why outsourcing a service to a SaaS or cloud vendor transfers operational tasks but never transfers legal accountability for customer data
- Prevent the most common cloud breaches by hardening customer-owned IAM roles, storage bucket policies, and network security groups
Renting the building does not lock your apartment door
When Meridian Space & Robotics (chronos.) migrates its satellite CAD archives to a public cloud object store and adopts a SaaS collaboration suite, a project manager asks Principal Security Architect Vera Vance whether Meridian can retire its access-review and data-classification controls because "the cloud provider is SOC 2 and ISO 27001 certified."
Vera points out the central trap of cloud adoption: the cloud provider’s SOC 2 report proves that the provider guards their physical data centers, hypervisors, and storage disks (security OF the cloud). It says nothing about whether a Meridian engineer just set an S3 bucket policy to Principal: "*" or granted a contractor permanent global admin rights (security IN the cloud).
| Architecture Layer | On-Premises | IaaS (VMs / VPC) | PaaS (Managed DB / Serverless) | SaaS (Cloud Suite / CRM) |
|---|---|---|---|---|
| Data Governance, Classification & Residency | Customer | Customer | Customer | Customer (Always) |
| IAM Users, Federation, MFA & Role Grants | Customer | Customer | Customer | Customer (Always) |
| Application Code & Workload Configuration | Customer | Customer | Shared (Customer code / Provider runtime) | Provider (Customer owns tenant settings) |
| Guest OS Patching & Host Firewall | Customer | Customer | Provider | Provider |
| Hypervisor, Physical Network & Data Center | Customer | Provider | Provider | Provider |
How the line moves across IaaS, PaaS, and SaaS
As you move from Infrastructure as a Service (IaaS) to Platform as a Service (PaaS) and Software as a Service (SaaS), the provider takes over more of the lower plumbing. In IaaS (such as raw compute instances), Staff Infrastructure Engineer Kael Cho must patch the Linux kernel, harden SSH, and configure VPC security groups. In PaaS (such as a managed relational database), the cloud provider patches the OS and database engine, while Kael still owns database schema permissions, KMS key policies, and network ingress rules.
In SaaS, the vendor runs the entire software stack, yet Meridian still owns the top three layers that cause the vast majority of cloud breaches: who is allowed to log in (Identity & MFA), which roles and external sharing settings are enabled (Configuration), and what sensitive data is uploaded in the first place (Data Governance).
You can outsource operations, never accountability
From a legal, regulatory, and CISSP governance perspective, there is a vital distinction between operational responsibility and ultimate accountability. You can contract a cloud provider to operate servers and sign a Business Associate Agreement (BAA) or Data Processing Addendum (DPA), but if customer records or export-controlled orbital blueprints leak, regulators and customers hold Meridian accountable. Due diligence requires auditing the vendor’s controls before onboarding and continuously monitoring Meridian’s own tenant posture via Cloud Security Posture Management (CSPM).
Customer-side cloud misconfigurations dominate real incidents
Almost no enterprise cloud breaches involve an attacker tunneling through a provider’s physical concrete wall or breaking the hypervisor. Instead, breaches happen above the line: over-permissive IAM roles attached to compute instances, public storage buckets, unrotated API keys committed to Git, or SaaS tenants where guest link-sharing is left wide open.
CHECK YOUR JUDGMENT
Meridian Space & Robotics (chronos.orbital ) stores propulsion test telemetry in a managed cloud PaaS database. An engineer configures the database’s network access list to allow 0.0.0.0/0 and uses a weak static password without IAM token authentication, leading to a data breach. When executives ask whether the cloud provider violated the Shared Responsibility Model, how should Vera Vance respond?
NEXT FIELD LESSON