Infrastructure-as-a-Service Security Responsibilities

Infrastructure-as-a-Service

Updated: 11.19.2020

What is IaaS?

Infrastructure as a Service (IaaS) allows you to rent computing resources from a third party that you then access through the web. You essentially outsource having to set up or manage up racks, servers, storage, cooling equipment, power, or a physical place to house it all. You simply pay for only the computing capacity you need, and leave the dirty work of maintaining and securing the computer hardware to someone else, without incurring any upfront capital costs. See additional tips

It’s no secret many organizations rely on popular cloud providers like Amazon and Microsoft for access to computing infrastructure. The many perks of cloud services, such as the ability to quickly scale resources without the upfront cost of buying physical servers, have helped build a multibillion-dollar cloud industry that continues to grow each year.

Still, even though cloud has helped many companies, there are tradeoffs with cloud services such as Infrastructure-as-a-Service (IaaS) that organizations need to be aware of. With IaaS, a cloud provider maintains basic IT infrastructure such as servers, storage, and networks on your behalf, which is convenient but also raises concerns at the same time.

Infrastructure-as-a-Service infographic

Why are IT pros worried about cloud security?

With On-Premises infrastructure, you have complete visibility and control over everything. You can physically see your infrastructure, and if something goes wrong, you have the power and ability to take immediate actions to fix issues.

But with cloud services, you need to trust your provider to properly secure your environment and respond to any security incidents in a timely manner, and as the data shows, many IT departments are hesitant to relinquish control and are afraid of outages or data loss that might occur in the cloud.

Adding to the worries, if a security incident occurs on cloud infrastructure, there’s sometimes confusion over who’s ultimately responsible for addressing the problem because there’s shared security responsibility between you and the provider. Who needs to take actions to remedy an issue depends on where in the stack the security incident actually occurred. Therefore, it’s critical for cloud users to know who’s responsible for what.

How IaaS security responsibilities are divided

The two dominant cloud players, Amazon Web Services and Microsoft Azure, have both documented what they are responsible for as cloud providers when it comes to security. For example, in their shared responsibility model, Amazon Web Services has helpfully broken AWS security responsibilities into two main buckets:

Security of the cloud” = everything the provider does, including:

  • Securing global cloud infrastructure, including physical access to data center facilities where your IT resources are housed
  • Protecting the physical networking, compute, and storage resources, so you don’t have to worry about setting up servers or storage hardware, patching firmware, or installing and properly disposing of drives, etc.
  • Securing Hypervisors that host and manage your VMs running on cloud infrastructure

Security in the cloud” = everything you’re responsible for, including:

  • Guarding data generated or collected by your applications
  • Maintaining secure operating system, network, and firewall configurations
  • Identifying and accessing control mechanisms tied to any platforms or applications you manage
  • Protecting information by ensuring data integrity, using encryption, and properly using identity management technologies

How security responsibilities differ between Iaas, PaaS, and SaaS

Microsoft also draws a clear line that separates what cloud Service Providers and cloud customers are responsible for. Their March 2016 document entitled Shared Responsibilities for Cloud Computing goes one step further by breaking down responsibility areas across different cloud models including IaaS, PaaS, and SaaS.

AWS Infrastructure-as-a-Service

With all three service models, the cloud provider is solely responsible for physical security of infrastructure. And like with AWS all Azure users, regardless of what cloud model they take advantage of, are responsible for data classification and availability to make sure sensitive customer data is properly handled across all of the cloud models. But there are varying degrees of responsibility when it comes to end-point protection, identity & access management, application level controls, network controls, and host infrastructure. As a general rule of thumb, the more control over infrastructure you have, the more security responsibility you have as well, with IaaS providing the most control and responsibility, followed by PaaS, and then SaaS.

customer-cloud

How to stay on top of cloud security

In summary, a first step towards securing cloud infrastructure and data is understanding what you’re responsible for so you can take appropriate action. The cloud providers try to make this very clear so you know what you’re getting into when you sign up for their services.

But just because the providers make some promises, you still need to be careful. Providers like Amazon Web services and Azure are not typically on the hook for data loss or a breach due to labor disputes, utility failures, natural disasters, orders of government, or acts of terrorism or war. They also include language in their service agreements that state you are still responsible for backing up and archiving your content in case of a disaster… so even when the cloud provider is on the hook for security, you still need a solid “plan B” just in case.

By Peter Tsai

The Top 20 Machine Learning Startups To Watch In 2021

The Top 20 Machine Learning Startups To Watch In 2021

Machine Learning Startups There are a record number of 9,977 machine learning startups and companies in Crunchbase today, an 8.2% increase over the 9,216 startups listed in 2020 and a 14.6% increase over the 8,705 ...
Robert Van Der Meulen

Focusing on Online Gaming Security During Development

Online Gaming Security Infrastructure Updated article: June 2nd, 2020 There are millions of gamers around the globe and as of 2018, video games generated sales of US$134.9 billion annually worldwide. As video games continue to ...
Gilad David Maayan

Leveraging Managed Kubernetes to Improve Your Operations

Leveraging Managed Kubernetes Kubernetes simplifies container orchestration, but sometimes companies are struggling with Kubernetes adoption. Many organizations do not have the required expertise to configure and manage Kubernetes by themselves. Managed Kubernetes is a good ...
EV Sales

Growth of Electric Vehicles – Heading In The Right Direction

Growth of Electric Vehicles The global electric vehicle market is projected to reach $802.81 billion by 2027, registering a CAGR of 22.6%.1 The highest revenue contributor was Asia-Pacific, which is estimated to reach $357.81 billion ...
New York

From Y2K To NYC Parking Meters: Have We Learned Anything About Complacency In Cybersecurity?

Cybersecurity Complacency This past January – in what seems like a different world now – a story briefly hit the headlines and was seen as more of a quirk than a threat. It was soon ...
Ramanan GV

Establishing a Unified Governance Model for the Digital Workforce

Increase visual control and reduce OPEX by 30% The Digital Service Providers (DSPs) are riding an automation wave. Painful manual tasks, which burdened staffs for ages, can now be easily handled by the software bots ...