Find the shared responsibility line for three services

short · 30 min · Objective 2.3

Task

Build the responsibility matrix for an IaaS, a PaaS and a SaaS service, and then test it against five real incidents to see which side of the line each failure fell on. Most cloud incidents are customer-side, and this exercise is how that stops being a slogan.

Steps

  1. Write /tmp/responsibility.csv with rows for physical, hypervisor, operating system, runtime, application code, application configuration, data, and identity and access.
  2. Add three columns — iaas, paas, saas — and fill each cell with provider, customer or shared.
  3. Mark the two rows that are customer in every column, and write in /tmp/cloud.md why those two never move.
  4. Write five short incident descriptions from cloud breaches you know of — an open storage bucket, a leaked key, an over-permissive role, a missing patch on a virtual machine, and a provider outage.
  5. For each, name the service model and which side of the line the failure fell on.
  6. Count how many fell on the customer side and record the proportion.

Verify

python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/responsibility.csv')))
assert len(rows)>=8, 'not all layers are present'
always=[r[list(r)[0]] for r in rows
        if r['iaas']=='customer' and r['paas']=='customer' and r['saas']=='customer']
print('customer in every model:', always)
assert len(always)>=2, 'data and identity must be customer-owned in all three'
os_row=[r for r in rows if 'operating' in list(r.values())[0].lower()][0]
assert os_row['iaas']=='customer' and os_row['paas']=='provider', 'the OS row is the one that moves'
print('matrix consistent')
PY
grep -ciE "data|identity|access" /tmp/cloud.md

The assertions check the two things the exam tests: data and identity are the customer's in every model, and the operating system is the row that moves — yours in IaaS, the provider's in PaaS. If the OS assertion fails, that is the misunderstanding worth fixing before the exam.

Notes

The proportion you counted is the honest version of the lesson's claim. Almost every widely reported cloud breach is a customer-side configuration failure, which means 'move to the cloud' changes which mistakes are available rather than removing them.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.