Cloud Security Fundamentals and Shared Responsibility
Domain 1 asks you to place each control on the correct side of the provider/customer line, and to know how that line moves across IaaS, PaaS and SaaS. Expect scenario questions: given a service and a duty (patching, key custody, packet inspection, bucket policy), say who owns it and which CloudGuard pillar covers the customer-side gap.
Fixed versus moving duties
- Always the provider: physical facility, hardware lifecycle, hypervisor, and the multi-tenant network fabric. AWS calls this "security of the cloud".
- Always the customer: data classification, identity and access decisions, who may read an object or assume a role, and the configuration of every control you switch on. That is "security in the cloud".
- Moves with the service model: guest OS, middleware, runtime and application patching. On IaaS you patch the OS; on PaaS the provider patches engine and host; on SaaS you own data, identity and configuration only.
Where the Check Point portfolio fits
Provider-managed services still leave you a network and configuration duty. CloudGuard Network Security is the customer-owned inspection point for traffic you can steer through it. CloudGuard Posture Management continuously evaluates account configuration against benchmarks and flags drift. CloudGuard Workload Protection covers images, containers and serverless assets. The provider never runs your firewall policy, and Check Point never owns your IAM design.
Worked example
A team lifts an on-premises PostgreSQL database to Amazon RDS and asks what changed. RDS is managed, so the provider patches the database engine, the host operating system and the hardware, and runs the backup mechanism you schedule. The customer still owns the master credential and its rotation, the KMS key policy protecting storage, encryption-at-creation as a design decision, and the security group rules. If a rule opens 5432 to 0.0.0.0/0, Posture Management raises it as a finding; Network Security can inspect client traffic that reaches the DB subnet; neither of them patches PostgreSQL, and neither replaces the security group fix.
Traps that cost marks
- Treating "the provider encrypts at rest" as compliance. Key policy and access grants remain yours.
- Assuming a firewall appliance sees traffic between two managed services that never enters your VPC or VNet.
- Reading the model as one fixed table. It is per service, and it shifts the moment a managed service replaces a self-run component.
- Believing a CloudGuard deployment absorbs responsibility for a customer misconfiguration. It detects or inspects; ownership stays with you.