Cloud Security Concepts and Shared Responsibility
Domain 2: Cloud Security Concepts and Shared Responsibility
This domain tests whether you can allocate duties correctly between provider and customer. CCSA questions often present a service model and ask who owns a control, or ask why a customer still has a finding in a managed service.
Core rules
- The provider is responsible for security of the cloud: facilities, hardware, hypervisor, and provider-managed network underpinnings. The customer is responsible for security in the cloud: identities, data, configuration, and use of services.
- The split moves with the service. In IaaS, the customer patches guest OS and runtime. In PaaS, the provider patches OS/runtime, but the customer configures apps, identities, and data access. In SaaS, the provider runs the application, but the customer still manages users, permissions, data classification, and integrations.
- Identity and access management, data classification, logging configuration, and network exposure choices are usually customer duties across models. Provider compliance certifications do not automatically make the customer compliant.
- Managed-service features such as encryption options or private endpoints are controls the customer must enable and scope.
- CrowdStrike Falcon Cloud Security assesses customer-side configuration, identity, and workload risk; it does not transfer responsibility to CrowdStrike or the cloud provider.
Worked example
A team stores customer records in an object-storage bucket. The provider encrypts disks and secures the data center. The bucket policy allows public read, and the application uses a long-lived access key. Reasoning: physical and infrastructure controls are provider-owned; public access and credential handling are customer-owned. The finding is a customer misconfiguration, not a provider breach. Remediation is to block public access, scope the bucket policy, replace the key with a role, and enable access logging.
Traps
- Saying the provider secures “everything” in SaaS.
- Treating inherited compliance as complete compliance.
- Assuming managed databases remove the need for customer backup, access, and encryption decisions.
- Confusing “provider patched the host” with “customer secured the data.”
- Believing a security product changes the underlying responsibility split.