Public Cloud Security Fundamentals and Shared Responsibility
The first domain tests whether you can place each control on the correct side of the cloud shared-responsibility line and choose the right Fortinet control for the customer's side. Expect service-model comparisons (IaaS, PaaS, SaaS), provider responsibility matrices, and scenarios where a control is technically available but ownership still sits with the customer.
Core rules
- The provider is responsible for security of the cloud: facilities, hardware, hypervisor, managed-service infrastructure, and, for SaaS, the application. The customer is responsible for security in the cloud: data classification, identity and access, configuration, and use of the service.
- In IaaS the customer patches guest OS, middleware, applications, and network controls it configures. In PaaS the provider manages OS/runtime; the customer still owns application code, identities, data, and service configuration. In SaaS the customer owns data, users, and sharing settings.
- Identity is almost always a customer responsibility, even when the provider supplies the IdP. Federation does not outsource authorization decisions.
- Compliance is inherited only for controls the provider actually operates. Auditing a provider certificate does not make the customer's workload compliant.
- Fortinet controls sit on the customer side: FortiGate-VM for traffic policy/inspection, FortiCNAPP for posture and workload risk, FortiManager/FortiAnalyzer for management and logging.
Worked example
A team stores customer records in an object bucket. The bucket policy allows Principal: "*" and the objects are not encrypted. The provider's data center is certified and its hypervisor is patched. Who owns the finding? The customer: the provider secures the storage service, but bucket policy, IAM, encryption choice, and data classification are customer controls. The fix is to remove public access, enforce TLS and encryption, scope IAM, and monitor with CSPM. A FortiGate cannot repair the bucket policy; it can only control traffic that traverses it.
Traps that cost marks
- Saying the provider patches the guest OS in IaaS.
- Treating a provider compliance report as full customer compliance.
- Assuming PaaS removes the need for application security or secret management.
- Forgetting that data residency and encryption-key custody can be shared or customer-owned depending on the service.
- Confusing "provider offers a control" with "provider operates the control for you."