Shared responsibility model

Capital One, July 2019: a misconfigured web application firewall rule on AWS opens access to the data of about 106 million people, and the OCC fines the bank $80 million in August 2020, the penalty aimed at the bank and not the provider. The shared responsibility model is the split, written into the cloud provider's terms, between what the provider secures and what the customer alone secures. The provider takes the physical facility, the virtualization layer and the services it operates; the customer keeps its configurations, identities, access rights and data. The line moves with the service consumed: high for a bare virtual machine, where almost everything falls to the customer, low for a fully provider-operated service. It is a risk transfer instrument before it is a technical document, because it determines who the loss is attributable to, therefore which policy responds and against whom recovery is available. The dominant cause of cloud compromise is customer-side misconfiguration rather than intrusion into the provider's infrastructure, as incident response vendors report year after year. An underwriter who has not seen where that line falls for the workloads actually in production does not know what is being covered.