March 16, 2022

There are many benefits of adopting a cloud-based IT service model, whether SaaS, PaaS, IaaS, or a hybrid. One major reason is enhanced IT security; any major cloud service provider, including Microsoft Azure, has built their operations to comply with U.S. Department of Defense standards. They follow the latest best practices to keep their systems and user data secure. They offer deep security expertise and 24/7 resources to anticipate issues before they occur and respond promptly to emerging threats and vulnerabilities – coupled with modern AI and Machine Learning security technologies.

But what is the extent of security protection that your cloud provider manages versus your organization’s responsibility? The answer isn’t always clear-cut. The security protection you receive from a cloud provider can vary greatly depending on which service model and service options you’ve selected. That’s why it’s important to know who’s responsible for what – and where you might be vulnerable.

Hosting contracts vary – and many cloud service providers offer add-on security options – but here are some general guidelines and recommendations:

Infrastructure as a Service (IaaS)
For IaaS services, your cloud vendor provides only the physical or virtual infrastructure. That means you’re in charge of the network and system infrastructure, applications, and data – and the security responsibilities that go with them. As an IaaS customer, it is your job to deploy and monitor the identity and access management tools you need to authenticate users and secure endpoints. In terms of data security, you are solely responsible for measures such as data collection, encryption, and monitoring.

Platform as a Service (PaaS)
If you’re operating in a PaaS environment, your cloud provider manages the entire infrastructure, including databases and other middleware. Your team manages the application and data content. That means you have primary responsibility for access management, while your cloud provider should be providing API security and auditing. While you supply the data, your provider oversees securing those databases. In addition to databases and middleware, PaaS services have evolved for Identity Solutions, namely “easy-auth” or Modern Authentication and customers should be taking advantage of their cloud provider’s serverless code functions to eliminate the need for username and password authentication dependencies.

Software as a Service (SaaS)
For SaaS services, your cloud provider provides everything from the infrastructure to the application. You’re responsible for providing the data and user access. You can be sure your SaaS provider has taken all proper application security measures, including source code analysis, vulnerability testing, secure deployment, and runtime threat protection. For your part, ensure the security of the endpoints used to access your cloud solutions. If your SaaS provider doesn’t offer identity and access management as part of their solution, deploy your own tools.

How can you be sure your IT security is adequate?
As you can see, security measures are a shared responsibility in cloud service models, and it’s essential to understand how robust your security protections are and which aspects of security your organization is responsible for.

In the Azure environment, a good starting point is your Microsoft Secure Score. At a glance, its dashboard enables you to gauge the current state of your organization’s security posture and alert you to responsibilities requiring your attention.

You can then build on your Secure Score findings by engaging a security services provider to perform a thorough security assessment. For example, Neudesic’s comprehensive security assessment service will analyze all aspects of your – identities, devices, servers, data, applications, infrastructure, and networks – helping you identify and mitigate risks and providing an actionable list of recommendations to put your security strategy on solid footing. Click here to learn more.