What is the shared responsibility model in the cloud?
It is the split of security duties between the cloud provider and you, and most cloud incidents happen on your side of the line. The provider secures what it runs: data centres, hardware, the network between them and, depending on the service, the operating system and the application itself. You remain responsible for how you use it: who has accounts and with what rights, multi-factor authentication (MFA), how storage and services are configured, which data you put there, your own applications and their patches, and your backups. The line moves with the service type. With rented virtual servers you manage almost everything above the hardware; with a SaaS product such as an office suite you mainly manage identities, sharing settings and data. Read your provider's own responsibility matrix, map each item to a named owner in your company, and check it after every new service. A provider's certificates cover the provider's part, not your configuration.