Cloud › Module 2 › Lesson 1
Shared Model
Shared responsibility literacy names the split — CSP secures the cloud, customer secures what's in the cloud — mapped on YOUR $CLOUD_LAB before any live assessment.
Visual · t31_shared_model
Shared model literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Nothing is 'fully managed' for security — literacy names who owns patching, IAM, and data exposure on accounts you control.
The shared responsibility model divides security duties: cloud providers secure physical infrastructure, hypervisors, and managed service foundations; customers secure identities, configurations, data classification, network rules, and application code. Misunderstanding the split causes the majority of cloud breaches — usually customer-side misconfig, not CSP datacenter failure. Cyberlium maps shared responsibility on YOUR $CLOUD_LAB sandbox — never assess stranger subscriptions without authorization. Next: CSP vs Customer.
1. Shared model layers (named)
CSP responsibility: physical security, regional resilience, managed control plane for services like S3 or Azure Blob foundations. Customer responsibility: IAM policies, bucket ACLs, encryption settings, VPC rules, logging enablement, and patch cadence for guest OS and apps.
On $CLOUD_LAB, write one sentence each for CSP vs customer duty on a fictional S3 bucket in your sandbox.
Command guide
Try these commands — Shared model layers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AWS shared responsibility — https://aws.amazon.com/compliance/shared-responsibility-model/ Azure shared responsibility — https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility NIST SP 800-144 — https://csrc.nist.gov/publications/detail/sp/800-144/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
python3 - <<'PY'
model = ['CSP: physical DC, hypervisor, managed service patches', 'Customer: data, IAM, network config, encryption keys', 'Varies by service: IaaS vs PaaS vs SaaS shifts the line']
print('Shared responsibility model (literacy):')
for i, s in enumerate(model, 1): print(f' {i}. {s}')
PYCommand — copy this
curl -sS https://aws.amazon.com/compliance/shared-responsibility-model/ | head -8
Primary tools to practice this lesson: python3, curl. Reference sites: AWS shared responsibility (https://aws.amazon.com/compliance/shared-responsibility-model/); Azure shared responsibility (https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility); NIST SP 800-144 (https://csrc.nist.gov/publications/detail/sp/800-144/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why the model beats 'the cloud is secure'
Marketing 'secure cloud' hides customer obligations — public buckets, open security groups, and stale keys remain YOUR fix. Compliance frameworks (CIS, SOC 2) map controls to this split; auditors ask who owns each control.
Students label responsibilities on lab notes before running hardening checklists on personal accounts.
3. Lab boundary
Forbidden: claiming CSP secures your data so bucket ACL review is optional. Allowed: shared model card — three CSP duties, three customer duties, one $CLOUD_LAB resource example.
Ship: shared model card for YOUR sandbox resource. Next: CSP vs Customer.
4. What you ship: shared model card for $CLOUD_LAB
Three CSP duties, three customer duties, lab resource example. $CLOUD_LAB named. chmod 600.
5. What you record before the next lesson
Date. Shared model card. $CLOUD_LAB named. File t31-m02-l01-shared-model.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip customer duties because 'AWS handles security.' Assess stranger tenant to 'test the model.'
Right
Write shared model card for YOUR $CLOUD_LAB resource. Next: CSP vs Customer.
Mission: map shared model on YOUR sandbox resource
1) Pick one $CLOUD_LAB resource (bucket, VM, or app registration). 2) List three CSP vs three customer duties. 3) Note one common customer failure mode. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
If you cannot name customer duties, your hardening checklist has a blind spot.
Knowledge Check
APPLY: Shared responsibility means:
Multiple choice
Knowledge Check
APPLY: True or False: Public S3 buckets are typically a customer-side misconfig.
True or False
Knowledge Check
APPLY: Shared model literacy on Cyberlium uses:
Multiple choice