## The Shared Responsibility Model

This is the most critical concept in Cloud Security. It answers: **"If we get hacked, whose fault is it?"**

### The Line in the Sand
*   **Cloud Provider (AWS/Azure)**: Responsible for security **OF** the Cloud.
    *   Physical security (Guards, Fences).
    *   Power/Cooling.
    *   Hypervisor vulnerabilities.
    *   Network cabling.
*   **Customer (You)**: Responsible for security **IN** the Cloud.
    *   Your Data.
    *   Your User Accounts (IAM).
    *   Your OS Patches (for IaaS).
    *   Your Firewall Rules (Security Groups).

### The "S3 Bucket" Scenario
*   **Scenario**: A company leaves an S3 bucket (storage folder) "Public". Hackers steal 1 million customer records.
*   **Who is at fault?** The Customer.
*   **Why?** AWS gave you the tools to make it private. You chose (or forgot) to make it public. AWS secured the hard drive so no one could steal the physical disk, but they cannot stop you from publishing your own data.

### The Variance
The line moves based on the service model.
*   **IaaS**: You do more work (Patching, Antivirus).
*   **SaaS**: You do less work (Just Identity/Data).

### SOC Implications
In the cloud, **Identity is the new Perimeter**.
*   In On-Prem, we trusted people inside the firewall.
*   In Cloud, there is no firewall around the API. If an attacker steals an API Key or Admin Password, they *are* the Admin.
*   Therefore, **MFA (Multi-Factor Authentication)** is the single most important control in the cloud.