A medium-sized organization migrates its workloads to a public cloud provider. The IT manager is unsure about which security responsibilities remain…

Under the shared responsibility model, the cloud provider is responsible for the security of the cloud (e.g., physical hardware, data center security), while the customer is responsible for security in the cloud. This includes managing their data, applications, and access controls.

Managing identity and access policies (C) is a fundamental customer responsibility, as the organization must control who has access to its cloud resources and data. Similarly, configuring network security controls like firewalls for virtual machines (D) is a key task for the customer to protect their workloads from unauthorized network traffic. Both fall squarely within the customer's domain of control and responsibility in IaaS and PaaS environments.

A. Maintaining the underlying hardware of the cloud infrastructure is the cloud provider's responsibility. The customer consumes the hardware as a service and has no physical access or maintenance duties.

B. Ensuring the physical security of the cloud provider's data centers is a core responsibility of the cloud provider, who owns and operates the facilities.

1. Amazon Web Services (AWS). "AWS Shared Responsibility Model." AWS Documentation. Accessed 2023. In its model diagram, AWS clearly places "Identity & Access Management" and "Network & Firewall Configuration" under the customer's responsibility for IaaS services like EC2.

2. Microsoft Azure. "Shared responsibility in the cloud." Microsoft Learn Documentation, September 20, 2023. The documentation shows that for IaaS, the customer is responsible for "Identity & directory infrastructure" and "Network controls." This confirms that both managing access and configuring firewalls are customer duties.

3. Saltzer, J. H., & Schroeder, M. D. "The Protection of Information in Computer Systems." Proceedings of the IEEE, vol. 63, no. 9, pp. 1278-1308, Sept. 1975, doi:10.1109/PROC.1975.9939. While a foundational text, its principles are applied in the cloud model. The principle of least privilege, which governs identity and access management (Option C), is a user-managed control. The configuration of network perimeters (firewalls, Option D) is also a user-level responsibility for their specific environment.

4. Massachusetts Institute of Technology (MIT). "6.857 Computer and Network Security, Lecture 20: Cloud Security." MIT OpenCourseWare, Spring 2017. The lecture notes discuss the shared responsibility model, highlighting that the cloud customer is responsible for configuring access control, network security (like firewall rules), and securing their applications and data deployed in the cloud.