共享责任模型(SRM)是云服务提供商(CSP)与其服务的最终用户之间的一种理解. 该协议规定，云计算服务提供商(CSP)将负责保护其云计算运营的平台基础设施，而最终用户则负责保护在云计算平台上运行的工作负载.
的确, Gartner下划线 the need for customers of CSPs to thoroughly underst和 the agreement, csp不能提供完整的安全性，安全领导者必须了解他们在云中的安全责任范围. 对于正在将全部或部分工作负载迁移到云的组织来说尤其如此.
因此, 对于构建云的架构师来说，考虑到他们想要操作的环境的特定安全含义是最理想的. 这将帮助所有利益相关者更全面地了解业务迁移到云计算所承担的风险和责任. 缺乏对SRM概念的理解，因为它涉及到一个特定的组织和他们的云计算服务提供商，可能会导致误解，认为云计算服务提供商负责某一区域的安全——这可能会导致错误配置和/或不正确地保护云资产.
了解您在SRM中的角色可以帮助您维护您在CSP方面的责任以及实施和执行 云安全 best practices like regular vulnerability scanning.
Let's take a look at how some of the top CSPs define SRMs for their environments. 毕竟, 这些信息将是找到最适合您组织独特需求的供应商的关键.
这种模式表明，AWS负责云的安全，而客户负责云中的安全. 虽然AWS致力于保证其基础设施的安全，但客户负责IT控制，例如 加密 和 identity 和 access management (IAM)、修补客户操作系统、配置数据库以及员工网络安全培训.
This model states that, in an on-premises datacenter, a customer owns the whole stack. As the customer moves to the cloud, some responsibilities transfer to Microsoft. Those responsibilities will vary, depending on the type of stack deployment.
For all cloud deployment types, the customer owns their data 和 identities. They’re responsible for protecting the security of those data 和 identities, 本地资源, the cloud components they control. Regardless of the type of deployment, the customers will always retain the following data, 端点, 账户, access-management responsibilities.
该模型表明，需要深入了解客户使用的每项服务, 以及每个服务提供的配置选项，以及谷歌云如何保护服务. Every service has a different configuration profile, it can be difficult to determine the best security configuration.
客户是了解其业务的安全和法规需求以及保护机密数据和资源的需求方面的专家. GCP has also introduced the concept of “shared fate,，这使得客户实质上购买了将责任传递给GCP的权利.
Now, let's take a look at how the SRM differs based on the 云模式的类型 商业运作的基础. 在下面的每个标题下列出了CSP负责的组件和客户负责的组件.
The thing to remember is that as we move on from top to bottom in each area below, the CSP manages more 和 more components. 因此, a customer gains more 和 more convenience 和 peace-of-mind, 但定制能力较差.
CSP负责:
客户负责:
CSP负责:
客户负责:
CSP负责:
客户负责:
In a fully custom-built on-prem infrastructure the user would, 当然, be responsible for all aspects listed above.
Getting into a more technical summation of what the SRM typically encompasses, 许多专家会说，客户要对他们在云环境中可以更改/添加/删除/重新配置的任何东西负责. If they do not have the ability to modify something, 云计算运营的这方面的监督责任很可能落在云计算服务提供商(CSP)身上.
As noted above, however, there can be areas of overlap. These gray areas are also known as shared control areas, 并且需要csp和他们的客户都知道，以便尽可能顺利地运行. For example, in terms of AWS, shared control areas would include aspects like 补丁管理、配置管理 基础设施即代码(IaC), 安全意识培训. 为什么这些区域是共享的?
具体地说, AWS would be responsible for patching 和 fixing flaws within their infrastructure, 而客户则负责修补其客户操作系统和应用程序. 类似的, AWS maintains configuration of its infrastructure, but a customer is responsible for configuring its own operating systems, 数据库, 和应用程序.
最后, AWS及其云客户都有责任为各自的员工组织提供安全意识培训. 这些共享控制区域只有助于加强csp及其客户保护他们单独负责的区域的能力.
The benefits of an SRM are fairly defined along the lines of the benefits that 迁移到云 能产生. 作为一个客户，你是在与一个合作伙伴打交道——只是要确保这个合作伙伴是你可以信任的.
Best practices will obviously be dependent on your organization's unique needs. So let's take a look at some of the more general best practices of a solid SRM.