Shared responsibility and Zero Trust
Cloud security fails most often when people assume the provider handles something that is actually theirs. The shared responsibility model and Zero Trust are the foundation for almost every other SC-900 topic.
Shared responsibility model
Microsoft secures the cloud infrastructure. You secure what you put in it. The split moves as you go from your own datacenter towards SaaS.
| Responsibility | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Information and data | Customer | Customer | Customer | Customer |
| Devices (mobile and PC) | Customer | Customer | Customer | Customer |
| Accounts and identities | Customer | Customer | Customer | Customer |
| Identity and directory infrastructure | Customer | Shared | Shared | Shared |
| Applications | Customer | Customer | Shared | Microsoft |
| Network controls | Customer | Customer | Shared | Microsoft |
| Operating system | Customer | Customer | Microsoft | Microsoft |
| Physical hosts, network, datacenter | Customer | Microsoft | Microsoft | Microsoft |
Remember the anchor points: the physical datacenter is always Microsoft’s in the cloud, and data, devices and accounts are always yours.
Zero Trust
Zero Trust replaces the idea of a trusted internal network. Its three guiding principles are:
- Verify explicitly: authenticate and authorize using every available signal, such as identity, location, device health and risk.
- Use least privilege access: limit access with just-in-time and just-enough-access, and risk-based adaptive policies.
- Assume breach: minimize the blast radius with segmentation, encrypt end to end and use analytics to detect threats.
Identity is treated as the primary security boundary, because users work from anywhere on any device. The six Zero Trust pillars are identities, endpoints, applications, data, infrastructure and network.
Defense in depth
Defense in depth uses several layers so that one failure does not expose everything. From the outside in: physical security, identity and access, perimeter, network, compute, application and data. Each layer slows an attacker who gets past the previous one.
Confidentiality, integrity, availability
The CIA triad describes what security protects: confidentiality (only authorized people see data), integrity (data is not altered improperly) and availability (systems and data are reachable when needed).
Exam traps
- Zero Trust is not “trust but verify” on the internal network. Nothing is trusted because of its network location.
- In PaaS the customer still owns data, accounts and identities. Only the OS and runtime move to Microsoft.
- SaaS does not remove customer duties. You still manage users, devices and the data you store.
- “Assume breach” does not mean giving up on prevention. It means designing to limit damage and detect quickly.
- Defense in depth is layered protection, not a single product such as a firewall.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. In an Azure virtual machine (IaaS) deployment, who is responsible for installing operating system updates?
Show answer
Answer: B.With IaaS the customer manages the guest operating system, including patching. Microsoft only handles the physical host, network and datacenter.
2. Which responsibility always stays with the customer, whatever the cloud service type?
Show answer
Answer: C.Data, endpoints, accounts and access management are always the customer's responsibility in IaaS, PaaS, SaaS and on-premises.
3. A security team decides to treat every request as if it came from an open network and to give each user only the access needed for the task. Which Zero Trust principles does this follow?
Show answer
Answer: A.Zero Trust rests on verify explicitly, use least privilege access and assume breach. The network is never trusted by default.
4. Which defense in depth layer includes network security groups and DDoS protection?
Show answer
Answer: C.The network layer limits connectivity and reduces attack exposure with tools such as NSGs, firewalls and DDoS protection.