Why Shared Fate is a Better Way to Manage Cloud Risk

Cloud security breaches happen, and when they do, it's common for finger-pointing to follow. There's an opportunity for both cloud users and cloud service providers (CSPs) to work together to transcend the limitations of the established shared responsibility model of cloud security. Building on that model's foundations and addressing its shortcomings can lead us to a better and more secure cloud future. 

Who "Owns" Cyber Risks? 

While under the shared responsibility model direct responsibilities change depending on the cloud services a customer is using, the CSP is always responsible for defending against threats to the cloud infrastructure, and the customer is always responsible for the security of the data and applications they manage in the cloud. 

But as cloud adoption has expanded, the limitations of shared responsibility have become clear. A hard edge between areas of responsibility isn't realistic to maintain in many areas of security. In addition, customers frequently assume that the CSP will take ownership of more cybersecurity responsibility than they actually do, and in many cases the only realistic way to defend against or respond to cyber threats is for the customer and CSP security teams to work together. 

Limitations of Shared Responsibility 

Some specific ways that the shared responsibility model can break down include: 

After years of real world use, it's clear that there are some critical areas where the shared responsibility model is not enough — and from a practical point of view, placing more burdens on cloud customers to try to fill the gaps is simply not going to fix the problem. There's a need for an updated cloud security paradigm, one that offers more actual solutions and encourages more collaboration.

The Shared Fate Model

The next stage of the evolution beyond traditional shared responsibility for cloud security is Google's shared fate, a collaborative model for handling cloud risks. Under the shared fate model, the CSP takes a much more proactive role, including providing guidance at the deployment stage as well as recommendations and tools to ensure ongoing security. Shared fate sees the cloud provider accepting the reality of where shared responsibility breaks down and steps up to close the gaps. 

Secure-by-default infrastructure, security foundations, and secure blueprints are elements of the shared fate model that take some of the security burdens off of customers' teams. In complex cloud environments involving multiple stakeholders, the model provides guides for how workflows and responsibilities should be arranged, rather than leaving it up to the customer to figure out alone. And shared fate places a greater emphasis on cyber insurance, a crucial aspect of responsible security that is there to help a cloud customer in the case of a cyber incident. 

Shared fate represents a shift intended to meet customers where they are and help them get to where they want to be. While customers always have some level of responsibility for cloud security, the shared fate model is a more pragmatic way to help manage cyber risks. Because in the end, cloud security is not just about deciding who does what, but about doing better, together.