The following model explains the levels of responsibility for the use and management of cloud services that are shared between the provider (Aruba Cloud) and the customer.
It is commonly believed that, when using a cloud service, responsibility for any issues can be delegated entirely to the provider, whether they are technical, legal or security-related.
As shown in the model below, the provider is not responsible for data management and classification. For example, distinguishing between sensitive data and data that can be made public is solely the customer's responsibility. Conversely, the customer is not responsible for the physical security of the cloud infrastructure.
This division of responsibilities leads to a distinction between:
- security of the cloud: concerns the protection of the physical infrastructure and data centers and is the provider's responsibility;
- security in the cloud: concerns the configuration, management and verification of security within the cloud environment and is the customer's responsibility.
The cloud services provided by Aruba Cloud require the customer to play an active role in managing and protecting their environment. In particular, by way of example and without limitation, the customer is responsible for the correct configuration of backup and Disaster Recovery solutions, including their appropriate sizing, the planning of protection measures, and the periodic execution of restore and/or failover tests.
The customer may use the tools and services provided by Aruba Cloud, while remaining responsible for their correct configuration and use.