Cloud Hosting Security: What's Your Job vs the Provider's

Every cloud provider secures the infrastructure. Almost none of them secure what you put on it. This split has a name, the shared responsibility model, and misreading where the line falls causes a lot of the real security incidents that happen on cloud infrastructure.

The provider covers the physical and platform layer: datacenter security, hypervisor isolation between customers, network infrastructure, patching the virtualization stack underneath everything. Hard to get wrong as a customer, mostly because you have zero access to touch it. It's also not where most breaches start.

Your side covers what you configure on top: the OS and its updates (unless you're on fully managed hosting), which ports are open, who has SSH or dashboard access, how secrets get stored, whether your software carries known vulnerabilities. Nearly every real-world cloud breach starts here, not from the provider's infrastructure getting compromised, but from a customer leaving a door unlocked.

The usual suspects. A default SSH port open to the whole internet instead of restricted by IP. Password auth instead of SSH keys. Database ports publicly reachable instead of locked to the application server. API keys sitting in a code repo instead of a secrets manager or environment variables. Software running for months with a known CVE because "it's working, why touch it."

None of these need deep expertise to fix, which is the whole point. These aren't sophisticated attacks, just unlocked doors. A basic firewall (most providers include one, sometimes free), SSH keys instead of passwords, and staying current on patches closes the overwhelming majority of realistic attack surface for a small-to-mid deployment.

If your workload carries real compliance requirements, HIPAA, PCI-DSS, SOC 2, that's a longer conversation, and it starts before you build anything: check whether your provider even supports the relevant framework. Retrofitting compliance onto an existing deployment hurts far more than starting with a provider that already handles it.