Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Supply Chain Security Feeds on the Shared Responsibility Model
Transcript
- Lucas: So, Luna, you know that moment when you realize the thing you thought was someone else's job is actually yours? That's been happening a lot in cloud security lately, and it's the reason we're seeing a wave of CISOs renegotiating their cloud contracts. Luna: I've heard that term, shared responsibility model, but I bet a lot of our listeners think their cloud provider is handling all the security. So what's actually going on? Lucas: Right. The cloud provider secures the infrastructure, but the customer is responsible for securing what they put in it. That's the model, and it's been around since the early days of cloud. But as we move into 2026, with AI workloads and serverless functions, that line is getting really blurry. Luna: Blurry how? Can you give me a concrete example? Lucas: Sure. Take a company that runs a customer-facing app on a major cloud. They think, 'we're on AWS, so we're secure.' But then they get breached because they left a storage bucket open. The provider's security tools were there, but the configuration was on them. That's a classic case. Luna: So it's like buying a safe, but you leave the door open. The safe maker isn't going to close it for you. Lucas: Exactly. And that's the core of the shared responsibility model. The provider gives you the tools, but you have to use them correctly. And in this episode, we're going to dig into how CISOs are actually dealing with this, because it's becoming a board-level conversation. Luna: And before we get too deep, I want to say something. If you're finding these conversations useful for what you're building or running, the way we keep this show ad-free is through listener support. If you've got a minute, you can buy me a coffee at buy me a coffee dot com slash fexingo. It helps us keep diving into topics like this. Lucas: Yeah, and we really appreciate that. Now, let's talk about why this is so critical right now. We've seen a shift from single-cloud to multi-cloud and hybrid setups. That means more moving parts, more configurations, and a bigger attack surface. Luna: And more chances for misconfiguration, right? I remember reading that something like 80 percent of cloud breaches are due to customer misconfiguration. Lucas: That number keeps popping up. And it's why we're seeing a new role emerge: the cloud security architect. Someone who specifically understands the shared responsibility model across different providers and can map out where the gaps are. Luna: So what does a cloud security architect actually do differently from a traditional security engineer? Lucas: They're the ones who sit down with the DevOps teams and say, 'This serverless function you're deploying, who's responsible for patching the runtime? Not the provider. You are.' They translate the cloud provider's documentation into actionable security policies for the company. Luna: That sounds like a lot of translation work. How are they handling it in practice? Lucas: A lot of them are starting with data flow mapping. They create a visual map of where every piece of sensitive data lives, how it moves, and who has access. That becomes the foundation for understanding your responsibilities. Luna: So it's not just about the technology, it's about knowing your data. That makes sense. Lucas: And that's where the contract comes in. We're seeing CISOs and their legal teams go through cloud contracts with a fine-tooth comb, looking for the 'security responsibilities' section. Some are even negotiating to shift more responsibility to the provider, though that's not always easy. Luna: Can you actually negotiate that? I thought the shared responsibility model was pretty fixed. Lucas: It's becoming more flexible, especially for enterprise customers with large spend. A few of the big providers now offer what's essentially 'security as a service' add-ons, where they'll manage more of the stack for you. But that comes at a premium, so not everyone can afford it. Luna: So for most companies, it's still on them. What are the biggest gaps you're seeing? Lucas: Identity and access management is a big one. In a serverless world, permissions are often defined in code, and if that code is too permissive, you're exposed. We've seen incidents where a function had access to a database it never needed. Luna: That's like giving the intern the keys to the executive suite. So how are they fixing that? Lucas: They're adopting a principle of least privilege, but also using automation to scan those permission policies regularly. And they're bringing in identity providers that work across all their cloud platforms, so they have a single view of who can do what. Luna: And what about the AI piece? I imagine AI workloads add a whole new layer of complexity. Lucas: They do. With AI, you're not just dealing with data and code, but also models, training data, and the infrastructure to run it all. The shared responsibility model gets even more nuanced because the provider might offer machine learning services, but you're responsible for the data that goes into them. Luna: And if that training data is sensitive, you'd better make sure it's encrypted and access is controlled. Lucas: Exactly. And that's why we're seeing more CISOs bring in AI security specialists. They understand how to secure the entire AI lifecycle, from data collection to model deployment. Luna: Now, there was a big breach earlier this year, right, that was traced back to a misconfigured cloud database. Can you talk about that? Lucas: Are you thinking of the one where a healthcare company leaked millions of patient records? Yeah, that was a classic case of the company not realizing they were responsible for securing the database, even though it was on a supposedly secure cloud. Luna: That's terrifying. And it goes to show that this isn't just a technical issue, it's a business risk that can destroy trust overnight. Lucas: Right, and the fallout was huge — regulatory fines, lawsuits, and a hit to their reputation. The board came back and said, 'How did this happen?' And the answer was, 'We thought the cloud provider had it covered.' Luna: So what's the takeaway for CISOs out there? Lucas: You've got to be proactive. Don't wait for a breach to find out where your responsibility ends. Conduct a full audit of your cloud environment, map your data, and document every responsibility you have. And then, test it. Luna: Test it how? Is that where tabletop exercises come in? Lucas: Yeah, we've talked about those before. But specifically, run a scenario where a cloud service fails or a misconfiguration is exploited. See how your team responds, who they call, and whether they know where to look. That'll expose gaps in your understanding of the shared responsibility model. Luna: And what about the providers? Are they doing enough to make this clear to their customers? Lucas: They're getting better. A lot of them now have dashboards that show your security posture and flag areas where you might be responsible. But it's still on the customer to pay attention to those alerts and act on them. Luna: So, bottom line: the shared responsibility model is not a set-it-and-forget-it thing. It requires constant vigilance. Lucas: Absolutely. And as we move further into 2026, with more AI and serverless adoption, that vigilance is only going to become more important. The cloud isn't inherently insecure, but it's only as secure as the people using it. Luna: Well said. I think our listeners can take away that they need to own their part of the security, not just assume someone else is handling it. Lucas: Exactly. And maybe that's the most important thing to remember: in the cloud, security is a partnership, but you have to be an active partner. Luna: Thanks for joining us on this deep dive. We'll see you next time.