In the context of cloud security, the responsibility is shared between the cloud provider and the cloud consumer. This is known as the shared responsibility model. The cloud provider is responsible for securing the infrastructure that runs all of the services offered in the cloud. On the other hand, the cloud consumer is responsible for managing the security of their data, applications, and operating systems that they run on the cloud infrastructure. The specific responsibilities can vary depending on the service model being used (IaaS, PaaS, SaaS), but the underlying principle is that both parties have a role to play in ensuring the security of cloud services.

References: The concept of shared responsibility in cloud security is widely acknowledged and documented by various cloud service providers and security organizations, including Microsoft Azure1 and the Center for Internet Security (CIS)2. These sources provide detailed explanations of the shared responsibility model and outline the security tasks handled by the cloud provider and those that fall under the cloud consumer’s purview.