{"id":111690,"date":"2024-10-24T09:16:27","date_gmt":"2024-10-24T16:16:27","guid":{"rendered":"https:\/\/www.backblaze.com\/blog\/?p=111690"},"modified":"2024-10-24T09:16:29","modified_gmt":"2024-10-24T16:16:29","slug":"saas-and-the-shared-responsibility-model-a-guide-to-protecting-your-data","status":"publish","type":"post","link":"https:\/\/www.backblaze.com\/blog\/saas-and-the-shared-responsibility-model-a-guide-to-protecting-your-data\/","title":{"rendered":"SaaS and the Shared Responsibility Model: A Guide to Protecting Your Data"},"content":{"rendered":"\n
\"A<\/figure>\n\n\n\n
<\/div>\n\n\n\n

Were you the person who stayed up until 2 a.m. to finish the group project? If you, like me, burned the midnight oil to save the team from utter failure, you suffered from a breakdown of shared responsibility. No one knew who was supposed to do what.<\/p>\n\n\n\n

The same breakdown applies when you don\u2019t fully understand the \u201cshared responsibility model\u201d that most software as a service (SaaS) platforms use when it comes to your data. You might assume that, because it\u2019s in the cloud, your SaaS data is protected automatically. In reality, SaaS companies are only responsible for maintaining their<\/em> uptime, not for retaining your files and critical information in case you need to get back online\u2014and this has big implications for how you protect your data, ensure compliance, and optimize system performance.<\/p>\n\n\n\n

Today, I\u2019m diving into what this model means and how it affects how you use SaaS platforms.<\/p>\n\n\n\n

What is the shared responsibility model?<\/h2>\n\n\n\n

The shared responsibility model defines the division of duties between a SaaS provider and its customers. It delineates which aspects of the system the provider manages and what tasks remain under the customer\u2019s control. The primary goal is to clarify roles and reduce any ambiguity about who is responsible for certain aspects of security, data integrity, and system maintenance. <\/p>\n\n\n\n

Defined roles, reduced ambiguity. That all sounds great to me, but what do SaaS providers actually take responsibility for? And what are you responsible for? <\/p>\n\n\n\n

SaaS provider responsibilities<\/h3>\n\n\n\n

First and foremost, SaaS providers are responsible for ensuring that the application and its underlying infrastructure (servers, networking, data centers) are secure. This includes physical security, network protection, patching the platform, and overall system integrity. They typically guarantee a certain level of service availability, often formalized in a service level agreement (SLA). Downtime, system performance, and platform updates fall within the vendor’s scope.<\/p>\n\n\n\n

Practically speaking, that means that they may not back up your data as often as you would like or archive it for as long as you need. SaaS vendors do not concern themselves with fully protecting your files. Most importantly, they may not offer a timely recovery option if you lose the data, which is critical to getting your business back online in the event of an outage. <\/p>\n\n\n\n

Customer responsibilities<\/h3>\n\n\n\n

SaaS providers and cloud drives typically take responsibility for the security \u201cof\u201d the cloud, including the infrastructure that runs all of the services offered in the cloud. On the other hand, the customers are responsible for security \u201cin\u201d the cloud. This means customers must manage the security of their own data.<\/p>\n\n\n\n

What\u2019s the difference? Let\u2019s use an example I\u2019ve come across many times. If a user inadvertently uploads a ransomware<\/a>-infected file to a cloud drive like Google Drive<\/a> or OneDrive, the service might protect the integrity of the cloud infrastructure, ensuring the malware doesn\u2019t spread to other users. However, the responsibility to prevent the upload of the infected file in the first place, and managing its consequences, falls directly on the user. In essence, while cloud drives provide a platform for storing your data, relying solely on them without understanding the nuances of the shared responsibility model could leave gaps in your data protection strategy. <\/p>\n\n\n\n

Customer responsibilities include, among others:<\/p>\n\n\n\n