The Shared Responsibility Model and SaaS, explained

Data limitations of cloud computing

There’s a commonly held belief that if something is “in the cloud” it will always be there. But here’s the eye-opening truth—storing data in the cloud doesn’t mean it will always be there.

Not too long ago, vital business data used to be stored on-premise, in a giant maze of never-ending server rooms. This onsite infrastructure ran everything a company needed when it came to their networks.

Before the shift to cloud, in-house experts were typically responsible for building and maintaining backup procedures and in-house backup storage. But in the cloud, data backups have largely been left behind, likely because of the mistaken belief that “the cloud is always backed up.” Organizations with strong on-prem backup and recovery plans have neglected to bring this level of planning to cloud data backups– although they can both save a business.

Infrastructure, platform, and software as a service: What’s the difference?

As the internet matured and the flow of information got faster, companies began to outsource even more of their IT and software needs. This evolution has led to different options for businesses. These options include Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS).

In IaaS, the company providing the cloud manages all the physical infrastructure. Customers (or users) then have access to this network, which essentially acts as an extension of their own data center infrastructure. IaaS brings many benefits, such as potentially making workloads (a workload is an application or a service deployed on the cloud) faster, easier, more flexible, and more cost-efficient. Think of Amazon Web Services, Microsoft Azure, Google Cloud, and others. More often than not, IaaS is being used by companies that build their own software.

PaaS essentially involves having third-party companies manage the IT infrastructure but giving developers access to a framework where they can build customized apps. Many companies are both PaaS and IaaS, however, some businesses such as Heroku, Netlify, and Elastic Beanstalk are just PaaS.

And finally, there’s SaaS, which is the type of online software most people are familiar with. At last count, there are over 145,00 SaaS companies worldwide today. Most SaaS applications run directly from a web browser without any downloads or installations required, although some require plugins. For decades, businesses ran their software on their own computers, hosted on their desktops or servers. Online software like GitHub or Jira essentially eliminated the need to install and run applications on individual computers.  

Do you own your software, or rent it?

Think about this for a second. You don’t own the software, you rent it. This includes all the servers. And if businesses no longer own or control the servers which run their software, they also don’t have full control over their data. In other words, you have no physical copy of that data. So unless you have a copy, you can’t restore anything if it gets lost. And neither can the SaaS provider.

This brings us back to the Shared Responsibility Model.

It’s an aspect of cloud computing that’s rarely talked about, but something which can have a dramatic impact. Yet the shared responsibility model is a function of cloud computing itself. It outlines where a cloud provider’s duty of care ends and the customers begin. And regardless of whether you use infrastructure, platform, or software-as-a-service – the Shared Responsibility Model is part of the mix. 

If we map all the solutions out side by side, we can see where the provider’s responsibility ends and where the users’ begins:

For IaaS and PaaS, customers have many more things they are on the hook for. SaaS has the fewest number of things, but if you notice; data and user access/security are across the board. 

So whether you have a giant on-premise server room worth millions of dollars or you’re paying $99 a month for an app, software customers are ALWAYS responsible for ensuring data is protected. This is the crux of the Shared Responsibility Model. You and the SaaS provider share the responsibility for protecting your data. 

Why don’t SaaS tools protect your data?

It’s a common question. Why don’t Software-as-a-Service companies just save the data? There’s a distinction we need to make. They do “save” it – but they only save this data in a format that makes sense to them. 

Every new piece of data or content you create is hosted on the servers of whichever SaaS tool you are using. This data gets lumped in with all the users of said tool. You see all the customer information, reports, project plans, financial statements, or whatever function you use that specific SaaS tool for. Other the other side of the mirror, the SaaS provider essentially sees ones and zeros.