Che cos’è il modello di responsabilità condivisa di AWS?

I fornitori di servizi cloud come AWS manage a significant portion of infrastructure security, but that does not mean customers are off the hook. The Amazon shared responsibility model defines exactly where provider responsibility ends and customer responsibility begins.

Questo articolo illustra i principali elementi del modello di responsabilità condivisa e offre una panoramica pratica di come la responsabilità si distribuisca a seconda del tipo di servizio AWS utilizzato.

Nota: molti di questi concetti si applicano anche ad altri fornitori di servizi cloud.

The Amazon shared responsibility model separates responsibilities into two categories: security of the cloud and security in the cloud. AWS is responsible for the physical infrastructure, including data centers, servers, and networking. Customers manage what runs inside the cloud, including data, access controls, application settings, and encryption.

Con i servizi IaaS (Infrastructure-as-a-Service) come Amazon EC2, i clienti gestiscono il sistema operativo, le impostazioni del firewall e l’applicazione delle patch software. Al contrario, con i servizi serverless o gestiti come AWS Lambda o Amazon S3, AWS si occupa della piattaforma e dell’ambiente di esecuzione, mentre i clienti rimangono responsabili delle autorizzazioni di accesso e dell’integrità dei dati.

Per adempiere alla propria parte del modello, i clienti devono disporre di processi chiari per la gestione delle configurazioni, l’applicazione delle patch e la protezione delle identità. AWS può fornire l’infrastruttura, ma i clienti sono responsabili della sicurezza di ciò che realizzano su di essa.

Un’errata comprensione del modello di responsabilità condivisa può portare a lacune nella sicurezza di AWS. Quando i team presumono che AWS si occupi di più di quanto effettivamente faccia, attività chiave come il controllo degli accessi o la crittografia dei dati potrebbero essere tralasciate, aumentando il rischio di esposizione o di problemi di conformità.

L’assegnazione di ruoli chiari contribuisce a ridurre la confusione e le omissioni. I team di sicurezza devono definire chi si occupa di cosa a livello di rete, configurazione e applicazioni. Ciò include decidere chi imposta le politiche del firewall, chi gestisce l’applicazione delle patch e chi monitora l’attività del sistema.

1. Inventory AWS services in use: Identify which services are used and categorize them by service type (IaaS, PaaS, SaaS), since responsibility shifts based on the model.

2. Map responsibilities clearly: Use AWS documentation to separate what AWS manages from what your teams need to handle.

3. Assign ownership by control: Document which team or person is responsible for each task, especially for customer-managed controls like encryption or access policies.

4. Automate configuration checks: Use tools such as AWS Config to monitor compliance with your internal security standards.

5. Audit permissions regularly: Review IAM policies to limit access based on job roles and remove unused credentials.

6. Architect for worst-case scenarios: Build with immutability, indelibility, and air gapping so that if a catastrophic event happens or bad actor gets in, the damage is minimized and there’s always a recovery point available.

Commvault enables this level of proactive isolation and immutability with:

• Easily configurable data copies in isolated accounts with Commvault AirGap.
• Air-gapped, cross-account backups by default with Commvault® Cloud Rewind and Clumio.

7. Test response processes: Run simulations to verify that detection and recovery actions work as expected and are assigned to the right teams.

Commvault can help automate the testing and validation of recovery processes with its industry-first Cleanroom™ Recovery solution or through the cross-region, cross-account recovery capabilities within Cloud Rewind and Clumio.

8. Update documentation regularly: As service usage changes, revise your shared responsibility model mappings to reflect current architecture and controls.

Questa tabella evidenzia come la responsabilità si sposti da un unico responsabile a un modello condiviso. Un’errata comprensione di tali cambiamenti può portare a lacune nella protezione, specialmente in ambiti quali il controllo degli accessi e la registrazione degli audit. Sapere quale team è responsabile di quale controllo aiuta a ridurre tale rischio.

• Simplified management: Commvault integrates broadly across AWS services – as well as other on-premises and cloud technologies – to automate policy-based protection from a single pane of glass.
• Enhanced security: Commvault provides greater protection against ransomware and other cyberthreats with AI-forward threat scanning, as well as providing air-gapped, immutable, indelible backup copies for improved recoverability.
• Lower TCO: In addition to the cost benefits of helping to mitigate risk and reduce the impact of potential threats, Commvault also helps organizations control data protection-related cloud costs by optimizing how the data is collected and stored. With Commvault, organizations can keep fewer full snapshots and store data deduplicated and compressed without compromising recovery point objectives, realizing significant cost savings.

Il Gruppo Sony, colosso mondiale dell’intrattenimento e dell’elettronica, ha dovuto affrontare sfide significative nell’unificare la resilienza informatica nel proprio complesso ambiente multi-cloud. Con ampie implementazioni su AWS e Azure, il team dei servizi per i data center aveva bisogno di una soluzione in grado di collegare i carichi di lavoro on-premise, cloud e SaaS, soddisfacendo al contempo rigorosi requisiti di sicurezza.

“Our strategy is to connect globally from our data centers to our cloud solution,” explains Cassandra Cinar, senior director of Data Center Services at Sony. “To achieve that, we need a unified platform for recovery across cloud, on-premises, and software-as-a-service workloads.”
Sony’s security requirements were particularly demanding. The company needed a solution that could protect data across virtually all AWS users globally while supporting the company’s diverse multi-architecture environment. Additionally, the solution needed to help Sony comply with internal financial systems as well as SOC and GDPR requirements.

Dopo aver valutato diverse opzioni, Sony ha scelto Commvault Cloud per le sue funzionalità complete di resilienza informatica. L’implementazione copre ora 5.000 endpoint distribuiti su più data center, regioni e provider cloud, compresa la sua ampia presenza su AWS.

I risultati sono stati notevoli. Sony ha ridotto i costi relativi all’hardware, ai supporti di archiviazione e al backup di circa l’80% grazie alla crittografia, alla compressione e al passaggio all’archiviazione su disco e nel cloud su AWS e Azure. L’azienda ha inoltre migliorato i propri obiettivi di punto di ripristino (RPO) e ha acquisito la capacità di riconoscere le minacce più tempestivamente, ripristinare più rapidamente e ridurre i tempi di inattività.

“The key differences among security solutions lie in their deployment and recovery capabilities,” Cinar said. “Commvault’s robust and comprehensive infrastructure satisfies all our needs for recovery, service-level agreements, and crucial functionalities like threat detection and other security features.”

Sony’s experience demonstrates how organizations can successfully navigate the AWS shared responsibility model by implementing a unified approach to data protection and security across hybrid environments. Their partnership with Commvault and Accenture allowed them to establish consistent protection policies across their entire AWS infrastructure while maintaining compliance with both internal and external requirements.

Commvault helps address customer responsibilities under the AWS shared responsibility model by providing enterprise-grade tools for data protection, recovery, and la conformità. Its platform supports hybrid and multi-cloud environments, so organizations can manage their data consistently across AWS and other infrastructure.

Commvault extends the responsibility of securing and protecting data in the cloud to mission-critical data center workloads through air-gapped, immutable backups stored within an isolated tenant in Amazon S3.

This enables organizations to provide this added layer of recoverability across the broadest ecosystem, including infrastructure and applications like SAP, Oracle, Microsoft SQL Server, Active Directory, Epic Systems, VMware, and ServiceNow, among others. Commvault protects these workloads, backing them up into AWS and providing additional layers of security and resilience to align with the shared responsibility model.

Simplifying with built-in automation, Commvault reduces manual steps in backup and recovery, helping teams respond faster and with fewer errors. Centralized visibility across workloads gives IT and security teams the ability to monitor data activity, verify controls, and stay aligned with industry regulations.

Commvault also enables organizations to provide faster recoveries at lower cost for emerging native workloads like Amazon S3 and Amazon DynamoDB with their Clumio solution, optimizing protection and making this critical protection more accessible. Organizations leveraging Clumio can meet their shared responsibility for protecting data within native AWS services with a simple, turnkey solution optimized for cost and efficiency.

Understanding the AWS shared responsibility model is critical for protecting your data and applications in the cloud. When you know exactly which security controls fall under your responsibility, you can build stronger defenses and respond faster to threats.
Commvault can help organizations close security gaps and strengthen their data protection strategy in AWS, so let us show you how our platform can support your cloud security goals by richiesta di una demo.