Connect with us

Tech

SLA promises, security realities: Navigating the shared responsibility gap | Computer Weekly

Published

on

SLA promises, security realities: Navigating the shared responsibility gap | Computer Weekly


The shared responsibility model (SRM) plays a central role in defining how security and operational duties are split between cloud providers and their customers. However, when this model intersects with service level agreements (SLAs), it introduces layers of complexity.

SLAs typically cover metrics like uptime, support response times and service performance, but often overlook critical elements such as data protection, breach response and regulatory compliance. This creates a responsibility gap, where assumptions about who is accountable can lead to serious blind spots. For instance, a customer might assume that the cloud provider’s SLA guarantees data protection, only to realise that their own misconfigurations or weak identity management practices have led to a data breach.

Organisations may mistakenly believe their provider handles more than it does, increasing the risk of non-compliance, security incidents and operational disruptions. Understanding the nuances between SLA commitments and shared security responsibilities is vital to safely leveraging cloud services without undermining resilience or regulatory obligations.

The reality of the SRM and SLAs

The SRM fundamentally shapes the scope and impact of SLAs in cloud environments. Let’s quickly understand the reality of cloud providers’ SRM.

  • Cloud providers secure the infrastructure they manage; you ensure what you deploy.
  • Customers are responsible for data, configurations, identities and applications.
  • Cloud providers often cite the model to deflect blame during breaches. 
  • Customers must secure the stack themselves, as cloud doesn’t equal safe-by-default -visibility, policy and controls are still on you.

While an SLA guarantees the cloud provider’s commitment to “the security of the cloud”, ensuring the underlying infrastructure’s uptime, resilience and core security, it explicitly does not cover the customer’s responsibilities for “security in the cloud.” This means that even if a provider’s SLA promises 99.99% uptime for their infrastructure, a customer’s misconfigurations, weak identity management or unpatched applications (all part of their responsibility) can still lead to data breaches or service outages, effectively nullifying the perceived security and uptime benefits of the provider’s SLA. Therefore, the SRM directly impacts the adequate security and availability experienced by the enterprise, making diligent customer-side security practices crucial for realising the full value of any cloud SLA.

Several controls should be a part of a comprehensive approach to gaining access to innovative cloud technology while safeguarding your enterprise:

  • Due diligence, gap analysis and risk quantification: Conduct an exhaustive review of the cloud provider’s security posture beyond just the SLA. Request and scrutinise security whitepapers, independent audit reports (eg FedRAMP, SOC 2 Type 2, ISO 27001) and penetration test summaries. Perform a detailed risk assessment that quantifies the potential impact of any SLA shortfalls on your business operations, data privacy and regulatory obligations. Understand precisely where the provider’s “security of the cloud” ends and your “security in the cloud” responsibilities begin, especially concerning data encryption, access controls and incident response.
  • Strategic contract negotiation and custom clauses: Engage in direct negotiation with the cloud provider to tailor the SLA to your infrastructure requirements. For significant contracts, cloud providers should be willing to include custom clauses addressing critical security commitments, data handling procedures, incident notification timelines and audit rights that exceed their standard offerings. Ensure the contract includes indemnification clauses for data breaches or service disruptions directly attributable to the provider’s security failures, and clearly define data portability and destruction protocols for an effective exit strategy.
  • Implement robust layered security (defence-in-depth): Recognise that the shared responsibility model necessitates your active participation. In addition to the provider’s native offerings, implement additional security controls covering, among others, identity and access management (IAM), cloud security posture management (CSPM), cloud workload protection (CWP), data loss prevention (DLP) and zero trust network access (ZTNA).
  • Enhanced security monitoring and integration: Integrate the cloud service’s logs and security telemetry into your enterprise’s security information and event management (SIEM) and security orchestration, automation and response (SOAR) platforms. This centralised visibility and correlation capability allows your security operations centre (SOC) to detect, analyse and respond to threats across both your on-premises and cloud environments, bridging any potential gaps left by the provider’s default monitoring.
  • Proactive governance, risk and compliance (GRC): Update your internal security policies and procedures to explicitly account for the new cloud service and its specific risk profile. Map the provider’s security controls and your compensating controls directly to relevant regulatory requirements (eg GDPR, HIPAA, PCI DSS). Maintain meticulous documentation of your risk assessments, mitigation strategies and any formal risk acceptance decisions.

By adopting these strategies, IT and IT security leaders can confidently embrace innovative cloud technologies, minimising inherent risks and ensuring a strong compliance posture, even when faced with SLAs that don’t initially meet every desired criterion.

The bottom line

Make sure to follow the principle “own your security posture” by implementing customised security policies and not relying solely on your cloud provider. Treat security as a core component of your infrastructure and not an add-on.  Adopt and deploy unified controls to align security strategies across all environments to strengthen defences against the expanding threat landscape, thereby reducing risk and boosting resilience. Shared responsibility doesn’t mean shared blame, it means shared diligence.

Aditya K Sood is vice president of security engineering and AI strategy at Aryaka.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Security News This Week: Oh Crap, Kohler’s Toilet Cameras Aren’t Really End-to-End Encrypted

Published

on

Security News This Week: Oh Crap, Kohler’s Toilet Cameras Aren’t Really End-to-End Encrypted


An AI image creator startup left its database unsecured, exposing more than a million images and videos its users had created—the “overwhelming majority” of which depicted nudes and even nude images of children. A US inspector general report released its official determination that Defense Secretary Pete Hegseth put military personnel at risk through his negligence in the SignalGate scandal, but recommended only a compliance review and consideration of new regulations. Cloudflare’s CEO Matthew Prince told WIRED onstage at our Big Interview event in San Francisco this week that his company has blocked more than 400 billion AI bot requests for its customers since July 1.

A new New York law will require retailers to disclose if personal data collected about you results in algorithmic changes to their prices. And we profiled a new cellular carrier aiming to offer the closest thing possible to truly anonymous phone service—and its founder, Nicholas Merrill, who famously spent a decade-plus in court fighting an FBI surveillance order targeted at one of the customers of his internet service provider.

Putting a camera-enabled digital device in your toilet that uploads an analysis of your actual bodily waste to a corporation represents such a laughably bad idea that, 11 years ago, it was the subject of a parody infomercial. In 2025, it’s an actual product—and one whose privacy problems, despite the marketing copy of the company behind it, have turned out to be exactly as bad as any normal human might have imagined.

Security researcher Simon Fondrie-Teitler this week published a blog post revealing that the Dekota, a camera-packing smart device sold by Kohler, does not in fact use “end-to-end encryption” as it claimed. That term typically means that data is encrypted so that only user devices on either “end” of a conversation can decrypt the information therein, not the server that sits in between them and hosts that encrypted communication. But Fondrie-Teitler found that the Dekota only encrypts its data from the device to the server. In other words, according to the company’s definition of end-to-end encryption, one end is essentially—forgive us—your rear end, and the other is Kohler’s backend, where the images of its output are “decrypted and processed to provide our service,” as the company wrote in a statement to Fondrie-Teitler.

In response to his post pointing out that this is generally not what end-to-end encryption means, Kohler has removed all instances of that term from its descriptions of the Dekota.

The cyberespionage campaign known as Salt Typhoon represents one of the biggest counterintelligence debacles in modern US history. State-sponsored Chinese hackers infiltrated virtually every US telecom and gained access to the real-time calls and texts of Americans—including then presidential and vice-presidential candidates Donald Trump and J.D. Vance. But according to the Financial Times, the US government has declined to impose sanctions on China in response to that hacking spree amid the White House’s effort to reach a trade deal with China’s government. That decision has led to criticism that the administration is backing off key national security initiatives in an effort to accommodate Trump’s economic goals. But it’s worth noting that imposing sanctions in response to espionage has always been a controversial move, given that the United States no doubt carries out plenty of espionage-oriented hacking of its own across the world.

As 2025 draws to a close, the nation’s leading cyberdefense agency, the Cybersecurity and Infrastructure Agency (CISA), still has no director. And the nominee to fill that position, once considered a shoo-in, now faces congressional hurdles that may have permanently tanked his chances to run the agency. Sean Plankey’s name was excluded from a Senate vote Thursday on a panel of appointments, suggesting his nomination may be “over,” according to CyberScoop. Plankey’s nomination had faced various opposition from senators on both sides of the aisle with a broad mix of demands: Florida’s Republican senator Rick Scott had placed a hold on his nomination due to the Department of Homeland Security (DHS) terminating a Coast Guard contract with a company in his state, while North Carolina’s GOP senators opposed any new DHS nominees until disaster relief funding was allocated to their state. Democratic senator Ron Wyden, meanwhile, has demanded CISA publish a long-awaited report on telecom security prior to his appointment, which still has yet to be released.

The Chinese hacking campaign centered around the malware known as “Brickstorm” first came to light in September, when Google warned that the stealthy spy tool has been infecting dozens of victim organizations since 2022. Now CISA, the National Security Agency, and the Canadian Centre for Cybersecurity jointly added to Google’s warnings this week in an advisory about how to spot the malware. They also cautioned that the hackers behind it appear to be positioned not only for espionage targeting US infrastructure but also potentially disruptive cyberattacks, too. Most disturbing, perhaps, is a particular data point from Google, measuring the average time until the Brickstorm breaches have been discovered in a victim’s network: 393 days.



Source link

Continue Reading

Tech

Top Vimeo Promo Codes and Discounts This Month in 2025

Published

on

Top Vimeo Promo Codes and Discounts This Month in 2025


Remember Vimeo? You probably don’t use it to browse videos the way you might with some other services. But if you landed on this page, there’s a good chance you use it to host your professional portfolio. Or assets for your business. Or your short films. Vimeo has tools other video hosting services simply don’t have, like AI editing tools, on-demand content selling, customizable embeds, and collaborative editing features. And best of all: There are no ads. WIRED has rotating Vimeo promo codes to help you save.

Get 10% Off Annual Plans With This Vimeo Promo Code

No matter what you need for your business or career, when it comes to video, Vimeo’s got multiple plans to suit. And luckily, right now, you can save with a Vimeo promo code—even on the annual plans, which already include 40% in savings. Just use Vimeo coupon code GETVIMEO10 to save 10% on your membership plan.

The Easiest Way to Save 40% on Your Vimeo Plan

Vimeo has a few different membership plans that you can save on. No matter which you go with, the easiest way to save a lot is with an annual membership, which has automatic 40% savings compared to paying monthly. And yes, you can even stack promo codes with the annual billing options.

More on Vimeo Pricing and Membership Plans

So what tier do you need? The Starter plan starts at $12 per month (billed annually) or $20 per month (billed monthly). It comes with 100 gigabytes of storage, plus boosted privacy controls, custom video players, custom URLs, and automatic closed captioning.

Boost your plan to Standard for $25 per month (billed annually) or $41 per month (billed monthly) to upgrade to 2 terabytes of storage, 5 “seats” (which are collaborative team member spots), a brand kit, a teleprompter, text-based video editing, AI script generation, and engagement and social analytics.

Finally, there’s the Advanced plan, which costs $75 per month (billed annually) or $125 per month (billed monthly). You’ll get 10 “seats”, 7 terabytes of storage, AI-generated chapters and text summaries, live chat and poll options, plus streaming and live broadcast capabilities.

Use a Vimeo Coupon Code to Get Savings on Vimeo on Demand

Vimeo on Demand is a new way to stream and download movies online. Through Vimeo on Demand, you can rent, buy and subscribe to the best original films, documentaries and series directly from your favorite small business video creators, including The Talent and Wild Magic.

Vimeo Enterprise Solutions 2025

You may have not heard about Vimeo Enterprise, but it’s probably the most essential program for content creators, videographers, and digital media in the workplace in general. From meeting recordings and AI-driven video creation to compliance and distribution, Vimeo Enterprise helps centralize and manage video workflows.

Does Vimeo Have a Free Trial?

While Vimeo doesn’t have a free trial of its paid plans, it does have a free plan with some basic features. Additionally, paid plans can be canceled anytime–within 14 days for an annual subscription, or 3 days for a monthly subscription. You’ll get a full refund if you decide to cancel within the respective timeframes.



Source link

Continue Reading

Tech

WIRED Roundup: DOGE Isn’t Dead, Facebook Dating Is Real, and Amazon’s AI Ambitions

Published

on

WIRED Roundup: DOGE Isn’t Dead, Facebook Dating Is Real, and Amazon’s AI Ambitions


Leah Feiger: So it’s a really good question actually, and it’s one that I’ve thought about for quite some time. I think if it’s not annoying, I want to read this quote from Scott Kupor, the director of OPM and the former managing partner at Andreessen Horowitz, to be clear, just to remind everyone where people are coming from in this current administration. He posted this on X late last month, and this was part of Reuter’s reporting. So he posts, “The truth is, DOGE may not have centralized leadership under USDS anymore, but the principles of DOGE remain alive and well, deregulation, eliminating fraud, waste and abuse, reshaping the federal workforce, et cetera, et cetera, et cetera.” Which is the exact same, the thing that they’ve been saying this entire time, but it’s all smoke and mirrors, right? It’s like, oh no, no, well, DOGE doesn’t exactly exist anymore. There’s no Elon Musk character leading it, which Elon Musk himself said on the podcast with Joe Rogan last month as well. He’s like, “Yeah, once I left, they weren’t able to pick on anyone, but don’t worry, DOGE is still there.” So it feels wild to watch people fall for this and go like, “DOGE is gone now.” And I’m like, they’re literally telling us that it’s not.

Zoë Schiffer: I think one thing that does feel honestly true is that it is harder and harder to differentiate where DOGE stops and the Trump administration begins because they have infiltrated so many different parts of government and the DOGE ethos, what you’re talking about, deregulation, cost cuttings, zero-based budgeting, those have really become kind of table stakes for the admin, right?

Leah Feiger: I think that’s such a good point. And honestly, by the end of Elon Musk’s reign, something that kept coming up wasn’t necessarily that the Trump administration didn’t agree with DOGE’s ethos at all. It was that they didn’t really agree with how Musk was going about it. They didn’t like that he was stepping on Treasury Secretary Scott Bessent and having fights outside of the Oval Office. That was bad optics and that also wasn’t helping the Trump administration even look like they were on top of it.



Source link

Continue Reading

Trending