Connect with us

Tech

SLA promises, security realities: Navigating the shared responsibility gap | Computer Weekly

Published

on

SLA promises, security realities: Navigating the shared responsibility gap | Computer Weekly


The shared responsibility model (SRM) plays a central role in defining how security and operational duties are split between cloud providers and their customers. However, when this model intersects with service level agreements (SLAs), it introduces layers of complexity.

SLAs typically cover metrics like uptime, support response times and service performance, but often overlook critical elements such as data protection, breach response and regulatory compliance. This creates a responsibility gap, where assumptions about who is accountable can lead to serious blind spots. For instance, a customer might assume that the cloud provider’s SLA guarantees data protection, only to realise that their own misconfigurations or weak identity management practices have led to a data breach.

Organisations may mistakenly believe their provider handles more than it does, increasing the risk of non-compliance, security incidents and operational disruptions. Understanding the nuances between SLA commitments and shared security responsibilities is vital to safely leveraging cloud services without undermining resilience or regulatory obligations.

The reality of the SRM and SLAs

The SRM fundamentally shapes the scope and impact of SLAs in cloud environments. Let’s quickly understand the reality of cloud providers’ SRM.

  • Cloud providers secure the infrastructure they manage; you ensure what you deploy.
  • Customers are responsible for data, configurations, identities and applications.
  • Cloud providers often cite the model to deflect blame during breaches. 
  • Customers must secure the stack themselves, as cloud doesn’t equal safe-by-default -visibility, policy and controls are still on you.

While an SLA guarantees the cloud provider’s commitment to “the security of the cloud”, ensuring the underlying infrastructure’s uptime, resilience and core security, it explicitly does not cover the customer’s responsibilities for “security in the cloud.” This means that even if a provider’s SLA promises 99.99% uptime for their infrastructure, a customer’s misconfigurations, weak identity management or unpatched applications (all part of their responsibility) can still lead to data breaches or service outages, effectively nullifying the perceived security and uptime benefits of the provider’s SLA. Therefore, the SRM directly impacts the adequate security and availability experienced by the enterprise, making diligent customer-side security practices crucial for realising the full value of any cloud SLA.

Several controls should be a part of a comprehensive approach to gaining access to innovative cloud technology while safeguarding your enterprise:

  • Due diligence, gap analysis and risk quantification: Conduct an exhaustive review of the cloud provider’s security posture beyond just the SLA. Request and scrutinise security whitepapers, independent audit reports (eg FedRAMP, SOC 2 Type 2, ISO 27001) and penetration test summaries. Perform a detailed risk assessment that quantifies the potential impact of any SLA shortfalls on your business operations, data privacy and regulatory obligations. Understand precisely where the provider’s “security of the cloud” ends and your “security in the cloud” responsibilities begin, especially concerning data encryption, access controls and incident response.
  • Strategic contract negotiation and custom clauses: Engage in direct negotiation with the cloud provider to tailor the SLA to your infrastructure requirements. For significant contracts, cloud providers should be willing to include custom clauses addressing critical security commitments, data handling procedures, incident notification timelines and audit rights that exceed their standard offerings. Ensure the contract includes indemnification clauses for data breaches or service disruptions directly attributable to the provider’s security failures, and clearly define data portability and destruction protocols for an effective exit strategy.
  • Implement robust layered security (defence-in-depth): Recognise that the shared responsibility model necessitates your active participation. In addition to the provider’s native offerings, implement additional security controls covering, among others, identity and access management (IAM), cloud security posture management (CSPM), cloud workload protection (CWP), data loss prevention (DLP) and zero trust network access (ZTNA).
  • Enhanced security monitoring and integration: Integrate the cloud service’s logs and security telemetry into your enterprise’s security information and event management (SIEM) and security orchestration, automation and response (SOAR) platforms. This centralised visibility and correlation capability allows your security operations centre (SOC) to detect, analyse and respond to threats across both your on-premises and cloud environments, bridging any potential gaps left by the provider’s default monitoring.
  • Proactive governance, risk and compliance (GRC): Update your internal security policies and procedures to explicitly account for the new cloud service and its specific risk profile. Map the provider’s security controls and your compensating controls directly to relevant regulatory requirements (eg GDPR, HIPAA, PCI DSS). Maintain meticulous documentation of your risk assessments, mitigation strategies and any formal risk acceptance decisions.

By adopting these strategies, IT and IT security leaders can confidently embrace innovative cloud technologies, minimising inherent risks and ensuring a strong compliance posture, even when faced with SLAs that don’t initially meet every desired criterion.

The bottom line

Make sure to follow the principle “own your security posture” by implementing customised security policies and not relying solely on your cloud provider. Treat security as a core component of your infrastructure and not an add-on.  Adopt and deploy unified controls to align security strategies across all environments to strengthen defences against the expanding threat landscape, thereby reducing risk and boosting resilience. Shared responsibility doesn’t mean shared blame, it means shared diligence.

Aditya K Sood is vice president of security engineering and AI strategy at Aryaka.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

This M5 MacBook Air Discount Has Renewed My Faith in Cheap Laptops for 2026

Published

on

This M5 MacBook Air Discount Has Renewed My Faith in Cheap Laptops for 2026


In a time when almost everything is getting more expensive, this deal on the M5 MacBook Air has me hopeful about how laptop pricing will play out the rest of the year. The M5 MacBook Air has dropped back down to $949, which is $150 off its retail price. It’s only been at this price one other time since the product launched in early March and has more consistently sold for $1,049. As someone who’s reviewed every available MacBook and their strongest competitors, I can unequivocally say that this MacBook Air is one of the very best laptop deals right now.

Apple

MacBook Air (M5, 2026)

Take the Surface Laptop 7th Edition, for example, which has been one of my favorite alternatives to the MacBook Air through all of 2025. It had been at competitive prices with the M4 MacBook Air all along, with both laptops sometimes dropping to as low as $799 during sales events like Prime Day throughout the year. But now, the Surface Laptop has gotten an official price hike due to the RAM shortage and is currently sitting at $1,200. It’s still a laptop I like quite a lot, but at $350 more than a similarly configured M5 MacBook Air, it’s very difficult to recommend.

Or consider the MacBook Neo, Apple’s new budget laptop that also launched in March. While it’s much cheaper overall, it’s only ever been sold for $10 off its full price. At this reduced price for the M5 MacBook Air of $949, that leaves only a dangerously small $260 gap between the Neo and the Air. It’s almost embarrassing how much better the Air is by comparison—in every way imaginable. If you’re curious how these two laptops stack up, I’ve done a comprehensive comparison between them that’s worth checking out. But to put it simply, despite all the excitement (and controversy) around the much cheaper MacBook Neo, the MacBook Air still has the most price flexibility in terms of deals.



Source link

Continue Reading

Tech

A Brain Implant for Depression Is About to Be Tested in Humans

Published

on

A Brain Implant for Depression Is About to Be Tested in Humans


The latest brain-computer interface could help people recover from severe depression. Motif Neurotech announced Monday that the US Food and Drug Administration has approved a human study to trial the company’s blueberry-sized brain implant that sits in the skull and delivers electrical stimulation to treat depression.

The Houston-based startup, founded in 2022, is part of a budding industry pursuing technology to read and interpret brain signals. While other companies exploring similar technology, like Elon Musk’s Neuralink, Paradromics, and Synchron, are developing devices to enable paralyzed people to communicate and use computers, Motif is aiming to ease depression in people who have not benefited from medication.

The company’s device is implanted in the skull just above the dura, the brain’s protective membrane. It targets the central executive network, a part of the brain that is responsible for high-level cognitive functions and is underactive in major depressive disorder. The implant emits specific patterns of stimulation to turn “on” this network.

Motif’s device would allow patients to receive therapeutic brain stimulation at home. “Through frequent electrical stimulation, we think we can drive that neuroplasticity that creates stronger connectivity within the central executive network for patients with depression, so that they can get out of bed in the morning, call their friends, go to the gym,” says Jacob Robinson, Motif’s cofounder and CEO.

Courtesy of Motif

Electrical stimulation has been used for decades to treat depression, and Motif’s approach is just the latest iteration. Electroconvulsive or “shock” therapy began in the 1930s and is still used today in cases where patients don’t benefit from antidepressants. Deep brain stimulation, which involves surgically implanting electrodes into the brain, is occasionally used experimentally but is not FDA approved. A much milder form of stimulation known as transcranial magnetic stimulation, or TMS, was approved in 2008. While it can be highly effective, it typically requires a lengthy treatment regimen of five treatments a week for six weeks.

A study from 2021 found that during a 12-month period in the United States, nearly 9 million adults were undergoing treatment for major depressive disorder, and of those, almost 3 million were considered to have treatment-resistant depression, when symptoms do not improve after at least two, and often more, antidepressant medications.

Motif’s device can be implanted in a 20-minute outpatient procedure without the need for brain surgery. It’s powered by wireless magnetoelectric technology that Robinson developed while at Rice University and is charged with a baseball cap that patients will wear when receiving the stimulation.



Source link

Continue Reading

Tech

The Man Behind AlphaGo Thinks AI Is Taking the Wrong Path

Published

on

The Man Behind AlphaGo Thinks AI Is Taking the Wrong Path


David Silver gave the world its very first glimpse of superintelligence.

In 2016, an AI program he developed at Google DeepMind, AlphaGo, taught itself to play the famously difficult game of Go with a kind of mastery that went far beyond mimicry.

Silver has since founded his own company, Ineffable Intelligence, that aims to build more general forms of AI superintelligence. The company will do this, Silver says, by focusing on reinforcement learning, which involves AI models learning new capabilities through trial and error. The vision is to create “superlearners” that go beyond human intelligence in many domains.

This approach stands in contrast to how most AI companies plan to build superintelligence, by exploiting the coding and research capabilities of large-language models.

Silver, speaking to WIRED from his office in London, says he thinks this approach will fail. As amazing as LLMs are, they learn from human intelligence—rather than building their own.

“Human data is like a kind of fossil fuel that has provided an amazing shortcut,” Silver says. “You can think of systems that learn for themselves as a renewable fuel—something that can just learn and learn and learn forever, without limit,” he says.

I’ve met Silver a few times and—despite this proclamation—he’s always struck me as one of the more humble people in AI. Sometimes, when talking about ideas he considers silly, he flashes a puckish grin. Right now, though, he’s deadly serious.

“I think of our mission as making first contact with superintelligence,” he says. “By superintelligence I really mean something incredible. It should discover new forms of science or technology or government or economics for itself.”

Five years ago, such a mission might have seemed ridiculous. But tech CEOs now routinely talk about machines outpacing human intelligence and replacing entire categories of workers. The idea that some new technical twist might unlock superhuman AI capabilities has recently spawned a raft of billion-dollar startups.

Ineffable Intelligence has so far raised $1.1 billion in seed funding at a valuation of $5.1 billion—an enormous sum by European AI standards. Silver has also recruited top AI researchers from Google DeepMind and other frontier labs to join his endeavor.

Silver says he will give all of the money he makes from equity in Effable Intelligence—a sum that could amount to billions if he is successful—away to charity.

“It’s a huge responsibility to build a company focusing on superintelligence,” he tells me. “I think this is something that has to be done for the benefit of humanity, and any money that I make from Ineffable will will go to high-impact charities that save as many lives as possible.”

Total Focus

Silver met Demis Hassabis, the CEO of Google DeepMind, at a chess tournament when they were kids, and the pair later became lifelong friends and collaborators.

They remained close after Silver left Google DeepMind, which he did only because he wanted to chart a completely new path. “I feel it’s really important that there is an elite AI lab that actually focuses a hundred percent on this approach,” he says. “That it’s not just a corner of another place dedicated to LLMs.”

The limits of the LLM-based approach can be seen, Silver says, with a simple thought experiment. Imagine going back in time and releasing a large language model in a world that believed the world was flat. Without being able to interact with the real world, the system, he says, would remain an avid flat-earther, even if it continued to improve its own code.

An AI system that can learn about the world for itself, however, could make its own scientific discoveries.



Source link

Continue Reading

Trending