Tech
SLA promises, security realities: Navigating the shared responsibility gap | Computer Weekly

The shared responsibility model (SRM) plays a central role in defining how security and operational duties are split between cloud providers and their customers. However, when this model intersects with service level agreements (SLAs), it introduces layers of complexity.
SLAs typically cover metrics like uptime, support response times and service performance, but often overlook critical elements such as data protection, breach response and regulatory compliance. This creates a responsibility gap, where assumptions about who is accountable can lead to serious blind spots. For instance, a customer might assume that the cloud provider’s SLA guarantees data protection, only to realise that their own misconfigurations or weak identity management practices have led to a data breach.
Organisations may mistakenly believe their provider handles more than it does, increasing the risk of non-compliance, security incidents and operational disruptions. Understanding the nuances between SLA commitments and shared security responsibilities is vital to safely leveraging cloud services without undermining resilience or regulatory obligations.
The reality of the SRM and SLAs
The SRM fundamentally shapes the scope and impact of SLAs in cloud environments. Let’s quickly understand the reality of cloud providers’ SRM.
- Cloud providers secure the infrastructure they manage; you ensure what you deploy.
- Customers are responsible for data, configurations, identities and applications.
- Cloud providers often cite the model to deflect blame during breaches.
- Customers must secure the stack themselves, as cloud doesn’t equal safe-by-default -visibility, policy and controls are still on you.
While an SLA guarantees the cloud provider’s commitment to “the security of the cloud”, ensuring the underlying infrastructure’s uptime, resilience and core security, it explicitly does not cover the customer’s responsibilities for “security in the cloud.” This means that even if a provider’s SLA promises 99.99% uptime for their infrastructure, a customer’s misconfigurations, weak identity management or unpatched applications (all part of their responsibility) can still lead to data breaches or service outages, effectively nullifying the perceived security and uptime benefits of the provider’s SLA. Therefore, the SRM directly impacts the adequate security and availability experienced by the enterprise, making diligent customer-side security practices crucial for realising the full value of any cloud SLA.
Several controls should be a part of a comprehensive approach to gaining access to innovative cloud technology while safeguarding your enterprise:
- Due diligence, gap analysis and risk quantification: Conduct an exhaustive review of the cloud provider’s security posture beyond just the SLA. Request and scrutinise security whitepapers, independent audit reports (eg FedRAMP, SOC 2 Type 2, ISO 27001) and penetration test summaries. Perform a detailed risk assessment that quantifies the potential impact of any SLA shortfalls on your business operations, data privacy and regulatory obligations. Understand precisely where the provider’s “security of the cloud” ends and your “security in the cloud” responsibilities begin, especially concerning data encryption, access controls and incident response.
- Strategic contract negotiation and custom clauses: Engage in direct negotiation with the cloud provider to tailor the SLA to your infrastructure requirements. For significant contracts, cloud providers should be willing to include custom clauses addressing critical security commitments, data handling procedures, incident notification timelines and audit rights that exceed their standard offerings. Ensure the contract includes indemnification clauses for data breaches or service disruptions directly attributable to the provider’s security failures, and clearly define data portability and destruction protocols for an effective exit strategy.
- Implement robust layered security (defence-in-depth): Recognise that the shared responsibility model necessitates your active participation. In addition to the provider’s native offerings, implement additional security controls covering, among others, identity and access management (IAM), cloud security posture management (CSPM), cloud workload protection (CWP), data loss prevention (DLP) and zero trust network access (ZTNA).
- Enhanced security monitoring and integration: Integrate the cloud service’s logs and security telemetry into your enterprise’s security information and event management (SIEM) and security orchestration, automation and response (SOAR) platforms. This centralised visibility and correlation capability allows your security operations centre (SOC) to detect, analyse and respond to threats across both your on-premises and cloud environments, bridging any potential gaps left by the provider’s default monitoring.
- Proactive governance, risk and compliance (GRC): Update your internal security policies and procedures to explicitly account for the new cloud service and its specific risk profile. Map the provider’s security controls and your compensating controls directly to relevant regulatory requirements (eg GDPR, HIPAA, PCI DSS). Maintain meticulous documentation of your risk assessments, mitigation strategies and any formal risk acceptance decisions.
By adopting these strategies, IT and IT security leaders can confidently embrace innovative cloud technologies, minimising inherent risks and ensuring a strong compliance posture, even when faced with SLAs that don’t initially meet every desired criterion.
The bottom line
Make sure to follow the principle “own your security posture” by implementing customised security policies and not relying solely on your cloud provider. Treat security as a core component of your infrastructure and not an add-on. Adopt and deploy unified controls to align security strategies across all environments to strengthen defences against the expanding threat landscape, thereby reducing risk and boosting resilience. Shared responsibility doesn’t mean shared blame, it means shared diligence.
Aditya K Sood is vice president of security engineering and AI strategy at Aryaka.
Tech
These are the Password Managers You Should Use Instead of Your Browser

Setting up and migrating to Dashlane from another password manager is simple, and you’ll use a secret key to encrypt your passwords, much like BitWarden’s setup process. In practice, Dashlane is very similar to the others on this list. Dashlane offers a 30-day free trial, so you can test it out before committing.
After signing up, download the app for Android and iOS, and grab the browser extensions for Firefox, Chrome, and Edge.
Best for Bundled Services
You might know Nord better for its VPN service, but the company also offers a password manager, NordPass, and a pretty nice online storage system, NordLocker. A part of the appeal of NordPass comes in bundling it with the company’s other services for some compelling deals. As a password manager, NordPass offers everything you need. It uses a zero-knowledge setup in which all data is encrypted on your device before it’s uploaded to the company’s servers. Unlike most services here, NordPass uses XChaCha20 for encryption. It would require a deep dive into cryptography to get into the differences, but the short story is that it’s just as secure and maybe slightly faster than the AES-256 encryption used by other services.
There’s a personal information storage feature to keep your address, phone number, and other personal data safe and secure, but easy to access. NordPass also offers an emergency access feature, which allows you to grant another NordPass user emergency access to your vault. It works just like the same feature in 1Password, allowing trusted friends or family to access your account if you cannot.
Other nice features include support for two-factor authentication to sign in to your account, as well as security tools to evaluate the strength of your passwords and alert you if any of your data is compromised. Note that NordPass Premium is theoretically $3 a month, but there are always sales that bring that much lower.
The downside, and my one gripe about all Nord services, is that there is no monthly plan. As noted above, the best deal comes in combining NordPass, NordVPN, and NordLocker for a bundled deal. A free version of NordPass is available, but it’s restricted to only a single device.
After signing up, download the app for Android and iOS, and grab the browser extensions for Firefox, Chrome, and Edge.
Best DIY Options (Self-Hosted)
Want to retain more control over your data in the cloud? Sync your password vault yourself. The services below do not store any of your data on their servers. This means attackers have nothing to target. Instead of storing your passwords, these services use a local vault to store your data, and then you can sync that vault using a file-syncing service like Dropbox, NextCloud, or Edward Snowden’s recommended service, SpiderOak. There are two services to keep track of in this scenario, making it a little more complex. But if you’re already using a file-syncing file service, this can be a good option.
You can also properly host your own vault with network-attached storage or a local server.
Enpass does not store any data on its servers. Syncing is handled through third-party services. Enpass doesn’t do the syncing, but it does offer apps on every platform. That means once you have syncing set up, it works just like any other service. And you don’t have to worry about Enpass being hacked, because your data isn’t on its servers. Enpass supports syncing through Dropbox, Google Drive, OneDrive, iCloud, Box, Nextcloud, or any service using WebDAV. Alas, SpiderOak is not currently supported. You can also synchronize your data over a local WLAN or Wi-Fi network.
All of the features you expect in a password manager are here, including auto-generating passwords, breach-monitoring, biometric login (for devices that support it), auto-filling passwords, and options to store other types of data, like credit cards and identification data. There’s also a password audit feature to highlight any weak or duplicate passwords in your vault. One extra I particularly like is the ability to tag passwords for easier searching. Enpass also makes setting up the syncing through the service of your choice very easy. Enpass added support for passkeys, too.
Tech
‘People Are So Proud of This’: How River and Lake Water Is Cooling Buildings

“In the old days, it was more like a luxury project,” says Deo de Klerk, team lead for heating and cooling solutions at the Dutch energy firm Eneco. Today, his company’s clients increasingly ask for district cooling as well as district heating systems. Eneco has 33 heating and cooling projects under construction. In Rotterdam, Netherlands, one of the company’s installations helps to cool buildings, including apartment blocks, police offices, a theater and restaurants, using water from the River Meuse.
It’s not hard to see why cooling technologies are getting more popular. A few years ago, Nayral moved out of Paris. She remembers the heat waves. “My routine during the weekend was to go to the parks,” she says. Nayral would sit there well into the evening—reading Les Misérables, no less—waiting for her apartment to cool down. Recently, she has increasingly found herself spending time in shopping malls, where air-conditioning is plentiful, in order to make it through searing hot French summers. This year, unprecedented heat waves hit France and other countries in Europe.
The city of Paris is now desperate to help its denizens find cool refuges during spells of extreme heat. A key component of Parisian climate adaptation plans is the river-supplied cooling network, the pipes for which currently cover a distance of 100 kilometers, though this is due to expand to 245 km by 2042. While around 800 buildings are served by the network today, those in charge aim to supply 3,000 buildings by that future date.
Systems such as Paris’ do not pump river water around properties. Rather, a loop of pipework brings river water into facilities where it soaks up warmth from a separate, closed loop of water that connects to buildings. That heat transfer is possible thanks to devices called heat exchangers. When cooled water in the separate loop later arrives at buildings, more heat exchangers allow it to cool down fluid in pipes that feed air-conditioning devices in individual rooms. Essentially, heat from, say, a packed conference room or tourist-filled art gallery is gradually transferred—pipe by pipe—to a river or lake.
The efficiency of Paris’ system varies throughout the year, but even at the height of summer, when the Seine is warm, the coefficient of performance (COP)—how many kilowatt-hours of cooling energy you get for every kilowatt-hour of electricity consumed by the system—does not dip much below 4. In the winter, when offices, museums, and hospitals still require some air-conditioning, the COP can be as high as 15, much higher than conventional air-conditioning systems. “It is absolutely magnificent,” boasts Nayral.
But those summer temperatures are increasingly a concern. This summer, the Seine briefly exceeded 27 degrees Celsius (81 degrees Fahrenheit), says Nayral. How can that cool anything? The answer is chiller devices, which help to provide additional cooling for the water that circulates around buildings. Instead of blowing out hot air, those devices can expel their heat into the Seine via the river loop. The opportunity to keep doing this is narrowing, though—because Fraîcheur de Paris is not allowed to return water to the Seine at temperatures above 30 degrees Celsius, for environmental reasons. At present, that means the river can accommodate only a few additional degrees of heat on the hottest days. Future, stronger heat waves could evaporate more of that overhead.
Tech
Europe’s fastest supercomputer to boost AI drive

Europe’s fastest supercomputer Jupiter is set to be inaugurated Friday in Germany with its operators hoping it can help the continent in everything from climate research to catching up in the artificial intelligence race.
Here is all you need to know about the system, which boasts the power of around one million smartphones.
What is the Jupiter supercomputer?
Based at Juelich Supercomputing Center in western Germany, it is Europe’s first “exascale” supercomputer—meaning it will be able to perform at least one quintillion (or one billion billion) calculations per second.
The United States already has three such computers, all operated by the Department of Energy.
Jupiter is housed in a center covering some 3,600 meters (38,000 square feet)—about half the size of a football pitch—containing racks of processors, and packed with about 24,000 Nvidia chips, which are favored by the AI industry.
Half the 500 million euros ($580 million) to develop and run the system over the next few years comes from the European Union and the rest from Germany.
Its vast computing power can be accessed by researchers across numerous fields as well as companies for purposes such as training AI models.
“Jupiter is a leap forward in the performance of computing in Europe,” Thomas Lippert, head of the Juelich center, told AFP, adding that it was 20 times more powerful than any other computer in Germany.
How can it help Europe in the AI race?
Lippert said Jupiter is the first supercomputer that could be considered internationally competitive for training AI models in Europe, which has lagged behind the US and China in the sector.
According to a Stanford University report released earlier this year, US-based institutions produced 40 “notable” AI models—meaning those regarded as particularly influential—in 2024, compared to 15 for China and just three for Europe.
“It is the biggest artificial intelligence machine in Europe,” Emmanuel Le Roux, head of advanced computing at Eviden, a subsidiary of French tech giant Atos, told AFP.
A consortium consisting of Eviden and German group ParTec built Jupiter.
Jose Maria Cela, senior researcher at the Barcelona Supercomputing Center, said the new system was “very significant” for efforts to train AI models in Europe.
“The larger the computer, the better the model that you develop with artificial intelligence,” he told AFP.
Large language models (LLMs) are trained on vast amounts of text and used in generative AI chatbots such as OpenAI’s ChatGPT and Google’s Gemini.
Nevertheless with Jupiter packed full of Nvidia chips, it is still heavily reliant on US tech.
The dominance of the US tech sector has become a source of growing concern as US-Europe relations have soured.
What else can the computer be used for?
Jupiter has a wide range of other potential uses beyond training AI models.
Researchers want to use it to create more detailed, long-term climate forecasts that they hope can more accurately predict the likelihood of extreme weather events such as heat waves.
Le Roux said that current models can simulate climate change over the next decade.
“With Jupiter, scientists believe they will be able to forecast up to at least 30 years, and in some models, perhaps even up to 100 years,” he added.
Others hope to simulate processes in the brain more realistically, research that could be useful in areas such as developing drugs to combat diseases like Alzheimer’s.
It can also be used for research related to the energy transition, for instance by simulating air flows around wind turbines to optimize their design.
Does Jupiter consume a lot of energy?
Yes, Jupiter will require on average around 11 megawatts of power, according to estimates—equivalent to the energy used to power thousands of homes or a small industrial plant.
But its operators insist that Jupiter is the most energy-efficient among the fastest computer systems in the world.
It uses the latest, most energy-efficient hardware, has water-cooling systems and the waste heat that it generates will be used to heat nearby buildings, according to the Juelich center.
© 2025 AFP
Citation:
Europe’s fastest supercomputer to boost AI drive (2025, September 5)
retrieved 5 September 2025
from https://techxplore.com/news/2025-09-europe-fastest-supercomputer-boost-ai.html
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no
part may be reproduced without the written permission. The content is provided for information purposes only.
-
Tech1 week ago
Top CDC Officials Resign After Director Is Pushed Out
-
Sports1 week ago
Dolphins GM Chris Grier says fans threatened his family in string of vile emails after team’s lackluster year
-
Entertainment1 week ago
YouTube TV viewers could lose access to Fox channels over contract dispute
-
Tech1 week ago
Real-time technique directly images material failure in 3D to improve nuclear reactor safety and longevity
-
Tech1 week ago
Manufacturas Eliot boosts digital shift with Coats Digital’s VisionPLM
-
Tech7 days ago
SSA Whistleblower’s Resignation Email Mysteriously Disappeared From Inboxes
-
Sports1 week ago
Graziano: Don’t be surprised if these 32 things happen, from an MVP run to rookies who could star
-
Entertainment7 days ago
Sabrina Carpenter gives insight into her new music and viral debate over album cover