Objective 3.1: Compare and contrast security implications of different architecture models
Security+ SY0-701 practice question
A company is replacing its on-premises CRM with a software as a service (SaaS) CRM. While building the responsibility matrix, the security manager must identify which tasks stay with the company rather than moving to the provider. Which of the following remains the company's responsibility?
- Patching the CRM application code
In SaaS, the provider develops, runs, and patches the application itself. The customer cannot patch the provider's code.
- Managing which employees have accounts and what data they can access(Correct)
Correct. Deciding who gets an account, what roles and permissions they have, and removing access when people leave remain the customer's responsibility in every cloud model, including SaaS.
- Hardening the operating systems of the servers that host the CRM
The operating systems under a SaaS application belong to the provider's platform. The customer has no access to them; in IaaS this would be a customer task, but not in SaaS.
- Securing physical access to the provider's data centers
Physical security of the data centers is always the provider's responsibility in public cloud services, whatever the service model.
Explanation
In the shared responsibility model, the provider's share grows as you move from IaaS to PaaS to SaaS. With SaaS, the provider runs the application, the platform, and the infrastructure. The customer always keeps responsibility for its own data, its users, and how access is granted, which is why identity and access management stays on the customer's side of the matrix.