Build the cloud shared-responsibility table as a lookup, then answer four "who is responsible?" questions and list everything the consumer owns under IaaS.

Answer

OWNER = { 'application and data': {'SaaS': 'provider', 'PaaS': 'consumer', 'IaaS': 'consumer'}, 'runtime and middleware': {'SaaS': 'provider', 'PaaS': 'provider', 'IaaS': 'consumer'}, 'guest OS patching': {'SaaS': 'provider', 'PaaS': 'provider', 'IaaS': 'consumer'}, 'virtual network controls': {'SaaS': 'provider', 'PaaS': 'provider', 'IaaS': 'provider'}, 'physical security': {'SaaS': 'provider', 'PaaS': 'provider', 'IaaS': 'provider'}, } def responsible(component, model): return OWNER[component][model] queries = [ ('guest OS patching', 'IaaS'), ('guest OS patching', 'PaaS'), ('application and data', 'SaaS'), ('physical security', 'IaaS'), ] for component, model in queries: print(model + ' / ' + component + ' -> ' + responsible(component, model)) consumer_load = sorted(c for c in OWNER if OWNER[c]['IaaS'] == 'consumer') print('IaaS consumer owns: ' + ', '.join(consumer_load))

Stallings & Brown 5e ch13 §13.1–13.3; NIST SP 800-145 *The NIST Definition of Cloud Computing*, SP 500-292 *Cloud Computing Reference Architecture*, SP 800-144 *Guidelines on Security and Privacy in Public Cloud Computing* (EXT); Cloud Security Alliance threat and SecaaS listings (EXT)