InInfrastructure as a Service (IaaS), the customer has themost control and security responsibilitybecause:
* The provider only secures physical infrastructure (data centers, networking, hardware).
* Customers must configure and manage firewalls, network security, operating system patches, and IAM.
* Data security, encryption, and application security are entirely the customer's responsibility.
In contrast:
* PaaS (Platform as a Service)places some security responsibility on the provider (e.g., runtime environments, managed databases).
* SaaS (Software as a Service)places most security responsibility on the provider, with customers mainly managingidentity and access controls.
This is extensively discussed in:
* CCSK v5 - Security Guidance v4.0, Domain 1 (Cloud Computing Concepts and Architectures)
* Cloud Controls Matrix (CCM) - Infrastructure and Application Security Controls.