Pitfalls, exit costs and official sources
Shared responsibility in the cloud: who secures what, and the Cyber Centre's cloud guidance
How the shared responsibility model splits security duties between you and your host for shared, VPS, IaaS and managed cloud, what it costs, and what the Cyber Centre advises.
In every hosting model, security is shared: the provider secures what it controls (data centres, hardware, the virtualisation layer and, depending on the service, more), and you secure everything you control (accounts and passwords, your data, your applications and, on a VPS or cloud VM, the operating system and firewall). The more of the stack you rent as raw infrastructure, the larger your share. The Canadian Centre for Cyber Security describes the same split in its cloud guidance and recommends that organisations understand the controls on both sides. Many costly incidents and surprise bills start where each side assumed the other was responsible.
This guide is part of the pitfalls overview. It covers the cost and contract side of security for hosting; it is not a security service guide.
Who does what, by hosting type
| Layer | Shared hosting | VPS / IaaS VM | Managed database or platform | Managed cloud (MSP) |
|---|---|---|---|---|
| Physical data centre, hardware | Provider | Provider | Provider | Provider (via cloud) |
| Virtualisation | Provider | Provider | Provider | Provider (via cloud) |
| Operating system patching | Provider | You | Provider | MSP, per contract |
| Network firewall rules | Mostly provider | You | Shared | MSP, per contract |
| Application and plugins | You | You | You | Often you; check |
| Accounts, passwords, MFA | You | You | You | You and MSP |
| Data and backups | Shared; check plan | You | Shared; check retention | MSP, per contract |
| Monitoring and response | Provider for platform | You | Shared | MSP, per contract |
The Cyber Centre's Cloud security risk management (ITSM.50.062) shows the consumer's share growing from SaaS to PaaS to IaaS, and recommends a risk-management process that includes assessing the provider's controls, often through independent third-party assurance reports rather than self-assessments, and checking that a report's scope covers the services and regions you use.
The cost of your share
Your share of security is a real cost that belongs in the hosting estimate:
| Task | Illustrative monthly effort or cost |
|---|---|
| OS and software patching, two servers | 2 hours |
| Reviewing firewall rules and access | 1 hour |
| Checking backups and a quarterly restore test | 1 hour (averaged) |
| Multi-factor authentication for all admin accounts | Usually included with the platform |
| Monitoring and alerting tools | $0–$50 |
| Example at $55 an hour, with $30 of tools | 4 × $55 + $30 = $250 a month |
If that work is not done, the cost does not disappear; it turns into risk. Compare it with a managed option in managed cloud vs self-managed.
Security failures that become billing failures
Two cost patterns are directly caused by gaps on the customer side:
- Compromised credentials: an attacker with access to your cloud account can start expensive resources (for example for cryptocurrency mining), and you are generally liable for the usage. Multi-factor authentication on every account, no long-lived access keys in code, and budget alerts are the main controls.
- Public storage buckets or open databases: data exposure can trigger privacy obligations, and unexpected public downloads can create egress charges.
See surprise cloud bill patterns.
What the Cyber Centre publishes
- Baseline cyber security controls for small and medium organizations: a short set of controls (including backups, patching, multi-factor authentication and secure configuration) aimed at organisations with fewer than 500 employees.
- Cloud security risk management (ITSM.50.062): the risk-management approach for cloud services, including the shared responsibility split and the use of third-party assurance.
- Cloud service provider information technology security assessment process (ITSM.50.100): the process the Cyber Centre uses to assess cloud providers for Government of Canada use at the Protected B, medium integrity and medium availability level. It is designed for federal departments; a provider having been assessed does not mean your configuration is secure, but you may ask providers whether they participate.
These publications are free on cyber.gc.ca.
Privacy angle
Under PIPEDA, organisations must protect personal information with safeguards appropriate to its sensitivity, and remain responsible for information sent to processors (Principle 4.1.3). A provider's security does not cover your misconfiguration. If a breach of security safeguards involving personal information creates a real risk of significant harm, PIPEDA requires reporting to the Privacy Commissioner and notifying affected individuals; Quebec and Alberta have their own regimes. Plan who does what in your contract before an incident.
Contract clauses that make the split explicit
- A written responsibility matrix (like the table above) attached to the contract
- Provider's notice of security incidents affecting your data, and the timeline
- Your right to receive assurance reports or certifications relevant to the services you use
- Who performs restores, and at what cost
- Access to logs when you need to investigate
See SLAs, service credits and contract terms.
FAQ
Is my data automatically backed up in the cloud?
Not necessarily. Many services store data durably but do not keep point-in-time backups unless you configure them. Deleting or encrypting data by mistake or through an attack can remove it from the live copy. Configure backups and test restores.
Does a Canadian region make my data more secure?
Location and security are different questions. A Canadian region can help with privacy and contractual requirements; security depends on configuration, access control and the provider's controls.
Do I need a security professional for a small website?
For a simple site on managed hosting, following the host's guidance and the Cyber Centre's baseline controls is a reasonable start. For applications with personal or payment data, an independent review is worth considering.
Sources
- Canadian Centre for Cyber Security — ITSM.50.062 Cloud security risk management; ITSM.50.100 CSP assessment process; baseline controls
- Office of the Privacy Commissioner of Canada — safeguards and breach reporting under PIPEDA
- Justice Laws Website — PIPEDA, Schedule 1
- Commission d'accès à l'information du Québec — confidentiality incidents under Law 25
