When using a SaaS solution, who is responsible for application security?

The correct answer is A. The cloud service provider only. In the SaaS model, the cloud service provider owns, operates, and maintains the entire stack - infrastructure, platform, middleware, and the application itself. The consumer accesses the application through a browser or API but has no ability to modify, patch, or configure the…

Cloud Auditing for Infrastructure, Platform, and Software as a Service (IaaS, PaaS, SaaS)

Question

Options

AThe cloud service provider only
BThe cloud service consumer only
CBoth cloud consumer and the enterprise
DBoth cloud provider and the consumer

How the community answered

(25 responses)

A
96% (24)
B
4% (1)

Explanation

In the SaaS model, the cloud service provider owns, operates, and maintains the entire stack - infrastructure, platform, middleware, and the application itself. The consumer accesses the application through a browser or API but has no ability to modify, patch, or configure the application code or security controls. Therefore, application security is entirely the CSP's responsibility. This contrasts with IaaS (where the customer manages the OS and everything above) and PaaS (where the customer manages the application layer). The consumer's responsibilities in SaaS are limited to data they input, user access management within the application, and client-side configurations - not application security itself.

Topics

#SaaS security#Shared Responsibility Model#Cloud service provider responsibilities#Application security

Community Discussion

No community discussion yet for this question.

Full CCAK Practice