In cloud computing, the customer is always responsible for security 'of' the cloud, while the provider handles security 'in' the cloud.

The shared responsibility model states: Cloud provider is responsible for security 'OF' the cloud (infrastructure, hardware, physical security). Customer is responsible for security 'IN' the cloud (data, applications, access management, OS patching in IaaS). Responsibilities vary by service model (IaaS/PaaS/SaaS).