Shared Responsibility Managed Server

This English version is provided for convenience only. The German version is legally binding; in the event of any discrepancy between the two versions, the German version shall prevail.

1. Introduction

The Shared Responsibility Model (SRM) describes the allocation of responsibilities between centron GmbH, Heganger 29, 96103 Hallstadt, Germany (the “Provider”) and the Customer when using Managed Server Services.

With Managed Servers, the Provider assumes an extended share of operation and maintenance compared with conventional Infrastructure-as-a-Service offerings. Nevertheless, material responsibilities remain with the Customer, in particular with regard to applications, data and access control.

The Provider provides a managed server environment and takes over defined operating and maintenance tasks. The Customer is responsible for the use of the systems, the applications operated on them and the protection of its data.

2. Basic principle

The Provider is responsible for the security of the infrastructure and of the managed system level, in particular:

• physical data centres and hardware
• hardware and virtualisation layer
• basic installation of the operating system
• maintenance, updates and patching of the system (to the agreed extent)
• basic network security
• operation and availability of the server environment

The Customer is responsible for the security of the use of the system, in particular:

• applications and services
• data and content
• user management and access controls
• individual system configurations outside the Managed Scope

This model follows the principle that the Provider supports the operation of the system, while the Customer is responsible for the use and protection of its workloads.

3. Data security

The Customer is responsible for the security of the data that it stores or processes on the Managed Server.

In particular, the following is recommended:

• protecting the access credentials for the centron account and for the systems
• using separate user accounts
• restricting access to data
• encrypting data appropriately

The Provider makes the platform and security mechanisms available but assumes no responsibility for the content in the instances or for its protection.

4. User and access control

The Customer is fully responsible for the management of user accounts and access rights within the systems provided.

This includes in particular:

• creation and management of user accounts
• granting and restricting access rights
• management of administrative access

Improper assignment of rights may lead to unauthorised access and falls within the Customer’s area of responsibility.

5. Network security and access

The Provider provides basic network mechanisms that contribute to securing the server environment.

The Customer is responsible for:

• restricting access to trusted sources
• configuring firewall rules (where managed by the Customer)
• securing open ports and services
• secure connection of applications

Control over which systems may access the Managed Server falls within the Customer’s area of responsibility.

6. Encryption

The Provider provides basic security mechanisms, in particular in the area of the infrastructure and system communication.

The Customer is responsible for:

• use of secure protocols (e.g. HTTPS, SSH with key)
• secure management of access credentials
• additional encryption at application level, where applicable

The encryption of sensitive data within applications lies entirely within the Customer’s responsibility.

7. Operation, maintenance and updates

Within the scope of the managed services, the Provider takes over:

• installation and operation of the operating system
• carrying out security updates and patching of the operating system
• monitoring of the system state (to the agreed extent)
• basic system maintenance

The Customer is responsible for:

• installation, configuration and operation of applications
• maintenance of application software
• adjustment of system settings outside the Managed Scope

Managed Servers relieve the Customer of basic operating tasks but do not replace its responsibility for applications and their security.

8. Backup and recovery

The Provider may make data backup functions available, provided this forms part of the agreed service.

The Customer is responsible for:

• use and configuration of backup functions
• reviewing backup strategies
• ensuring that data can be restored

The Provider makes the technical capabilities available, while the Customer must ensure that they are used correctly.

9. Monitoring and logging

The Provider carries out basic monitoring of the infrastructure and system availability but does not assume full responsibility for logging and monitoring within the systems.

The Customer is responsible for:

• monitoring of applications
• analysing logs
• setting up alerting
• detecting security incidents

Monitoring of the application level lies entirely within the Customer’s area of responsibility.

10. High availability and scaling

The Provider provides the technical basis for operating the servers.

The Customer is responsible for:

• design of highly available architectures
• use of redundancy mechanisms
• scaling of applications
• implementation of failover strategies

Managed Servers do not offer automatic high availability unless this has been expressly agreed.

11. Compliance and regulatory requirements

The Provider operates the infrastructure in accordance with common security and compliance standards.

The Customer is responsible for:

• compliance with statutory requirements
• use in compliance with data protection law
• classification and protection of the data

The use of a secure infrastructure supports compliance requirements but does not replace the Customer’s obligations.

12. Summary of responsibilities

The Provider provides a managed server environment and takes over defined tasks in the areas of operation, maintenance and infrastructure.

The Customer is responsible for the secure use of this environment, in particular for:

• configuration and operation
• access controls
• data and secrets
• applications

Security in the cloud is therefore a shared responsibility in which both parties must fulfil clearly defined tasks.