When a company moves to the cloud, there are many parties responsible for security. Even with contracts, it may not always be clear where the boundaries of responsibility between the companies, the users, the cloud providers, and third-party security vendors lie. Security professionals I spoke to at both the Black Hat USA 2016 conference and Security BSides Las Vegas noted they’ve had clients who were surprised to discover a certain security service was not offered by their cloud provider, even though it was written out in the contract.

“You want to be clear on who is in charge of what when it comes to delivering your security needs in the cloud infrastructure especially when they’re delivered by a third party vendor,” said Keren Elazari (@k3r3n3), an independent security consultant, researcher with Tel Aviv University, and founder of Security BSides Tel Aviv.

The confusion really comes into play when an organization hires a third party vendor to work with the cloud provider.

Ultimately, Elazari said you simply have to ask, “Who configures what?”

For example, a web application firewall is delivered on the cloud and usually by the cloud as well. “You want to be clear that you can use those web application firewall services in the cloud and that the provider that is giving you the infrastructure for the cloud is going to play nicely with your security provider,” said Elazari.