@isc2clack wrote:I was looking for general views on which of the major cloud vendors people feel have the more robust, consistent security model?
This is a massively open-ended question and can vary greatly depending on the type of cloud service you need/use. I don't think security lies in the macro details of either one but how well you, as the consumer, understand the fine details of what the service provider will do and what's your responsibility. That will vary within each vendor depending on service level and type. With the cloud, you replace system admins with "service analysts" (or some such thing) who know the SLAs and SOC reports inside and out and address the gaps. You also need to really focus on your users and ensure they understand data classification, permissions, and good authentication practices.
The analogy I use is the cloud is a glass apartment building. Depending on your wants and your service provider's capabilities, it may be completely furnished or empty, it may have a cleaning service or no maintenance at all, maybe there is a doorman or maybe there is none at all. But above everything else, you gotta remind your users not to walk around in their underwear.
