Offsetting cloud security risk requires provider, customer cooperation