CSP (cloud service provider)
A cloud service provider is the company that supplies computing resources as a service, from raw infrastructure to fully managed applications. Where its responsibility ends and yours begins is the first question of any cloud project.
A CSP, or cloud service provider, is an organisation that supplies computing services and resources over the network, allowing other organisations to run infrastructure and applications without owning the hardware underneath.
Providers are central to how software gets built and run now: cloud storage, virtual servers, managed databases, development platforms and a great deal more.
That model also brings security questions that do not exist in a data centre you own, and they need answering explicitly rather than by assumption.
What characterises a provider
Shared infrastructure. Providers offer pooled computing resources, so many customers use the same underlying servers, storage and network. Isolating those tenants from each other is the provider’s core security job.
A shared responsibility model. There is a division of duties between provider and customer. The provider secures the underlying infrastructure; the customer is responsible for securing their own applications, data and configuration inside it.
Elasticity. Resources scale up and down quickly, which is the operational reason organisations move in the first place, and also the reason the estate changes faster than any inventory kept by hand.
The security questions that follow
Data. Sensitive information sits in a shared environment, so encryption and access control stop being good practice and become the mechanism that separates you from everybody else.
Identity and access. Managing who can reach what is the single biggest control in cloud. Providers supply the tooling; deciding what the policy should be is not something they can do for you.
Compliance. Regulatory obligations vary by sector and by jurisdiction. The provider certifies its own platform, and the customer still has to demonstrate that what they built on top of it complies.
A worked example
A company moves its IT estate to the cloud for the flexibility and the ability to scale.
It chooses a large provider and uses it to host its applications and store critical data.
The provider supplies the physical and virtual infrastructure underneath, and is responsible for the availability and security of the servers and the storage.
It also supplies integrated security tooling: identity and access management for permissions, key management for encryption keys.
The customer is responsible for making sure the applications it develops and the data it stores are configured securely: security policy, encryption of sensitive data, and access permissions that reflect what people actually need.
The provider and the split: where its responsibility ends
This entry describes what a cloud service provider is. The question that comes immediately afterwards, and that opens every cloud project, is answered by the shared responsibility model.
The line moves with the type of service, which is why there is no single answer. With raw infrastructure the customer owns nearly everything above the hypervisor, operating system included. With a managed platform or a managed database the provider takes on more. With a fully managed application the customer is left with access, data and configuration.
The recurring mistake is reading managed as protected. The provider’s half is usually well run, and what is exploitable almost always lives in the customer’s configuration, which is precisely the half the model assigns to them.
And the split is not only an idea: it decides the scope of an audit. What belongs to the provider is not touched, and agreeing that before starting avoids a report full of findings the customer cannot act on.
In one sentence: the provider secures the cloud and the customer secures what they put in it.