Cloud computing is a way of delivering computing resources, such as servers, storage, databases and software, over a network on demand, so you pay for what you use instead of buying and running everything yourself. The CCSP exam builds on two definitions: NIST SP 800-145 and ISO/IEC 17788. You need their vocabulary, because many questions hinge on whether a situation really is cloud computing and who is responsible for what.
NIST lists five essential characteristics. On-demand self-service means a customer can provision resources without a human at the provider approving each request. Broad network access means services are reachable over standard networks from many kinds of device. Resource pooling means the provider serves many customers from shared physical resources, and the customer usually does not know exactly where their workload runs. Rapid elasticity means capacity can grow and shrink quickly, often automatically. Measured service means usage is metered, which enables pay-per-use billing and gives both sides data for chargeback and capacity planning. ISO/IEC 17788 adds multitenancy as a sixth key characteristic: several customers share the same infrastructure while being kept isolated from each other.
Roles matter because responsibility follows them. The cloud service customer (CSC) uses the service and remains accountable for its own data. The cloud service provider (CSP) makes the service available. A cloud service partner supports either side; examples are a cloud auditor who independently assesses controls and a cloud service broker who negotiates, aggregates or integrates services from several providers on the customer's behalf. Regulators set the legal and industry requirements that both customer and provider must meet, and they can request evidence.
Security consequences flow straight from the characteristics. Resource pooling and multitenancy create the risk that one tenant affects another, so isolation is a core provider duty. Self-service and elasticity make it easy to create resources nobody tracks, so governance and tagging become the customer's job. Measured service gives you data that can reveal abuse, such as a sudden cost spike from a hijacked account mining cryptocurrency.
Key terms
- Resource pooling
- The provider serves many customers from shared physical resources that are dynamically assigned, with location largely hidden from the customer.
- Rapid elasticity
- The ability to scale capacity up or down quickly, often automatically, so it appears unlimited to the customer.
- Cloud service broker
- A partner that negotiates, integrates or aggregates cloud services from one or more providers on behalf of a customer.
- Multitenancy
- Several customers (tenants) sharing the same infrastructure while their data and workloads are kept logically separated.
A retailer's developers spin up dozens of virtual machines in minutes for a holiday sale and remove them afterwards. The monthly bill shows exactly how many compute hours were used. Those are on-demand self-service, rapid elasticity and measured service at work, and the security team adds tagging rules so every short-lived resource still has an owner.
Check yourself
Which characteristic makes pay-per-use billing possible?
Measured service, because the provider meters resource usage.
Who remains accountable for data when a company moves it into a public cloud?
The cloud service customer; the provider operates controls, but accountability for the data stays with the customer.
What does a cloud auditor do?
It is a partner that independently assesses and reports on the controls of a cloud service, giving assurance to customers and regulators.