Cloud › Module 2 › Lesson 2
CSP vs Customer
CSP vs customer literacy compares provider-native controls with your obligations — IAM, logging, encryption — on YOUR $CLOUD_LAB policy notes.
Visual · t31_csp_vs_customer
CSP vs customer literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Same breach headline, different owner — literacy teaches which console pane fixes the gap on accounts you own.
CSP tools include AWS Shield foundations, Azure physical security, and managed Kubernetes control planes. Customer tools include IAM, security groups, bucket policies, Key Vault access policies, and CloudTrail or Sentinel enablement. L1 alerts often cite 'customer config' even when the headline blames 'the cloud.' Cyberlium compares CSP vs customer controls on YOUR $CLOUD_LAB — fictional resource IDs only. Next: Misconfig Named.
1. Control ownership table (named)
CSP-owned: datacenter access control, hypervisor patching, regional backbone. Customer-owned: root account MFA, access key rotation, S3 Block Public Access, NSG rules, Entra ID conditional access in your tenant.
On $CLOUD_LAB, fill two-row table: control name, owner (CSP or customer), fix location in console or CLI for your sandbox.
Command guide
Try these commands — Control ownership table (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AWS customer responsibilities — https://docs.aws.amazon.com/security/ Azure customer responsibilities — https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility OWASP cloud — https://owasp.org/www-project-cloud-security/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/notes/shared-responsibility-checklist.md" <<'EOF'
# Shared Responsibility Checklist (YOUR accounts)
## CSP owns
- [ ] Physical security of data centers
- [ ] Hypervisor / managed control plane patches
## YOU own
- [ ] IAM users, roles, policies (least privilege)
- [ ] S3 bucket policies, public access blocks
- [ ] CloudTrail / audit log enablement
- [ ] Container image hygiene, K8s RBAC/NetworkPolicy
## Lab scope
- Document only — no stranger tenant assessment
EOFCommand — copy this
grep -E 'YOU own|CSP owns|Lab scope' "$CLOUD_LAB/notes/shared-responsibility-checklist.md"
Primary tools to practice this lesson: grep, python3. Reference sites: AWS customer responsibilities (https://docs.aws.amazon.com/security/); Azure customer responsibilities (https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility); OWASP cloud (https://owasp.org/www-project-cloud-security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why ownership clarity speeds remediation
Misassigned tickets waste days — customer teams waiting on CSP for an IAM fix that only they can deploy. Runbooks should cite owner and console path; students practice on lab paperwork.
Defenders escalate to platform team when duty is genuinely CSP-side — rare compared to customer misconfig volume.
3. Literacy ≠ blame shifting
Forbidden: ignoring customer duties because a breach blog mentioned AWS. Allowed: ownership table — five controls with CSP/customer label and $CLOUD_LAB example resource.
Ship: CSP vs customer ownership table for YOUR sandbox. Next: Misconfig Named.
4. What you ship: CSP vs customer table for $CLOUD_LAB
Five controls with owner and fix path. $CLOUD_LAB named. NO stranger tenant. chmod 600.
5. What you record before the next lesson
Date. Ownership table. $CLOUD_LAB named. File t31-m02-l02-csp-vs-customer.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark IAM policy as CSP-owned. Skip fix path column.
Right
Write CSP vs customer table for YOUR $CLOUD_LAB. Next: Misconfig Named.
Mission: assign control ownership on YOUR lab
1) List five controls (MFA, logging, encryption, network, patching). 2) Label CSP or customer owner each. 3) Name console or CLI fix path on your sandbox. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Fix path column turns literacy into actionable hardening.
Knowledge Check
APPLY: IAM policy content is typically:
Multiple choice
Knowledge Check
APPLY: True or False: Physical datacenter security is CSP-owned in the shared model.
True or False
Knowledge Check
APPLY: CSP vs customer literacy on Cyberlium avoids:
Multiple choice