Managed Service or One-Time Job?

About this interactive

Vendors sell hardware, software or services. The Vendor Management lesson splits the services in two. A one-time service is a job with an end. The provider comes in, does the work, hands it over and leaves: a penetration test, a migration, a rewiring, a plan written and delivered. When the job is done, the contract has ended. A managed service provider (MSP) takes over running something you used to run in house, and keeps running it. The lesson's example is a company hired to run the help desk: staff calls were routed to the provider instead of to someone inside. An MSP might also run your network, your phone system or your infrastructure. An MSP that runs security functions, such as monitoring alerts or managing firewalls, is called a managed security service provider (MSSP). The difference matters for security. An MSP holds standing access to your systems for as long as it runs them, which is why Security+ lists MSPs as a supply chain threat vector: an attacker who gets into one MSP can reach every client it manages. A quick test for each card: when this provider finishes today's work, is the contract done, or will it be back tomorrow running the same thing?

What you'll learn

Tell a managed service provider, which takes over running one of your functions with no set end, from a service provider hired for one job that ends when the job is done
Recognize the functions a managed service provider commonly runs for a company: the help desk, security monitoring, the network or other infrastructure

Aligned to

CompTIA Security+

2.2 Explain common threat vectors and attack surfaces.

NIST CSF

GV.SC-04 Suppliers are known and prioritized by criticality.

ISC2 CISSP

1.11 Apply Supply Chain Risk Management (SCRM) concepts

Key terms

Managed Service Provider: A third-party company that remotely manages a customer's IT infrastructure or end-user systems. MSPs can introduce shared security risks; a compromised MSP can serve as a launchpad for attacks against all of its clients simultaneously.
Service Provider: A vendor that delivers a specific service, such as cloud computing or penetration testing, either on a short-term or ongoing basis.
Penetration Testing: An authorized simulated attack on a system to identify and evaluate security vulnerabilities.

Topics

Vendor Management Managed Service Provider Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →