Cloud, Virtualization, and Container Security
Security in elastic environments
Core idea
Cloud and virtualization improve agility, but they also shift security responsibilities across provider, platform, and customer. Misunderstanding that split is a common source of exposure.
Cloud shared responsibility
| Area | Typical owner |
|---|---|
| Physical datacenter and core infrastructure | Cloud provider |
| Platform services and managed tools | Shared depending on service model |
| Identity, data, and workload configuration | Customer |
| Application logic and secrets | Customer |
VMs vs containers
Virtual machines
- Stronger isolation boundary
- Heavier resource overhead
Containers
- Fast and portable deployment
- Share the host kernel, so hardening matters
Common cloud risks
Cloud hygiene
Use strong identity controls, tight storage permissions, infrastructure as code review, and continuous configuration monitoring.
Secure cloud deployment basics
-
1
Define the provider and customer responsibilities for each service.
-
2
Harden identities, keys, and network exposure.
-
3
Scan images, templates, and runtime configurations.
-
4
Monitor logs and alerts from cloud control planes.
-
5
Remove abandoned or orphaned resources.
In most cloud models, who is primarily responsible for securing application data and access permissions?
Customers usually remain responsible for data, identities, and application configuration.
Correct answer: The customer
Why are containers not a security boundary as strong as a separate virtual machine?
Shared kernel architecture means hardening and privilege controls are essential.
Correct answer: Because containers share the host kernel and therefore have a thinner isolation layer
What is a common reason cloud storage becomes exposed?
Misconfigured access policies are a frequent source of exposure.
Correct answer: Incorrect permission configuration
What does infrastructure as code help security teams do?
IaC makes changes auditable and easier to standardize.
Correct answer: Review, version, and replicate infrastructure configurations consistently