Web, Cloud, and Container Security at Scale
Why Web and Cloud Security Are Distinctly Hard
Scale, heterogeneity, and shared responsibility
Web and cloud systems combine browsers, APIs, identity providers, orchestration layers, storage services, and third-party dependencies. Security is complicated by multi-tenancy, elastic scaling, ephemeral infrastructure, and the shared responsibility model, where misconfigurations often create vulnerabilities even when core services are sound.
Common attack classes
Web application attacks
- Injection, XSS, CSRF, SSRF, auth bypass.
- Often exploit trust in untrusted input.
Cloud misconfiguration
- Overpermissive IAM, exposed storage, insecure metadata access.
- Often caused by complexity and automation errors.
Which vulnerability class most directly arises from treating untrusted input as code or query structure?
Injection attacks occur when input changes the semantics of code or queries.
Correct answer: Injection
What is the security risk of overly permissive IAM policies?
Least privilege limits the damage caused by credential theft or misuse.
Correct answer: They let compromised identities access more resources than necessary, increasing blast radius.
Secure Software Supply Chains
From source to deployment
A secure software supply chain protects code, dependencies, build systems, package registries, signing keys, and deployment pipelines. Recent incidents have shown that trusted update channels and CI/CD infrastructure are lucrative targets because compromising them can silently reach many downstream environments.
Supply-chain hardening checklist
-
1
Step 1: Pin and verify dependencies where possible.
-
2
Step 2: Protect build systems and signing keys with strong access controls.
-
3
Step 3: Use reproducible or auditable builds when feasible.
-
4
Step 4: Segment CI/CD secrets and enforce short-lived credentials.
-
5
Step 5: Continuously monitor provenance and package integrity.
Why are software supply-chain attacks so dangerous?
A trusted upstream component can propagate compromise broadly and silently.
Correct answer: They can compromise many downstream users through a trusted channel
Name one benefit of short-lived credentials in cloud environments.
Shorter lifetimes limit attacker persistence.
Correct answer: They reduce the window of misuse if credentials are stolen or leaked.
Runtime Isolation and Multi-Tenancy
Isolation under shared infrastructure
Cloud providers rely on a mixture of hypervisors, microVMs, namespaces, cgroups, network policies, and identity controls. Researchers study cross-tenant leakage, noisy-neighbor effects, metadata service abuse, and the security impact of control-plane compromise.
What is a core goal of multi-tenant isolation?
Isolation constrains both direct compromise and collateral impact across tenants.
Correct answer: Limit one tenant's ability to affect another
Why is the control plane a high-value target in cloud security?
Compromising the control plane can have broad systemic impact.
Correct answer: Because it can manage identities, policies, and resources across many workloads.