Cloud and Virtualization Security
What to know
Understand the shared responsibility model and how it shifts by service model: infrastructure as a service leaves the customer responsible for OS, runtime, and application; platform as a service moves OS and runtime to the provider; software as a service leaves configuration, identity, and data handling with the customer. Know that data classification and identity are always customer responsibilities.
Cloud-native concepts to master: virtual networks and security groups, identity and access roles, key management services, object storage access policies, logging and audit trails, and infrastructure as code. Understand why misconfiguration - public storage buckets, overly permissive roles, exposed management interfaces - is the dominant cloud risk. Know the value of guardrails: policy-as-code, organization-level restrictions, and continuous configuration assessment.
Virtualization risks include hypervisor escape, VM sprawl, snapshot and image leakage, and insecure template cloning. Container security adds image provenance, registry scanning, runtime isolation, and orchestration control-plane hardening. Understand workload isolation and the principle that a snapshot or image may contain secrets.
Traps
Questions often imply the provider secures customer data - it does not; the provider secures the platform. Another trap: assuming network controls inside the cloud behave like on-premises firewalls; security groups are typically stateful and instance-scoped. Beware options that treat "encryption at rest enabled by default" as sufficient - access control and key custody still matter. Also, deleting a VM does not necessarily delete its snapshots or attached storage.
Worked example
An object storage bucket is found publicly readable. The remediation is to remove public access, enable policy enforcement at the organization level to prevent recurrence, audit access logs for exposure, and rotate any credentials found in the objects.
Rule of thumb: in cloud, identity and configuration are the primary attack surface - audit both continuously.