Cloud Workload Security
Protect the unit of compute
Workloads include virtual machines, containers, serverless functions, and managed platform runtimes. Unifying practices: hardened minimal base images, vulnerability and patch management, immutable infrastructure where change means redeployment rather than in-place patching, scanned and signed image registries, infrastructure-as-code scanning, runtime protection, and configuration hardening against a recognized benchmark.
Containers and serverless
Containers share the host kernel, so host hardening and orchestration control-plane security (role-based access in Kubernetes, admission control, network policy, secret handling) matter more than the container itself. Serverless shifts OS and runtime patching to the provider; you still own function permissions, dependency vulnerabilities, secrets, event injection, and timeouts. Ephemeral workloads must have logging and identity designed in from the start, because there is no machine to log into later.
Agents versus agentless
Agent-based tools provide runtime depth but require deployment and lifecycle management. Agentless approaches scan snapshots and API-visible configuration; easier to operate, but they see only what the API exposes. Mature programs use both.
Traps
- Misconfiguration, not zero-days or hypervisor escape, is the dominant workload risk in cloud.
- The provider does not patch your guest OS in IaaS or your container images anywhere.
- Instance metadata services are a well-known attack path; require token-based access.
- Immutable infrastructure means you do not log in and fix things by hand.
Rule of thumb
Treat every workload as disposable: build from code, scan the build, minimize what runs, and destroy rather than repair.