Cloud Platform and Infrastructure Security
Layers to think in
Physical/environmental, network, compute/host, virtualization, and management plane. The management plane is the highest-value target in cloud: compromise of console credentials or API keys is effectively root over the estate, so identity, MFA, and API logging are infrastructure controls, not just application concerns.
Virtualization and multitenancy
Hypervisor compromise means VM escape and cross-tenant access; controls include patching, minimizing hypervisor features, separating management traffic, and hardening images. Related risks: VM sprawl, unmanaged snapshots containing secrets, and template drift.
Network
Understand VPC/VNet design, subnets, route tables, internet and NAT gateways, and the difference between stateful security groups (instance-level, return traffic automatically allowed) and stateless network ACLs (subnet-level, you must write both directions). Segmentation and private endpoints keep data-plane traffic off the public internet. Zero trust replaces 'inside is trusted' with per-request authentication and least privilege.
Compute and containers
Harden hosts, remove default accounts, use bastion/jump hosts or session managers instead of public SSH, and scan container images plus orchestration configuration. Serverless shifts patching to the provider but not code, permissions, or event-source trust.
Resilience
BCDR design: backup/restore, pilot light, warm standby, multi-site. Match the strategy to RTO/RPO, and remember that a backup in the same account and region is not a disaster-recovery plan.
Worked example
An engineer finds a subnet where inbound traffic is allowed by the security group but responses never arrive. Cause: NACLs are stateless, so ephemeral return ports must be explicitly permitted. Remember 'stateful = security group, stateless = NACL'.