Provider-cloud infrastructure and management security
Draw the actual trust boundaries
A service-provider cloud has management, control and data paths with different purposes and exposure. Infrastructure ACLs can restrict traffic directed at relevant internal addresses, while control-plane protection limits eligible traffic to the device’s processing resources. Neither mechanism automatically replaces application authorization or encrypted transport. Protect actual orchestration APIs, hypervisors, virtual switches, identities and remote-management interfaces rather than focus only on physical switch ports.
Use identity and encryption for their roles
Authentication establishes a claimed principal under a supported mechanism; authorization decides permitted action and accounting supports evidence. Administrative TACACS+/AAA examples can illustrate these distinctions, but legacy protocol properties are not permission to expose credentials over untrusted networks. TLS authenticates/protects its configured transport leg, while mutual TLS also uses client authentication under its trust model. MACsec concerns relevant link protection and IPsec a selected network-layer tunnel arrangement. Each needs actual key, peer and lifecycle management; none automatically makes an authorized administrator’s every action safe.
Apply routing and traffic controls deliberately
uRPF evaluates source reachability under its selected mode and topology assumptions. Asymmetric routing can affect strict checks, so a security label is not proof that every legitimate packet will pass. RTBH and BGP FlowSpec distribute particular filtering/mitigation decisions with different traffic effects and trust requirements. A discard route can intentionally sacrifice selected reachability to protect a broader service. Network segmentation and scoped management reduce exposure but require actual enforcement and monitoring rather than a VLAN name alone.
Preserve evidence and limited authority
A denial, a silent drop and missing telemetry have different possible causes. Review actual ACL order, effective privileges, relevant logs, identity, source and outcome before an authorized change. API credentials, configuration exports and packet captures can contain sensitive data. Use appropriate retention and access controls, and avoid logging secrets merely for convenience. Mitigation capacity and upstream saturation remain real limits; an enabled feature cannot guarantee every denial-of-service event is harmless. These written scenarios perform no authentication, filter deployment, key operation or traffic test and do not establish legal or operational authority over a provider network.