Enterprise Virtual, Cloud, and Wireless Network Security
Virtualization and cloud
Know the hypervisor split: Type 1 (bare metal, e.g. ESXi/Hyper-V) versus Type 2 (hosted). Risks include VM escape, hypervisor compromise, snapshot sprawl, resource contention, and inter-VM traffic that never crosses a physical firewall - hence virtual firewalls, private VLANs, and virtual switches. Containers share the host kernel and isolate with namespaces/cgroups, so they need image scanning and orchestration hardening.
Cloud models shift responsibility: IaaS leaves the customer responsible for OS, middleware, runtime, applications, and data; PaaS covers applications and data; SaaS leaves data, identity, and configuration. The provider is always responsible for physical security and the underlying infrastructure. Controls to name: identity and access management with MFA and least privilege, CASB for shadow-SaaS visibility, encryption with customer-managed keys, and logging into a SIEM.
Wireless
Understand 802.1X/EAP with a RADIUS server (WPA2/WPA3-Enterprise) versus a pre-shared key (Personal). WPA3 replaces the WPA2 four-way handshake PSK exchange with SAE, mitigating offline dictionary attacks. Threats: rogue AP, evil twin, deauthentication/disassociation DoS, WPS PIN brute force, captive-portal phishing, and misconfigured guest networks bridging to the corporate LAN. Defenses: WIPS/WIDS, PMF, disabling WPS, certificate-based EAP-TLS, and segmenting guest, IoT, and corporate SSIDs onto separate VLANs.
Traps
Questions claim the cloud provider secures customer data in IaaS - it does not. WPA2-Personal is PSK, not 802.1X. A deauth attack is a availability attack, not a confidentiality break.
Rule of thumb
Ask 'who owns this layer?' to answer any shared-responsibility question, and 'is this a rogue device or a legitimate device misused?' to answer any wireless question.