Dell Cloud Infrastructure Design cheat sheet

Requirements and assumptions must be explicit and testable.

DIY, converged and hyperconverged designs have actual integration responsibilities.

Self-service, metering and monitoring require governance and accountability.

Size and compare the supported full lifecycle, including failure and exit.

Apply the NIST cloud model rather than a marketing label alone.

Self-service, broad access, pooling, elasticity and measurement describe different capabilities.

Pooling and tenant isolation require evidence at the relevant layer.

Elasticity adapts capacity to demand; released compute does not remove every other charge.

Cloud economics depend on utilization, contracts, migration and ongoing costs.

NIST SP 500-292 defines five roles: consumer, provider, auditor, broker, carrier.

The service model determines where the management boundary sits, not the technology used.

In SaaS the consumer still owns identities, access rights, configuration and data.

Choose the actual block, file or object interface.

Raw, usable, logical and consumed capacity differ.

Multipathing, zoning, mapping and file permissions address different stages.

Redundancy, snapshots, replicas and backups cover different failure scopes.

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Internet-facing services belong in a DMZ; data stores sit in a filtered internal zone.

VLANs alone are not a trust boundary - add DAI, private VLANs and 802.1 X.

IPsec AH gives integrity only; ESP adds confidentiality.

IDS is passive and alerts; IPS is inline and blocks.

NAT is not a security control and temporary rules must be removed.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Distinguish tolerated data loss from tolerated interruption.

A recovery point and restore time must both meet the stated targets.

A same-failure-domain snapshot alone does not cover loss of that domain.

Verify complete restore procedures and actual dependency behavior.