Cloud Infrastructure Security
Securing VMs • Containers • Networks • Data Protection & Privacy
Securing virtual machines and containers, Network security: AWS VPC, Azure Virtual Network,
Google Cloud VPC, Firewalls, load balancers, security groups, Cloud security architecture design
principles
Agenda
Part A — Infrastructure Security Part B — Data Protection & Privacy
• Secure virtual machines (hardening, patching, • Encryption in transit & at rest (and how to verify
identity, secrets) it)
• Secure containers (image scanning, runtime, least • Key management (KMS, rotation, envelope
privilege) encryption)
• Network security building blocks (subnets, routing, • Data classification + access control +
gateways) tokenization
• Firewalls & segmentation (SG/NSG/NACL/GCP • Backups, DR, and ransomware-resilient designs
firewall rules) • Privacy-by-design: minimization, retention,
• Load balancers + TLS + WAF placement (where auditing
controls live)
Securing Virtual Machines (VMs)
VM Security Checklist Attack surface
• Use golden images (Packer/AMI) + minimal packages Reduce exposed services
• Patch OS regularly + reboot strategy
• No public SSH (use bastion/SSM)
• Disable password SSH; use keys/SSO; rotate credentials
• No open RDP (use VPN/JIT)
• Restrict inbound ports: allow only required (e.g., 443)
• TLS everywhere
• Host firewall (iptables/ufw) + cloud firewall rules
• Secrets: never in code; use secret manager / env injection
• Centralized logs + alerts (auth failures, sudo, auditd)
Compute layers
Container
Virtual Machine
Host / Hypervisor
Securing Containers
Build (image security) Run (runtime security)
• Use minimal base images (distroless/alpine where • Run as non-root; drop Linux capabilities
suitable) • Read-only filesystem; least privileges
• Pin versions + use SBOM (software bill of materials) • Network policies (Kubernetes) for micro-
• Scan images (Trivy/Grype) in CI; fail on critical CVEs segmentation
• Do not bake secrets into images • Limit egress; block metadata endpoint abuse
• Sign images (e.g., Cosign) + verify at deploy time
Quick demo commands
docker build -t app:1.0 .
trivy image app:1.0
# run as non-root
kubectl apply -f [Link]
Network Security: Building Blocks
Subnets • Routing • Gateways • Segmentation
Core concepts (cloud-agnostic) Reference 2-tier design (diagram)
• Virtual network boundary (VPC/VNet/VPC)
Generic VPC/VNet pattern Firewall / rules
• Subnets: public vs private
• Routing: route tables decide packet paths
Virtual network boundary
• Internet/NAT gateways: inbound/outbound control
• Micro-segmentation: isolate tiers (web/app/db) Public subnet Private subnet
• Private connectivity: VPN / Direct Connect /
Load balancer App VM App Pod
ExpressRoute
AWS VPC Security
Security Groups vs Network ACLs + Load Balancers
Key controls in AWS VPC
AWS VPC example Firewall / rules
• Security Groups (SG): stateful firewall at ENI/instance level
• Network ACLs (NACL): stateless rules at subnet boundary
Virtual network boundary
• ALB/NLB: front door + TLS termination + health checks
• VPC Flow Logs: visibility into traffic (detective control) Public subnet Private subnet
• Private subnets + NAT: control outbound access App VM
App
Load balancer Pod
Azure Virtual Network Security
NSG, Azure Firewall, Load Balancer / Application Gateway
Key controls in Azure
Azure VNet example Firewall / rules
• Network Security Groups (NSG): allow/deny rules on subnet
or NIC
• Azure Firewall: managed, central policy + logging Virtual network boundary
• Application Gateway: L7 load balancer + TLS termination Public subnet Private subnet
(WAF optional)
App
• UDR (routes): force traffic through firewall (hub-and-spoke) Load balancer App VM
Pod
• Flow logs (NSG) + Azure Monitor for detection
Google Cloud VPC Security
Firewall rules, hierarchical policies, load balancers
Key controls in Google Cloud
GCP VPC example Firewall / rules
• VPC firewall rules: stateful, apply to VM instances (targets via
tags/SAs)
• Hierarchical firewall policies: org/folder/project policy layers Virtual network boundary
• Cloud Load Balancing: global anycast front door + TLS Public subnet Private subnet
• VPC Flow Logs: traffic visibility App
Load balancer App VM
• Private Google Access + Cloud NAT for controlled egress Pod
Firewalls & Load Balancers
Where do you filter traffic? (Layer-by-layer)
Control placement cheat-sheet
Layer AWS Azure Google Cloud
Edge / Front door ALB/NLB (+ WAF) App Gateway / LB (+ WAF) Cloud LB (+ Armor)
Instance / NIC Security Groups NSG (NIC/subnet) Firewall rules (targets)
Subnet boundary Network ACL NSG (subnet) Hierarchical firewall policy
Visibility VPC Flow Logs NSG flow logs VPC Flow Logs
Cloud Security Architecture Principles
Design patterns for secure-by-default systems
Principles Reference architecture (3-tier)
• Zero Trust: verify explicitly; never trust network location
Web tier (public) — LB + WAF
• Least privilege by default (roles, scopes, time-bound
access)
• Defense in depth: multiple layers of controls (prevent +
detect) App tier (private) — VMs/Pods
• Secure defaults: private-by-default networking and storage
• Separation of duties: admin ≠ developer ≠ auditor
Data tier (private) — DB/Storage
• Automate security: IaC + policy-as-code + CI checks
Practical checks
• No direct public access to app/data tiers
• All traffic encrypted (TLS) + strong ciphers
• Central logs + alerts for anomalies
• Backups tested (restore drills)
Data Protection & Privacy
Keep data confidential, integral, and available (CIA)
Data security goals (CIA) Controls mapped to lifecycle
• Confidentiality: authorized access only (IAM + encryption)
Collect Store Use Share Delete
• Integrity: detect/stop unauthorized changes (hashing,
signing, immutability)
• Availability: resilience (backups, multi-AZ/region, DR)
Examples of controls
• Privacy: minimize data, limit retention, audit access
• Collect: consent, minimization
• Store: encrypt at rest, backups
• Use: least privilege, audit logs
• Share: tokenization, DLP, signed URLs
• Delete: retention policy, secure erase
Encryption & Key Management
In transit (TLS) + at rest (KMS) + rotation
Encryption in transit (TLS) Envelope encryption (diagram)
• Terminate TLS at load balancer or at app (end-to-end)
• Use modern TLS versions + disable weak ciphers Data key (DEK) KMS key (KEK)
Encrypts data Encrypts DEK
• Automate certificates (ACM / Key Vault certs / managed certs)
• Verify: curl -v / browser devtools / LB listener settings
Store encrypted data + encrypted DEK
• Rotate keys (policy-driven)
• Limit who can use vs manage keys
• Log all KMS key usage
Encryption at rest • Avoid exporting private keys when possible
• Enable default encryption for storage (S3/Blob/GCS)
• Use customer-managed keys (CMK) when required
• Separate duties: key admins ≠ data admins
• Verify: check encryption settings + audit logs
Backups, DR & Ransomware Resilience
Availability + recovery are part of security
Backup best practices DR strategy (diagram)
• 3-2-1 rule: 3 copies, 2 media, 1 offsite/isolated
Region A Region B
• Immutable backups (WORM/object lock) for ransomware (Primary) (Standby)
• Automate backups + monitor failures Repli
cate
• Test restores regularly (game day drills) data
• Separate backup admin role from production admin (RPO
)
Mini-lab (proof)
• Take backup → delete test record → restore
• Show logs/screenshots of restore
• Measure RTO & RPO (simple)
Privacy-by-Design Checklist
Minimization • Purpose limitation • Retention • Auditing
Privacy controls you can implement Example: logging safely
• Data classification: public / internal / confidential /
restricted BAD: log full password / tokens / PII
GOOD: log userId + action + requestId
• Minimize collection (only what you need for the feature) GOOD: hash or truncate identifiers
• Retention policy (auto-delete after X days)
• Mask/tokenize sensitive fields (IDs, tokens, etc.)
Engineering mindset: privacy is a system requirement (like
• Access logging for sensitive datasets (who/when/why) latency), not a legal checkbox.
• DLP scans for accidental exposure in storage/logs
Mini-project idea
• Build a notes app storing sensitive fields
• Add retention (auto-delete old notes)
• Audit log access to restricted notes
• Show proof: logs + policy + encryption enabled
Recap & Practical Tasks
What students should implement and submit
Infrastructure security (submit proof) Data protection & privacy (submit proof)
• VM hardening checklist applied to one VM • Enable encryption at rest (storage + database)
• Container: scan image + run non-root • TLS in transit (LB listener or app config)
• Network: LB public, app private, only required ports open • Key governance: who can use vs manage keys
• Firewall rules: allow 443, deny direct VM inbound • Backups + restore test (RTO/RPO estimate)
• Visibility: enable flow logs / activity logs • Retention policy + audit access logs