MODULE – 2

Cloud Infrastructure Security, Secure Infrastructure architecture

[Link]
 Objectives of the Module
By the end of this module, you will be able to:
• Understand security at network, host, and application levels
• Recognize common attack vectors and threats in cloud systems
• Apply mitigation techniques: isolation, virtualization, segmentation, IDS/IPS, firewalls
• Strengthen systems through OS hardening & minimization
• Ensure trusted environments using verified & measured boot
• Integrate defense-in-depth strategies in secure cloud architecture

[Link]
• Cloud Infrastructure Security involves policies, technologies, and practices to protect
cloud resources from threats, ensuring confidentiality, integrity, and availability of data
and applications.
• A Secure Infrastructure Architecture in cloud security is the strategic framework—the
"blueprint"—that integrates various security controls like identity and access
management, network security, encryption, and continuous monitoring to build a
resilient and trustworthy cloud environment.
• Key principles include designing for the principle of least privilege, zero trust, and
defense-in-depth to create a secure foundation for cloud-native operations.

[Link]
This is the overarching practice of applying security measures to cloud-based systems,
data, and applications. It focuses on protecting cloud resources from both internal and
external threats by implementing robust controls for:

• Data Security and Protection: Ensuring data is encrypted and protected from
unauthorized access.
• Access Management: Controlling who can access what resources using strong
authentication and identity and access management (IAM).
• Network Security: Securing the network traffic into and out of cloud systems using
firewalls, VPNs, and intrusion detection systems.
• Compliance: Adhering to relevant data protection laws and regulatory standards.

[Link]
Secure Infrastructure Architecture in Cloud Security

This is the design and framework that underpins cloud infrastructure

security. It's a strategic approach to build security into the cloud
environment from the ground up.
A good cloud security architecture includes:

[Link]
• Layered Defenses: Employing multiple security controls at different levels of the infrastructure
stack for defense-in-depth.
• Identity and Access Management (IAM): A fundamental component for centralizing control
over user access and permissions.
• Data Security Measures: Implementing encryption for data at rest and in transit, alongside
other data loss prevention techniques.
• Vulnerability Management: Continuously identifying and addressing security weaknesses in
the environment.
• Threat Detection and Response: Using tools and processes to detect, respond to, and
mitigate security incidents in real-time.
• Visibility and Monitoring: Gaining continuous visibility into cloud environments to detect
misconfigurations and anomalous activity.
• Automation: Using tools to automate security tasks, enforce policies, and reduce manual
errors, especially in dynamic cloud environments.

[Link]
● Cloud infrastructure security is what is protected in the cloud, while secure
infrastructure architecture is how that protection is strategically built and
maintained.

[Link]
Infrastructure Security at Network Level

● Infrastructure Security deals with the threats, risks, and challenges that are
associated with the security of the organization’s IT infrastructure such as the
host, network, and application levels, this approach is commonly used by
security practitioners.
● Whereas Non-IT security associates are advised not to equate the
infrastructure security with access management’s infrastructure as service
security(IaaS).
● Besides that infrastructure security is more related to customers, as they have
ramifications with threat, risk, and compliance management.

[Link]
● There are no new attacks, vulnerabilities, or changes that need to be
considered in this specific topology by the information security personnel.
● Beside that the organization’s IT infrastructure might be affected by the
implementation of a private cloud but the current network topology probably
will not get affected.
● Whereas if we used the services of public clouds any changes in the security
requirements will require a change in the network topology.
● Therefore, must define some ways through which our existing network
topology will interact with the topology of the cloud provider.

[Link]
Risk Factors Needed to be Addressed

● Integrity and Confidentiality of the In-Transit Data:

○ In-transit data vulnerable over public internet.
○ Requires TLS/SSL encryption, VPNs, and secure APIs.
● Access Control Methods:
○ Limited ability to audit provider’s internal operations.
○ Use IAM, MFA, RBAC, and continuous monitoring.
● Availability of the Services:
○ Dependence on external networks → risk from misconfigs & attacks.
○ Threats: BGP hijacking, DDoS, outages (e.g., YouTube 2008).
○ Need redundancy, failover, disaster recovery.
● Replace the Models Established in Network Zones and tiers within the Domains:
○ Network zones/tiers (prod vs dev, app vs DB) are blurred in cloud.
○ Logical isolation replaces physical; risk of lateral movement.
○ Mitigation: segmentation, microservices security, zero-trust.

[Link]
Infrastructure Security at the Host Level

● Focus on securing hosts across SaaS, PaaS, and IaaS models.

● No new host threats specific to cloud, but virtualization risks exist (VM
escape, config drift, insider threats).
● Elasticity of cloud = frequent changes → harder vulnerability & patch
management.

[Link]
SaaS & PaaS Host Security
● Providers handle host OS and platform security; customers have limited
visibility.
● Virtualization use: VMware, XEN for hardware utilization.

● Abstraction Layer:
○ SaaS: hidden from users; only provider staff/developers access.

○ PaaS: indirect access via APIs.

● Customers rely on providers for a secure host environment.

[Link]
IaaS Host Security

● Customers responsible for securing hosts.

● Layers:
○ Virtualization Software Security – managed by provider.

○ Guest OS/Virtual Server Security – managed by customer.

● APIs allow provisioning, duplication, decommissioning.

● Elasticity enables scaling resources but increases attack exposure.

[Link]
Host Security Threats in Public IaaS

● Malware embedded in VM components.

● Weak host firewalls → system compromise.

● Weak/reused passwords → account breaches.

● Theft of SSH private keys → unauthorized host access.

[Link]
Securing Virtual Servers

● Protect private keys, enforce role-based access.

● Disable password login at shell prompt; restrict firewall ports.

● Disable unused services (FTP, print, etc.).

● Regular log monitoring & IDS installation.

● Protect virtual images & decryption keys from unauthorized access.

[Link]
Application Layer Security

● Applications range from single-user to large-scale e-commerce.

● Security programs must adapt to cloud environments.

● Browser security is critical → combined (App + Browser) = end-to-end cloud

security.
● Goal: Protect Confidentiality, Integrity, Availability (CIA).

[Link]
Application-Level Threats

● Common vulnerabilities: XSS, SQL Injection, Malicious File Execution, Logic

Errors.
● Exploits lead to fraud, phishing, and hijacked trusted sites.

● Public cloud apps face higher risks → require strong controls.

● Internet security should be embedded into SDLC.

[Link]
DoS & EDoS Attacks

● DoS: Flood of page reloads, XML requests, protocol-specific traffic → service

disruption.
● EDoS: Economic impact due to cloud’s pay-as-you-go model (↑CPU, storage,
bandwidth costs).
● Hard to filter malicious traffic without harming user experience.

[Link]
End User Security

● Users must ensure PC/browser protection:

○ Safe browsing (HTTPS sites).

○ Anti-malware, antivirus, personal firewall, IPS, regular patches.

● Keep browsers updated to remove known vulnerabilities.

● End-user vigilance is essential for end-to-end security.

[Link]
Security Responsibilities in SaaS & PaaS

● SaaS:
○ Provider secures the application; customer manages users, access, and roles.

○ Security assurance integrated into provider’s SDLC.

● PaaS:
○ Provider secures platform & runtime engine.

○ Sandbox model ensures confidentiality & integrity in multi-tenant environments.

○ Responsibility shared with third-party app providers.

[Link]
Common attack vectors and threats

[Link]
Common attack vectors and threats

● Attack vectors are the specific paths or methods that cyber attackers use to
gain unauthorized access to a system, network, or application.
● These vectors serve as entry points for attacks, allowing malicious actors to
exploit vulnerabilities.
● Every ethical hacker has their unique attack vector to check the security of
the target application. This application may be a web application or an android
application.
● They take advantage of weaknesses or flaws in the system to steal
information, cause damage, or gain control.

[Link]
[Link]
Some Common Attack Vectors

● Phishing : It is a type of cyber attack in which user or victim is duped to click on harmful sites which are crafted in a way
to feel authentic site. The most common mode of phishing is by sending spam emails that appear to be authentic and
thus, taking away all credentials from the victim.
● Malware : Malware is short for malicious software and refers to any software that is designed to cause harm to
computer systems, networks, or users. Malware are designed to gain access to computer systems, generally for the
benefit of some third party, without the user’s permission.
● MITM : In Man-in-the-Middle (MitM) attacks there is an unwanted proxy in the network intercepting and modifying the
requests/responses. This proxy is called a Man in the middle.
● Denial of Service: Denial-of-Service (DoS) is a cyber-attack on an individual Computer or Website with the intent to
disrupt an organization’s network operations by denying access to its users. It is done by flooding the targeted machine
or resource with surplus requests in an attempt to overload systems and prevent some or all legitimate requests from
being fulfilled.
● Insider Attacks: Insider Threats or Insider Attack are caused by insiders like former employees, business partners,
contractors, or security admins having access to the confidential information previously.
● Ransomware: Ransomware is a form of malicious software that prevents computer users from accessing their data by
encrypting it.
● SQL Injection: SQL injection is a code injection technique attackers use to gain unauthorized access to a database by
injecting malicious SQL commands into web page inputs.
[Link]
Recent Cyber Security Attacks

● Infosys: Indian IT services company Infosys experienced a data breach in November 2023, affecting
its US unit, Infosys McCamish Systems. The breach led to the unavailability of several applications,
and the company is still investigating the impact​.

● Indian Council of Medical Research: A data breach exposed health data of around 815 million
Indian citizens in October 2023. The breach was caused by a threat actor named “pwn0001,” who
claimed to have the data for sale​.

● Hyundai Motor Europe: In February 2024, Hyundai Motor Europe was hit by a ransomware attack
named Black Basta , where the attackers claim to have stolen 3TB of corporate data​.

● Boeing: In November 2024 Boeing reported a cyber incident that impacted various parts of its
business. It was attacked by the LockBit ransomware gang initially claimed responsibility, though
Boeing confirmed that the incident did not affect flight safety.​

[Link]
Protection from Attack Vectors

● Network Segmentation
● Intrusion Detection and Prevention System
● Antivirus
● Encryption
● Good security practices
● Patching vulnerabilities

[Link]
Attack surface

● An attack surface refers to all the locations, interfaces, or channels by which

an attacker may obtain unauthorized access to a system, network, or
application.
● It comprises the entire vulnerabilities, access points, and potential channels of
attack that exist inside an organization's cyberspace.

[Link]
Common threats

[Link]
Mitigation techniques- Isolation, Virtualization
and Segmentation

[Link]
Isolation

● Isolation refers to separating critical systems, processes, or workloads so that a

compromise in one component does not affect others.
● Purpose:
○ To contain attacks, prevent lateral movement, and minimize the impact of security breaches.
● Examples:
○ Running applications in sandboxed environments so malware can’t affect the host system.
○ Using network isolation to separate internal corporate systems from public-facing services.
○ Container isolation (like Docker) ensures each container runs independently, limiting access between
them.

● Benefits:
○ Limits the spread of attacks
○ Protects sensitive resources
○ Simplifies recovery after compromise

[Link]
Virtualization

● Virtualization allows multiple virtual instances (e.g., virtual machines, VMs) to

run on a single physical machine using a hypervisor
● Purpose:
○ To improve resource utilization, flexibility, and security by creating isolated environments
within the same hardware.
● Examples:
○ Server Virtualization: Multiple virtual servers hosted on one physical server.
○ Desktop Virtualization: Secure virtual desktops accessible via thin clients.
○ Network Virtualization: Creating virtual networks (VNets) within the same infrastructure..

[Link]
Virtualization

● Security Role:
○ Prevents one compromised VM from affecting others (isolation at the hypervisor level).
○ Enables snapshot and rollback features for quick recovery after an attack.
○ Supports test environments for analyzing malicious software safely.
● Benefits:
○ Enhanced isolation and control
○ Cost-efficient resource utilization
○ Easier system backup and recovery

[Link]
Segmentation

● Segmentation divides a network or system into smaller, controlled sections to

restrict access and limit attack spread.
● Purpose:
○ To reduce the attack surface and contain security incidents within smaller areas.
● Types:
○ Network Segmentation: Dividing a network into VLANs or subnets (e.g., separating user,
server, and database zones).
○ Microsegmentation: Fine-grained segmentation at the application or workload level, often
used in cloud environments.

[Link]
Segmentation

● Examples:
○ Separating development, testing, and production environments.
○ Using firewalls or access control lists (ACLs) between network segments.
○ Restricting IoT devices to their own subnet to prevent compromise of critical systems.
● Benefits:
○ Limits attacker movement within the network
○ Enhances monitoring and incident response
○ Supports compliance (e.g., PCI DSS, HIPAA)

[Link]
 Technique Main Goal Example Use Case Key Benefit
Isolation Contain threats Sandbox applications Prevent lateral attacks
Create secure virtual Run multiple VMs on Resource efficiency,
Virtualization
environments one server rollback
Divide networks into VLANs, Limit attack spread,
Segmentation
smaller zones microsegmentation enhance control

[Link]
Intrusion Detection and Prevention

[Link]
● In cloud environments, Intrusion Detection and Prevention Systems (IDPS)
play a vital role in monitoring, analyzing, and securing cloud resources
against unauthorized access, misuse, or attacks.
● Cloud systems are dynamic, multi-tenant, and distributed — making
traditional security measures insufficient.
● Hence, specialized cloud-based IDPS solutions are required.

[Link]
Key Concepts

Term Description

Any attempt to compromise confidentiality, integrity, or availability of cloud

Intrusion
resources.

Detection Identifying malicious activity through monitoring and analysis.

Prevention Blocking or mitigating an attack before it causes harm.

[Link]
Types of Intrusion Detection Systems

● Host-Based IDS (HIDS)

○ Monitors activities on individual virtual machines or servers.
○ Detects unauthorized file changes, rootkits, or configuration tampering.
○ Example: OSSEC, Wazuh
● Network-Based IDS (NIDS)
○ Monitors network traffic between cloud components.
○ Detects DoS attacks, port scanning, or suspicious communication.
○ Example: Snort, Suricata
● Cloud-Based IDS (CIDS)
○ Integrated with cloud service providers.
○ Uses AI/ML to detect anomalies in cloud workloads, storage, and APIs.
○ Example: AWS GuardDuty, Azure Security Center, Google Cloud IDS

[Link]
Intrusion Prevention Systems

● Active systems that detect and block malicious activity in real-time.

● Deployed inline (between the cloud network and internet traffic).
● Can drop packets, reset connections, or quarantine affected resources.

● Example Actions:
○ Blocking an IP address after detecting brute-force attempts.

○ Terminating malicious sessions automatically.

○ Isolating compromised VMs or containers.

[Link]
Techniques Used in Cloud IDPS

Technique Description
Matches known attack patterns (fast but cannot detect new
Signature-based detection
threats).
Anomaly-based detection Uses ML to learn normal behavior and flag deviations.
Monitors user and system behavior over time to detect insider
Behavioral analysis
threats.
Policy-based detection Enforces security rules and compliance standards.

[Link]
Cloud Provider Integration

● Major cloud platforms offer built-in or integrable IDPS services:

○ AWS: GuardDuty, Inspector, Network Firewall
○ Azure: Defender for Cloud, Sentinel
○ Google Cloud: Cloud IDS, Security Command Center
● These tools offer:
○ Centralized dashboards
○ Automated alerting and response
○ Integration with SIEM (Security Information and Event Management) systems

[Link]
Benefits of Intrusion Detection and Prevention

● Real-time monitoring and alerting

● Automated threat response
● Compliance with security standards (ISO, NIST, GDPR)
● Protection against DDoS, insider threats, and data breaches
● Enhanced visibility across cloud layers (network, VM, application)

[Link]
Challenges

● High false positive/negative rates

● Difficulty monitoring encrypted traffic
● Scalability issues in multi-cloud setups
● Privacy concerns in data inspection
● Need for continuous model updates (for ML-based IDS)

[Link]
Best Practices

● Deploy multi-layered IDPS (network + host + application).

● Enable automated incident response for faster containment.
● Use machine learning and threat intelligence for adaptive detection.
● Integrate with SIEM tools for centralized visibility.
● Conduct regular tuning and rule updates to reduce false alarms.

[Link]
 Firewall
● A firewall is a security mechanism that monitors and controls incoming and outgoing
network traffic based on predetermined security rules.
● Purpose:
○ To act as a barrier between trusted and untrusted networks, blocking malicious traffic and allowing
legitimate communication.
● Types:
○ Network Firewalls: Filter traffic between networks (e.g., between the internet and a private cloud network).
○ Host-based Firewalls: Protect individual cloud instances or servers.
○ Next-Generation Firewalls (NGFW): Combine traditional filtering with intrusion prevention, deep packet
inspection, and application-level control.
● Benefits:
○ Prevents unauthorized access
○ Protects against network-based attacks
○ Supports policy-based access control
● Example in Cloud:
○ AWS Security Groups, Azure Network Security Groups (NSGs), and Google Cloud Firewalls.

[Link]
OS Hardening and Minimization

OS Hardening involves securing an operating system by reducing its attack surface —

disabling unnecessary features, services, and accounts.
● Purpose:
○ To make the system more resilient against attacks and exploits.
● Key Techniques:
○ Remove Unnecessary Software: Avoid default packages or unused services.
○ Disable Unused Ports and Services.
○ Apply Security Patches Regularly.
○ Enforce Strong Authentication Policies (e.g., SSH keys, complex passwords).
○ Use File Integrity Monitoring (FIM).
○ Restrict Administrative Privileges (Principle of Least Privilege).
● Minimization Aspect:
○ Deploy only the minimal OS image required for your application—reduces vulnerabilities and improves
performance.
● Example in Cloud:
○ Using hardened images like CIS-hardened Ubuntu or AWS Linux 2 minimal AMIs.

[Link]
Verified and Measured Boot

A boot-time security mechanism ensuring that only trusted software components are loaded when
the system starts.
● Purpose:
○ To detect and prevent rootkits, bootkits, or unauthorized firmware from compromising the system before the OS loads.
● Process:
○ Verified Boot:
Checks the integrity and authenticity of each component (firmware, bootloader, kernel) using digital signatures.
○ Measured Boot:
Records cryptographic measurements of components in a Trusted Platform Module (TPM) for later verification (e.g.,
remote attestation).
● Benefits:
○ Ensures system integrity from the very first instruction executed.
○ Protects against low-level attacks that antivirus tools may miss.
○ Enables remote verification of system trustworthiness.
● Example in Cloud:
○ Google Cloud’s Shielded VMs, Microsoft Azure’s Secure Boot, and AWS’s Nitro Enclaves use similar verified/attested
boot mechanisms.

[Link]
 Technique Purpose Key Mechanism Example in Cloud

Protect network Packet filtering, traffic AWS Security Groups,

Firewall
boundaries inspection Azure NSG

Disable unused
OS Hardening & Reduce system CIS-hardened images,
services, minimal OS
Minimization vulnerabilities Ubuntu Minimal
image, patching

Verified & Measured Ensure system integrity Digital signature checks, GCP Shielded VMs,
Boot at startup TPM-based attestation Azure Secure Boot

[Link]