Virtualization, Containers & Cloud

The Board Question

A red-team report notes that "eng build" Kubernetes nodes can break out to the host via a poorly confined privileged container. Finance laptops show policy drift — host firewalls off, HIPS stale, FIM baselines missing. Sales are syncing PII to a shadow SaaS app.

The board just asked: "Are we safe in the cloud?"

Anya's answer: "We need one map that ties all of this together."

Modern enterprises don't run on one computer or one tidy app. They run on layers: hypervisors, containers, microservices, SaaS, mobiles, and clients scattered across countries. Each layer adds power and new places to fail. Your job isn't just to "turn on controls." It's to understand where isolation breaks, where defaults leak, and where shared responsibility is silently handing you the knife by the blade.

Virtualization vs Containers vs Microservices

Virtual Machines (VMs)

• What they are: Software emulation of a full OS on a hypervisor
• Isolation: Strong — guest OS boundary via hypervisor
• Key risks: VM escape, snapshot sprawl, stale "gold images," management plane exposure
• Controls: Hardened hypervisor; signed images with version control; least privilege to management APIs; consistent patch cadence; remove dormant snapshots

Containers

• What they are: App + libraries packaged together; shares the host OS kernel
• Isolation: Moderate — namespace/cgroups; weaker than a hypervisor boundary
• Key risks: Privileged containers, kernel CVEs, noisy-neighbour effects, weak registry hygiene
• Controls: Drop privileges; seccomp/AppArmor/SELinux profiles; image signing and scanning; read-only root filesystem; KMS-backed secrets management

Microservices

• What they are: Small, independent services communicating via APIs — no shared state
• Isolation: Logical API boundary — not a kernel or OS wall
• Key risks: Over-permissive service accounts, authn/authz gaps between services, SSRF, lateral movement via service mesh
• Controls: TLS service mesh (mTLS), zero trust between services, least-privilege scoped tokens, explicit API schemas, rate limits

Top Threat Actions and Mitigations

Host Protection Stack

• Antivirus / Anti-malware: Signature + heuristic detection. Only as good as updates and behaviour detection — don't rely on signatures alone.
• HIPS (Host Intrusion Prevention System): Blocks suspicious actions (buffer overflow, privilege escalation). Complements NIPS. Tune to reduce false positives.
• Host Firewall: Enforces inbound/outbound policy. Default-deny egress stops a surprising amount of C2 traffic.
• FIM (File Integrity Monitoring): Detects unauthorised file changes using cryptographic baselines. Point at logs, configs, and app binaries — wire alerts to incident response.
• Config/Policy Monitor: Detects drift from hardened baselines. Treat baselines as living artifacts; auto-revert when feasible.

Client and Mobile Risks and Controls

Client risks: physical loss, misuse, unapproved software, phishing clicks, locally stored secrets.

Mobile risks: loss/theft, weak access controls, unencrypted data, eavesdropping via MITM/fake APs, limited onboard security enforcement.

Controls That Actually Move Risk

• Patch/Update: OS, apps, firmware — automate the cadence.
• Network Controls: Segmentation; NIDS/NIPS; egress allowlists for SaaS.
• Endpoint Security: AV/EDR + HIPS + host firewall + full-disk encryption.
• Monitoring: Central logs + alerts (failed logins, suspicious child processes).
• User Education: Short, high-signal modules — phishing drills, USB hygiene.
• MDM for Mobile: Only managed devices get access; push policies; encrypt profiles; idle timeout and screen locks; remote wipe; camera/Bluetooth lockdown where sensitive; block jailbroken/rooted devices; geofencing for high-sensitivity roles.

Cloud Security — NIST, Models, and Reality

NIST Essential Characteristics of Cloud

• On-demand self-service
• Broad network access
• Resource pooling (multi-tenancy)
• Rapid elasticity
• Measured service

Cloud Service Models and Shared Responsibility

• IaaS: You own the guest OS, middleware, apps, config, and host firewalls. Provider owns physical hardware, hypervisor, core network. Common failures: missed OS patching, flat VPCs, public S3 equivalents.
• PaaS: You own your code, app config, limited runtime settings. Provider owns platform OS, middleware, and scaling fabric. Common failures: "compatible apps only" traps; implicit network trust within the platform.
• SaaS: You own tenant configs, roles, DLP rules, retention, and auth settings. Provider owns everything else. Common failures: over-permissive roles, weak MFA, data residency blind spots.

Cloud Deployment Models

• Private Cloud: Single organisation, more control and customisation, highest cost.
• Community Cloud: Shared by organisations with common needs — policy, compliance, mission.
• Public Cloud: Provider-owned, scalable and cost-effective, less infrastructure control.
• Hybrid Cloud: Ties two or more deployment models with standardised or proprietary technology. Move workloads to balance cost vs. control — sensitive writes stay private, burst read-only workloads go public.

CASB — Cloud Access Security Broker

CASB is your visibility and policy engine sitting between users/devices and cloud services.

• Discover: Shadow apps, usage patterns, unsanctioned data flows
• Protect: DLP, encryption, token governance
• Enforce: Access policies; monitor OAuth scopes; inline or API-mode deployment
• Detect: Threats across IaaS/PaaS/SaaS — Salesforce, Google Workspace, Azure, AWS

Neuromesh — Putting It Together

Virtualization and Containers

• Bare-metal hypervisors for production DB VMs — hardened, signed images, dormant snapshots removed
• Kubernetes: ban privileged containers; seccomp profiles; read-only root filesystems; AppArmor/SELinux; image signing + scanning before deploy; rotate secrets with managed KMS

Microservices

• Service-to-service mTLS with SPIFFE/SPIRE identities
• Replace wildcard tokens with scoped, short-lived JWTs; rate limiting and schema validation on every boundary

Endpoints

• Host firewalls default-deny egress; EDR + HIPS; FIM baselines restored
• Config monitor watches for "temporary exception" drift — creates a ticket and auto-reverts high-risk keys

Cloud and CASB

• Shadow SaaS discovered via CASB — either sanctioned with DLP and retention, or blocked
• IaaS: no flat networks; subnet segmentation; security groups default-deny; VPC egress via proxied gateways
• SaaS: phishing-resistant MFA; least-privileged roles; tenant audit logging to SIEM; data classification aligned to DLP

Cheat Sheet

Brain Ticklers