Protection of Information Assets · Topic 5 of 8
Cloud, Virtualization, Mobile, Wireless and IoT
Cloud service models and shared responsibility, virtualization and containers, mobile device management, WPA2 and WPA3 wireless security, and IoT.
- 3 min
- IaaS: customer manages the most; SaaS: the least, but always data and access.
- Misconfiguration is a leading cloud risk.
- Protect the hypervisor; control VM sprawl and images.
What it is
Cloud and virtualized environments run many workloads on shared infrastructure, moving some security responsibilities to a provider. Mobile, wireless and Internet of Things (IoT) devices extend the organization's network to places and things it does not fully control. Each brings risks that traditional data center controls do not cover.
How it works
Cloud service models
| Model | Provider manages | Customer manages |
|---|---|---|
| Infrastructure as a Service (IaaS) | Facilities, hardware, virtualization | Operating systems, applications, data, identities, network configuration |
| Platform as a Service (PaaS) | The above plus operating systems and runtime | Applications, data, identities |
| Software as a Service (SaaS) | Almost all of the stack | Data, user access and configuration of the service |
In every model the customer remains responsible for its data, who has access and how it configures the service. Many cloud breaches come from customer misconfiguration, such as publicly exposed storage.
Deployment models are public, private, community and hybrid cloud.
Cloud audit concerns
- Contract terms: security obligations, data location, breach notification, right to audit or independent assurance (for example SOC 2 or ISO/IEC 27001 certification), exit and data return.
- Configuration management and monitoring of the customer's own settings.
- Identity and access management, including MFA for administrators.
- Encryption and control of keys.
- Logging available to the customer.
- Data residency and legal jurisdiction.
Virtualization and containers
The hypervisor controls all virtual machines on a host, so its compromise affects every guest. Controls include patching and hardening the hypervisor, restricting management access, separating management networks, controlling VM sprawl (unmanaged virtual machines), and securing VM images and snapshots, which contain data. Containers share the host operating system kernel; images must come from trusted sources and be scanned for vulnerabilities.
Mobile devices
| Control | Purpose |
|---|---|
| Mobile device management (MDM) | Enforces passcodes, encryption, updates and configuration centrally |
| Remote wipe | Erases a lost or stolen device |
| Containerization | Separates corporate data from personal data on BYOD devices |
| App control | Limits installation to approved apps |
A bring your own device (BYOD) policy defines what personal devices may access and what the organization may do to them, such as wiping the corporate container.
Wireless security
- Use WPA3 or WPA2, with Enterprise mode (802.1X with individual credentials) for organizations. A shared passphrase cannot be revoked for one person.
- Older protocols such as WEP and WPA are weak and should not be used.
- Detect rogue access points and separate guest networks from internal ones.
- Hiding the network name (SSID) or filtering MAC addresses is weak on its own.
IoT devices
IoT devices often have default credentials, limited update support and weak security. Controls: inventory them, change defaults, place them on separate network segments, restrict their traffic, apply updates where possible and monitor their behavior.
In SaaS, the customer still owns user access and data. A question about a leaked SaaS file is usually about the customer's access management or sharing settings, not the provider's infrastructure.
How the exam asks about this
- "Who is responsible for data security in SaaS?" The customer, for its data and access.
- "A lost phone held customer data." MDM with encryption and remote wipe.
- "Smart building sensors share the corporate network." Segment them and restrict their traffic.
What to remember for the exam
- IaaS: customer manages the most; SaaS: the least, but always data and access.
- Misconfiguration is a leading cloud risk.
- Protect the hypervisor; control VM sprawl and images.
- MDM, encryption and remote wipe for mobile; containers for BYOD.
- WPA2 or WPA3 Enterprise for organizations; segment IoT.
Moving a system to the cloud does not move accountability. The organization still answers to regulators and customers for its data.
Common mistakes
Assuming the provider secures everything.
Using a shared Wi-Fi passphrase for staff.
Leaving IoT devices on the main network with default passwords.
Check yourself
In IaaS, who is responsible for patching the guest operating system?
The customer.
Why is WPA2 or WPA3 Enterprise preferred over a shared passphrase?
Each user has individual credentials, so access can be revoked per person and activity traced.
What is the main risk of a compromised hypervisor?
All virtual machines running on that host can be compromised.
Topic 5 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.