Cloud Platform and Infrastructure Security · Topic 1 of 5
Cloud Infrastructure and Platform Components
CCSP cloud infrastructure components: physical environment, network and communications, compute, virtualization, storage and the management plane.
- 5 min
- The six components: physical environment, network and communications, compute, virtualization, storage, management plane.
- SDN separates control and data planes and is programmed through APIs.
- Reservations guarantee minimums, limits cap maximums, shares set priority.
What it is
Every cloud service runs on the same layers: a physical environment of buildings and hardware, networks connecting it, compute that runs workloads, virtualization that shares compute among tenants, storage that keeps data, and a management plane that controls it all.
Knowing each layer, who secures it and what can go wrong, is the base for every infrastructure question.
How it works
Physical environment
Data centers, power, cooling, racks, servers and cabling. The provider owns all of it in public cloud. Customers rely on the provider's audit reports for evidence of physical security, because they cannot inspect it themselves.
Scale is the defining feature: providers run very large numbers of identical servers, so failures are routine and are handled by automation rather than by repairing individual machines.
Network and communications
| Element | Role |
|---|---|
| Physical network | Switches, routers and links run by the provider |
| Software defined networking (SDN) | Separates the control plane (decisions) from the data plane (forwarding) so networks are programmed through APIs |
| Virtual networks | Customer defined address spaces, subnets and route tables, isolated from other tenants |
| Gateways and connectivity | Internet gateways, VPNs and dedicated private links to customer sites |
SDN makes network controls programmable, which allows automation but also means a misconfigured API call can expose a network instantly. Customers usually cannot run traditional packet sniffing on shared networks and rely on flow logs and traffic mirroring offered by the provider.
Compute
Compute is processing and memory, offered as virtual machines, containers or serverless functions. Key concerns are reservations (guaranteed minimum resources), limits (maximum a tenant can consume) and shares (priority when resources are contended), which together stop one tenant starving others. Bare metal instances give a customer a whole server, removing the shared hypervisor but not the shared facility.
Virtualization
| Hypervisor | Runs on | Example use | Security note |
|---|---|---|---|
| Type 1 (bare metal) | Directly on hardware | Cloud provider hosts | Smaller attack surface; the standard for cloud |
| Type 2 (hosted) | On a host operating system | Desktop labs | Host OS adds attack surface |
Virtualization risks include VM escape (a guest breaks out to the hypervisor), VM sprawl (unmanaged machines), insecure images, side channel attacks between co-resident tenants, and inactive images that miss patches. Containers add shared kernel risk and need orchestration security.
Storage
Providers build storage from large pools of disks, presented as volume (block), object and file storage, plus managed databases. Data is replicated or erasure coded across devices and zones. Customers control access policies and encryption; providers control durability and physical sanitization.
Management plane
The management plane is the set of consoles, APIs and tools used to provision, configure and control all other layers. The provider has its own management plane for the whole platform; each customer gets a scoped management plane for its account.
| Risk | Control |
|---|---|
| Stolen administrator credentials | Phishing resistant MFA, no long lived keys, conditional access |
| Excessive permissions | Least privilege roles, separate duties, just in time elevation |
| Unmonitored changes | Management plane audit logging sent to a separate account |
| API abuse | Rate limits, authentication on every call, alerting on unusual activity |
Whoever controls the management plane controls compute, network and storage. It is the single most important component to protect.
Who secures which layer
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Physical, network hardware, hypervisor | Provider | Provider | Provider |
| Virtual network configuration | Customer | Shared | Provider |
| Compute instance and guest OS | Customer | Provider | Provider |
| Storage access and encryption settings | Customer | Customer | Mostly provider; customer sets sharing |
| Customer management plane accounts | Customer | Customer | Customer |
A worked example
An attacker steals a long lived access key from a developer's laptop. The key belongs to an identity with full administrative rights in the company's IaaS account. Within an hour the attacker launches crypto mining instances in several regions and deletes backups.
The root cause is a management plane failure, not a compute flaw. Remediation is removing long lived keys in favour of short lived federated credentials with MFA, restricting regions the account can use, separating backup administration into a different account, and alerting on instance launches outside normal patterns.
How the exam asks about this
- "Which hypervisor type is used by cloud providers to minimize attack surface?" Type 1, bare metal.
- "What separates the control plane from the data plane in cloud networking?" Software defined networking.
- "Which mechanism guarantees a tenant a minimum amount of compute resource?" A reservation.
What to remember for the exam
- The six components: physical environment, network and communications, compute, virtualization, storage, management plane.
- SDN separates control and data planes and is programmed through APIs.
- Reservations guarantee minimums, limits cap maximums, shares set priority.
- Type 1 hypervisors run on hardware; type 2 run on a host OS.
- The management plane is the highest value target in any cloud.
VM escape and side channel attacks are the provider's problem to prevent, but the customer chooses the risk. For the most sensitive workloads, dedicated hosts or bare metal reduce co-residency risk.
Common mistakes
Securing instances but not the console. Hardened servers do not help if the account that controls them is protected only by a password.
Expecting packet capture everywhere. In shared cloud networks customers usually rely on flow logs and provider mirroring features.
Mixing up limits and reservations. A limit stops a tenant taking too much; a reservation guarantees it gets enough.
Check yourself
What is the management plane?
The consoles, APIs and tools used to provision, configure and control the cloud's compute, network and storage resources.
What is VM escape?
An attack in which code in a guest virtual machine breaks out to the hypervisor, potentially reaching other guests on the same host.
What does a share do in cloud compute?
It sets a tenant's relative priority for resources when they are contended between tenants.
Topic 1 of 5 in Cloud Platform and Infrastructure Security
Test yourself on Cloud Platform and Infrastructure Security
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.