Cloud Platform and Infrastructure Security · Topic 3 of 5
Risks to Cloud Infrastructure and Platforms
CCSP infrastructure risk: identification and analysis, qualitative and quantitative methods, cloud vulnerabilities, threats and attacks, and treatment.
- 5 min
- SLE equals asset value times exposure factor; ALE equals SLE times ARO.
- Qualitative is fast and subjective; quantitative supports cost decisions but needs data.
- Misconfiguration, weak IAM and insecure APIs dominate real cloud incidents.
What it is
Risk analysis for cloud infrastructure asks what could go wrong with the platform a workload runs on, how likely it is, and how much harm it would do. It then chooses a treatment for each risk.
The cloud changes the inputs. Some risks move to the provider, new ones arrive with shared infrastructure and the management plane, and the customer has less direct visibility to assess them.
How it works
Risk identification
Identify assets (workloads, data, accounts, keys), threats (who or what could cause harm), vulnerabilities (weaknesses they could exploit) and existing controls. Sources include threat intelligence, CSA Top Threats reports, provider security documentation and audit reports, past incidents and architecture reviews.
Risk analysis
| Method | How | Strength | Weakness |
|---|---|---|---|
| Qualitative | Rate likelihood and impact on scales such as low, medium, high | Fast, works without data | Subjective |
| Quantitative | Calculate monetary loss | Supports cost-benefit decisions | Needs reliable data |
| Semi-quantitative | Numeric scores on defined scales | Easier comparison | Numbers can look more precise than they are |
The quantitative formulas:
SLE = Asset value x Exposure factor
ALE = SLE x ARO
Example: asset $500,000, exposure factor 40%, one event every 4 years
SLE = 500,000 x 0.4 = $200,000
ARO = 0.25
ALE = 200,000 x 0.25 = $50,000 per yearA control costing less than the ALE reduction it brings is cost justified.
Cloud vulnerabilities
| Vulnerability | Example |
|---|---|
| Misconfiguration | Open storage, permissive network rules, logging turned off |
| Weak identity and access management | No MFA, overprivileged roles, long lived keys |
| Insecure interfaces and APIs | Unauthenticated management or application APIs |
| Shared technology flaws | Hypervisor or CPU vulnerabilities affecting co-resident tenants |
| Lack of visibility | Limited logs in SaaS, no access to provider infrastructure |
| Unpatched images | Old templates deployed with known vulnerabilities |
Threats and attacks
| Attack | Target | Description |
|---|---|---|
| Account hijacking | Management plane | Stolen credentials used to take over an account |
| VM escape | Hypervisor | Breaking from a guest to the host |
| Side channel | Shared hardware | Inferring another tenant's data through timing or cache behaviour |
| Denial of service | Network, APIs | Overwhelming services; elasticity can turn it into a cost attack |
| Economic denial of sustainability | Billing | Driving up consumption so the bill becomes unaffordable |
| Malicious insider | Provider or customer staff | Abuse of legitimate access |
| Abuse of cloud services | Provider resources | Attackers renting cloud capacity for attacks or mining |
| Ransomware | Storage and backups | Encrypting or deleting data and backups |
Infrastructure risk also includes non-malicious events: provider outages, regional disasters, provider business failure and changes in law where data is stored.
Risk treatment strategies
| Strategy | Meaning | Cloud example |
|---|---|---|
| Avoid | Stop the activity | Do not move a highly regulated workload to public cloud |
| Mitigate (reduce) | Apply controls | Add MFA, encryption and multi-zone design |
| Transfer or share | Move financial impact to another party | Cyber insurance; contract terms with the provider |
| Accept | Take the risk knowingly | Owner signs off on single region for a low value system |
Transfer moves financial consequences, not accountability. A provider breach of customer data remains the customer's problem with its regulator and customers.
Residual risk is what remains after treatment, and it must be within risk appetite and accepted by the risk owner.
Infrastructure risks by service category
The higher the service category, the less the customer can assess directly. In IaaS, customers can scan and test their own systems.
In SaaS, they rely almost entirely on the provider's reports, certifications and contract terms. This is why independent assurance is part of risk analysis in the cloud.
A worked example
A media company runs its streaming platform in one region of one provider. The risk register lists a regional outage as medium likelihood and high impact, with an estimated $1.2 million loss per day of downtime.
The analysis shows that a second region costs $300,000 a year. The ALE of regional outage is estimated at $600,000. The company mitigates by adding the second region for streaming, accepts the residual risk for its internal reporting system, and transfers part of the financial impact through insurance.
How the exam asks about this
- "An asset is worth $100,000, exposure factor 25%, and the event occurs twice a year. What is the ALE?" SLE $25,000 times ARO 2 equals $50,000.
- "Buying cyber insurance is an example of which treatment?" Risk transfer.
- "What risk arises when attackers drive up a victim's cloud consumption?" Economic denial of sustainability.
What to remember for the exam
- SLE equals asset value times exposure factor; ALE equals SLE times ARO.
- Qualitative is fast and subjective; quantitative supports cost decisions but needs data.
- Misconfiguration, weak IAM and insecure APIs dominate real cloud incidents.
- Treatments: avoid, mitigate, transfer or share, accept.
- Transfer moves financial impact, never accountability.
Elasticity changes denial of service. An attack that would once take a service offline can instead scale it up and send the customer a very large bill.
Common mistakes
Assuming the provider carries the risk. Contracts can share financial impact, but regulators and customers hold the data owner accountable.
Using only provider claims. Risk analysis needs independent evidence such as audit reports, not marketing statements.
Forgetting residual risk. Treatment rarely removes risk completely; what remains must be accepted by the owner.
Check yourself
What is exposure factor?
The percentage of an asset's value expected to be lost in a single occurrence of a threat event.
What is the difference between avoiding and accepting a risk?
Avoidance stops the activity that creates the risk, while acceptance continues the activity and knowingly takes the risk.
Why is risk analysis harder in SaaS than in IaaS?
The customer cannot test or inspect the provider's infrastructure, so it depends on reports, certifications and contract terms.
Topic 3 of 5 in Cloud Platform and Infrastructure Security
Test yourself on Cloud Platform and Infrastructure Security
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.