Cloud Security Operations · Topic 1 of 6
Building Physical and Logical Cloud Infrastructure
CCSP building cloud infrastructure: HSM and TPM settings, secure by default, management plane tools, virtual hardware, hypervisor types and guest tools.
- 5 min
- HSMs store and use keys in tamper resistant hardware; TPMs anchor boot integrity and attestation.
- Secure by default: services off, encryption and logging on, no default passwords.
- Management plane tools go on an isolated network with MFA and full logging.
What it is
Building cloud infrastructure means turning hardware and software into a secure platform: configuring hardware security modules and trusted platform modules, installing management plane tools, setting secure virtual hardware and hypervisor options, and installing guest OS toolsets.
This is mostly the provider's job in public cloud, and the organization's job in private cloud. Customers building IaaS environments face the same decisions at the virtual layer.
How it works
Hardware specific security configuration
| Device | What it is | Configuration concerns |
|---|---|---|
| HSM (hardware security module) | Tamper resistant device that generates, stores and uses cryptographic keys | FIPS 140-3 level, role separation for administrators, quorum (M of N) control for sensitive operations, backups of key material, clustering for availability |
| TPM (trusted platform module) | Chip on the server board that stores keys and measurements of the boot process | Enabled and owned, used for measured or secure boot, sealing keys to a known good state, attestation to remote services |
A TPM proves a host booted the expected firmware, bootloader and hypervisor. A management system can then refuse to place workloads on hosts that fail attestation. HSMs protect master keys for the provider's KMS or are offered to customers as dedicated devices.
Secure by default
Secure by default means a system is secure as shipped, without the customer having to change anything: services off unless needed, strong authentication on, encryption on, logging on, default passwords removed. Builds start from hardened templates and baselines such as CIS Benchmarks, and deviations need approval.
Installation and configuration of management plane tools
The management plane controls the whole environment, so its tools need:
- A separate, isolated management network.
- MFA and role based access with least privilege.
- Hardened servers or appliances, patched promptly.
- Logging of every administrative action to a protected location.
- Backups of configuration, and redundancy so management survives a host failure.
- Verified installation media, checked by hash or signature.
Virtual hardware specific security configuration
| Resource | Secure configuration |
|---|---|
| Network | Separate virtual switches or VLANs for management, storage, live migration and tenant traffic; disable promiscuous mode and MAC address changes unless required |
| Storage | Encrypt virtual disks; isolate storage networks; restrict who can attach or snapshot disks |
| Memory | Set reservations and limits; be aware of memory sharing features that could enable side channels between tenants |
| CPU | Use reservations and limits; apply microcode and hypervisor fixes for CPU side channel flaws |
| Removable and unused devices | Remove virtual CD drives, USB and serial ports that guests do not need |
Hypervisor type 1 and type 2
| Type | Runs on | Security position |
|---|---|---|
| Type 1 (bare metal) | Directly on hardware | Small attack surface; used for cloud hosts |
| Type 2 (hosted) | On a general purpose OS | Inherits the host OS's vulnerabilities; suits labs and desktops |
Harden the hypervisor itself: minimal install, management interfaces on the management network only, secure boot, and timely patches.
Installation of guest OS virtualization toolsets
Guest toolsets are drivers and agents installed inside virtual machines to improve performance and let the hypervisor manage the guest: time synchronization, clean shutdown, better network and disk drivers, and status reporting.
Security points:
- Install them only from the trusted vendor source and keep them patched.
- Enable only the features needed; disable shared folders and copy and paste between host and guest in production.
- Remember they create a channel between guest and hypervisor, which is an attack surface.
Build verification
After building, verify against the baseline with automated configuration scans, confirm TPM attestation passes, and record the build in the configuration management database.
A worked example
A government agency builds a private cloud. Its plan uses type 1 hypervisors on servers with TPMs enabled for measured boot. Management interfaces sit on a dedicated network reached only through a jump host with MFA.
Master keys for the agency's KMS live in a clustered pair of HSMs validated to FIPS 140-3 Level 3, with key ceremonies needing three of five custodians. Virtual machine templates remove unused virtual devices, and guest tools are installed from the vendor repository with shared folders disabled.
How the exam asks about this
- "Which component lets a management system verify that a host booted trusted firmware?" The TPM, through measured boot and attestation.
- "What does secure by default mean?" Systems are secure in their delivered state, without extra configuration by the customer.
- "Which hypervisor type has the smallest attack surface?" Type 1, bare metal.
What to remember for the exam
- HSMs store and use keys in tamper resistant hardware; TPMs anchor boot integrity and attestation.
- Secure by default: services off, encryption and logging on, no default passwords.
- Management plane tools go on an isolated network with MFA and full logging.
- Separate virtual networks for management, storage, migration and tenant traffic.
- Guest toolsets help management but are an attack surface; keep them minimal and patched.
Quorum control on an HSM is a safeguard, not a formality. If one administrator can export or destroy master keys alone, the HSM's protection depends on a single person.
Common mistakes
Confusing HSM and TPM. An HSM is a dedicated key management appliance; a TPM is a chip on each host for platform integrity.
Putting management interfaces on tenant networks. Any tenant compromise then gives attackers a path to the control layer.
Leaving convenience features on. Shared folders and clipboard sharing between host and guest are useful in labs and risky in production.
Check yourself
What does TPM attestation provide?
Evidence, based on boot measurements stored in the TPM, that a host started with expected firmware and software.
Why should live migration traffic be on its own network?
Migration transfers virtual machine memory, which can contain sensitive data, so it must be isolated from tenant and other traffic.
What are guest OS virtualization toolsets?
Drivers and agents installed in a virtual machine that improve performance and let the hypervisor manage the guest, such as time sync and clean shutdown.
Topic 1 of 6 in Cloud Security Operations
Test yourself on Cloud Security Operations
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.