Cloud Security Operations · Topic 2 of 6
Operating Access, Network and Host Security
CCSP cloud operations: RDP, SSH, jumpboxes and console access, VLAN, TLS, DHCP, DNSSEC and VPN, firewalls, IDS, IPS, honeypots, OS hardening and patches.
- 5 min
- Never expose RDP or SSH directly to the internet; use bastions, MFA and logging.
- DNSSEC gives origin authentication and integrity, not encryption.
- IDS detects; IPS blocks inline; honeypots are isolated decoys.
What it is
Once infrastructure is running, it must be kept secure every day. That means controlling how administrators reach systems, configuring network services securely, operating network security controls, keeping operating systems hardened, and patching them on time.
These are familiar tasks, but the cloud changes the tools: security groups instead of hardware firewalls, bastion hosts instead of physical consoles, and image rebuilds instead of manual patching.
How it works
Access controls for local and remote access
| Method | Use | Secure practice |
|---|---|---|
| RDP | Graphical remote access to Windows | Never expose to the internet; require network level authentication and MFA; reach through a gateway or bastion |
| SSH | Command line access to Linux and network devices | Key based or certificate based authentication, no root login, no password authentication |
| Secure terminal access | Browser or agent based shell provided by the platform | Removes open inbound ports; access logged and tied to identity |
| Console based access | Provider console or out of band serial console | Highly privileged; restrict to break glass use with MFA |
| Jumpbox or bastion | Hardened host that is the only path into private networks | Minimal software, MFA, session recording, short lived access |
| Virtual client | Virtual desktop used for admin work | Keeps admin tools off personal devices |
| SSO | One identity for all admin access | Central control, MFA and fast revocation |
Just in time access, where admin rights are granted for a limited period after approval, reduces standing privilege.
Secure network configuration
| Service | Security role | Secure practice |
|---|---|---|
| VLAN | Separates traffic at layer 2 | Separate management, storage and tenant traffic; VLANs alone are not strong isolation |
| TLS | Encrypts traffic in transit | TLS 1.2 or 1.3 only, strong cipher suites, valid certificates |
| DHCP | Assigns IP addresses | Protect against rogue DHCP servers, for example with DHCP snooping; reserve addresses for servers |
| DNSSEC | Signs DNS records so resolvers can verify origin and integrity | It does not encrypt queries; it stops spoofed or tampered answers |
| VPN | Encrypted tunnel between sites or users and the cloud | IPsec or TLS VPNs with strong authentication; split tunneling decisions documented |
Network security controls
| Control | What it does |
|---|---|
| Firewalls | Filter traffic by rules; next generation firewalls add application awareness |
| IDS | Detects and alerts on suspicious traffic; passive |
| IPS | Sits inline and blocks detected attacks; can cause outages on false positives |
| Honeypots | Decoy systems that attract attackers so their methods can be studied; no legitimate user should touch them |
| Vulnerability assessments | Regular scans for known weaknesses in hosts and networks |
| Network security groups | Stateful filtering rules attached to instances, interfaces or subnets |
| Bastion host | Hardened single entry point for administrative access |
| Segmentation | Splitting networks into zones so a breach in one cannot spread freely |
A honeypot must be isolated so attackers cannot use it to pivot to real systems. Using it to lure and then attack the attacker back is not acceptable.
OS hardening through baselines, monitoring and remediation
Hardening follows a cycle:
- Baseline: adopt a standard such as a CIS Benchmark for Windows, Linux or VMware ESXi, adjusted to the organization.
- Apply: build images that meet the baseline; remove unneeded services, accounts and software.
- Monitor: scan running systems for drift from the baseline.
- Remediate: fix drift, preferably by replacing the instance with a compliant image.
Examples: disable SMBv1 and unused services on Windows; disable root SSH login and unneeded daemons on Linux; disable unused services and restrict management access on VMware hosts.
Patch management
| Step | Cloud practice |
|---|---|
| Identify | Monitor vendor advisories and scanner results |
| Assess | Prioritize by severity, exploitation and exposure |
| Test | Apply to non-production first |
| Deploy | Roll out through change management, ideally by rebuilding images |
| Verify | Confirm patch level by scanning |
| Document | Record in the CMDB and change records |
In PaaS and SaaS the provider patches its layers; the customer patches its code and dependencies. In IaaS the customer patches the guest OS.
A worked example
A security review of an IaaS environment finds RDP and SSH open to the internet on dozens of servers, with password login allowed. Several servers have drifted from the baseline and missed months of patches.
The team closes inbound management ports, deploys a bastion with SSO and MFA, and switches SSH to certificate authentication. Images are rebuilt monthly from a CIS based baseline, drift is scanned daily, and critical patches are deployed within the window set in policy.
How the exam asks about this
- "What is the MOST secure way for administrators to reach servers in a private cloud subnet?" Through a hardened bastion host or platform session service with MFA and logging.
- "What does DNSSEC protect against?" Spoofed or tampered DNS responses; it does not provide confidentiality.
- "Which control detects attacks but does not block them?" An IDS.
What to remember for the exam
- Never expose RDP or SSH directly to the internet; use bastions, MFA and logging.
- DNSSEC gives origin authentication and integrity, not encryption.
- IDS detects; IPS blocks inline; honeypots are isolated decoys.
- Harden with a baseline, monitor drift and remediate by rebuilding.
- Patch through change management, test first and verify afterwards.
An IPS in blocking mode can stop legitimate traffic. Tune it in detection mode first, and treat rule changes as production changes.
Common mistakes
Treating VLANs as security boundaries. They separate traffic but are not strong isolation on their own.
Assuming DNSSEC encrypts DNS. It only signs records.
Patching instances by hand. Manual patching leads to drift; rebuilding from patched images is more reliable.
Check yourself
What is the role of a bastion host?
It is a hardened single entry point through which administrators reach systems in private networks, with strong authentication and logging.
What is the difference between an IDS and an IPS?
An IDS monitors and alerts on suspicious traffic, while an IPS sits inline and can block it.
Why are baselines needed for OS hardening?
They define the approved secure configuration, so systems can be built to it and checked for drift.
Topic 2 of 6 in Cloud Security Operations
Test yourself on Cloud Security Operations
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.