Assessing and mitigating vulnerabilities II: cloud, virtualization, containers, IoT, embedded and edge

The second half of sub-domain 3.5 covers the architectures that have reshaped computing in the past fifteen years: cloud services, virtualized systems, containers, microservices and serverless functions, the internet of things, embedded systems, high-performance computing and edge and fog computing. Each brings new efficiencies and new weaknesses. The common thread is that the attack surface moves: away from a single server room and toward identities, configurations, application programming interfaces and millions of small devices.

Cloud-based systems

Cloud computing, as defined by NIST in SP 800-145, has five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. It comes in three service models, infrastructure, platform and software as a service, and four deployment models: public cloud, open to many customers; private cloud, operated for one organization; community cloud, shared by organizations with common concerns such as government departments; and hybrid cloud, which combines them. Lesson 2 covered the shared responsibility model; here the focus is on what goes wrong.

The leading causes of cloud breaches are misconfiguration and weak identity, not exotic attacks on the provider. Storage left publicly readable, overly broad permissions for roles, administrator accounts without multifactor authentication, secrets embedded in code repositories, unmonitored application programming interfaces and logging turned off all recur in incident reports. Multi-tenancy adds the theoretical risk of one customer reaching another through a hypervisor or service flaw, which providers work hard to prevent. Other concerns include data location and sovereignty, lock-in to one provider, and the difficulty of forensic investigation when the customer does not control the hardware.

Controls start with identity: single sign-on, phishing-resistant multifactor authentication for administrators, least-privilege roles and short-lived credentials. Cloud security posture management tools continuously check configurations against benchmarks and flag drift. Infrastructure as code lets teams review and test configurations before deployment, and policy as code blocks non-compliant changes automatically. Encryption with customer-managed keys, private network endpoints, central logging and cloud workload protection complete the picture. A cloud access security broker, or CASB, sits between users and cloud services to give visibility and control over software-as-a-service use, including services adopted without approval, known as shadow IT.

Virtualized systems

Lesson 5 described hypervisors and their place in the trusted computing base. The vulnerabilities of virtualized environments include virtual machine escape, in which code in one guest breaks out to the hypervisor and can then reach other guests; virtual machine sprawl, where forgotten machines remain unpatched; snapshots and images that contain sensitive data or outdated software; weak separation of management interfaces; and resource exhaustion, where one guest starves others. Controls include patching hypervisors promptly, isolating management networks, hardening and scanning templates, controlling who can create and copy machines, and placing workloads of very different sensitivity on separate hosts or clusters.

Containers, microservices and serverless

Containers package an application with its libraries into an image that runs on a shared operating system kernel, isolated by kernel features such as namespaces and control groups. They start quickly and use fewer resources than virtual machines, but their isolation is weaker, because all containers on a host share one kernel; a kernel flaw or a container running with excessive privileges can expose the host. Images pulled from public registries may contain vulnerable packages or even malware. Orchestration platforms such as Kubernetes add their own attack surface: exposed dashboards, overly broad role-based access and secrets stored without encryption have all been exploited. Controls include using minimal, signed images from trusted registries, scanning images in the build pipeline, running containers as non-root with read-only file systems, applying network policies between pods, encrypting secrets and keeping the orchestrator patched and locked down.

Microservices break an application into many small services that communicate over the network through application programming interfaces. This makes development faster and scaling easier, but turns internal function calls into network traffic that must be authenticated, authorized and encrypted. Each service has its own dependencies to patch. Common patterns include an API gateway that handles authentication and rate limiting at the edge, a service mesh that provides mutual TLS and policy between services, and centralized logging with distributed tracing so that a request can be followed across dozens of services.

Serverless computing, or function as a service, runs small pieces of code in response to events without the customer managing any servers. The provider handles the operating system and scaling; the customer is responsible for the code, its dependencies, its permissions and the data it handles. Typical weaknesses are functions granted far more permissions than they need, injection through event data from queues or storage, insecure third-party libraries, secrets stored in plain environment variables and weak logging that hides attacks. Because functions are short-lived, traditional host-based security tools do not apply, so security moves into the build pipeline, identity policies and application monitoring.

Internet of things and embedded systems

The internet of things, IoT, connects everyday devices such as cameras, thermostats, door locks, medical devices and industrial sensors to networks. Embedded systems are computers built into larger devices to perform specific functions, often with limited processing power, memory and battery. Their weaknesses are well known: default or hard-coded passwords, no secure update mechanism, unencrypted communication, insecure cloud back ends, open debugging interfaces such as JTAG or serial ports, long lifetimes after vendor support ends and no way to install security software. The Mirai botnet in 2016 enslaved hundreds of thousands of cameras and routers that still used default passwords and used them for record-breaking denial-of-service attacks.

Governments now regulate some of these weaknesses. The United Kingdom's product security regime, in force since April 2024, bans universal default passwords and requires vendors to publish how long devices will receive security updates. In the United States, the FCC's voluntary Cyber Trust Mark program for consumer IoT was launched in 2025, and NIST guidance in its IR 8259 series sets baseline device capabilities; the status of the labeling program has been changing, so check current details. In Canada, the Canadian Center for Cyber Security publishes guidance for organizations and consumers on securing connected devices. Within organizations, controls include placing IoT devices on separate network segments, changing default credentials, disabling unused services, monitoring device traffic for unusual behavior, buying from vendors with a published vulnerability disclosure policy and support period, and planning to replace devices before support ends.

High-performance computing and edge and fog computing

High-performance computing, HPC, uses clusters of powerful nodes for scientific, engineering and artificial intelligence workloads. Clusters are often shared by many research groups, run specialized schedulers and file systems, and prioritize performance over security, which can mean flat internal networks and long-lived credentials. Their computing power also makes them attractive for cryptocurrency mining by attackers. A series of intrusions into European supercomputers in 2020 used stolen SSH credentials for exactly this. Controls include strong authentication for users and administrators, segmentation of management networks, monitoring of job and resource usage, and careful handling of sensitive research data.

Edge computing processes data close to where it is generated, such as in a factory, a cell tower or a retail store, to reduce delay and bandwidth. Fog computing describes a layer of intermediate nodes between edge devices and the cloud that aggregate and process data. Edge nodes are physically exposed, numerous and often unattended, so they need tamper resistance, secure boot, encrypted storage, remote management with strong authentication and the ability to keep operating safely if their connection to the cloud is lost.

Thinking like a manager

In cloud scenarios, the likely root cause is misconfiguration or weak identity, and the fix is usually stronger identity, least privilege and continuous configuration monitoring, owned by the customer. In container and serverless scenarios, look for answers that move security into the build pipeline and restrict permissions. In IoT scenarios, segmentation and vendor support commitments are key, and devices that affect safety come first.

A common thread

Across cloud, virtual, container, IoT and edge systems the same questions recur: who is responsible for each layer, how the asset is inventoried, how it is configured and patched, how identities and secrets are managed, and how isolation is enforced and monitored. Answering these consistently is more valuable than memorizing the details of any single platform, which change quickly.