5.4 The attacks you will actually meet, and the defences

Work through these

• Denial of service and distributed denial of service; absorbing, rate limiting and the cost of being attacked

  Flooding a service until it cannot serve anyone is the oldest attack still working, and in the cloud the damage can be the bill rather than the outage. Absorbing, limiting and cost protection are three separate answers.

• Firewalls in the cloud: security groups, network firewalls and web application firewalls, and what each layer sees

  Instance-level rules, network-level rules and an application-aware filter each inspect a different amount of the traffic. Knowing what each layer can and cannot see is how you choose where to put a defence.

• Application security: injection, broken access control, and the dependency you did not audit

  Most breaches enter through the application rather than the infrastructure: unvalidated input, access control that is checked in the interface but not the backend, and a dependency nobody reviewed. This is where the majority of real incidents live.

• Virtual machine security: image provenance, patching, isolation and the escape scenario

  A machine is only as trustworthy as the image it started from and how promptly it is patched afterwards. The escape scenario, where code leaves its virtual machine, is rare and worth understanding as the boundary case.

• Data security: classification, encryption, access logging, and deletion that is actually deletion

  Knowing what data you hold, encrypting it, logging who touched it, and being able to genuinely delete it are four separate obligations. The last one is harder than it sounds once backups exist.