2.1.3. Infrastructure: Serverless, Virtualization, and Containers
💡 First Principle: Each infrastructure abstraction layer changes the attack surface and visibility model — what you can monitor, what logs exist, and where attackers can hide all depend on whether the workload runs on metal, a VM, a container, or a function.
Modern environments are rarely purely one type. A typical enterprise runs virtual machines in on-premises data centers, containers orchestrated by Kubernetes in cloud, and serverless functions for event-driven workloads — all feeding logs (if properly configured) into a central SIEM.
Virtualization runs multiple OS instances on shared physical hardware via a hypervisor. From a security standpoint: VM escape (a guest VM attacking the hypervisor or other guests) is rare but severe. More commonly, attackers target the management plane — vCenter, ESXi management interfaces — which can compromise every VM on the host if accessed. Each VM should be monitored as an independent endpoint; the hypervisor host itself needs its own monitoring.
Containerization packages applications and their dependencies into isolated units that share the host OS kernel. Docker and Kubernetes are the dominant technologies. Security concerns:
- Container images with vulnerable dependencies (container scanning tools like Trivy address this)
- Containers running as root (privileged containers can escape to the host)
- Misconfigured Kubernetes RBAC (overly permissive service accounts)
- Lateral movement through shared network namespaces
Serverless (AWS Lambda, Azure Functions, Google Cloud Functions) runs code in ephemeral compute instances that spin up on demand and disappear after execution. Security implications: no persistent server to harden or monitor with traditional agents; security depends on IAM role permissions (over-permissive roles are the primary attack vector) and cloud-native logging (CloudTrail, Azure Monitor) rather than endpoint agents.
⚠️ Exam Trap: Traditional endpoint detection and response (EDR) agents cannot run inside serverless functions — they're ephemeral and have no persistent OS to install on. Serverless security relies entirely on cloud-native logging, IAM controls, and code-level security practices.
Reflection Question: An attacker compromises a Kubernetes cluster by exploiting an overly permissive service account token stored in a pod. Why does this single compromise potentially give them access to far more than just that one container?
