Cybersecurity Systems, Cloud, and Application Security Syllabus

What is a software supply chain attack?

An attack that compromises software indirectly by targeting a trusted third-party component, dependency, build pipeline, or vendor update mechanism (e.g., SolarWinds, malicious npm packages), so the malicious code is delivered through legitimate distribution.

What is a Software Bill of Materials (SBOM)?

A formal, machine-readable inventory of all components, libraries, and dependencies (with versions) that make up a piece of software, enabling organizations to track and respond to vulnerabilities in their dependencies.

What is Software Composition Analysis (SCA)?

A tool/process that scans a project's open-source and third-party dependencies to identify known vulnerabilities (CVEs), license risks, and outdated components, key to managing supply chain risk.

What is a typosquatting / dependency confusion attack?

Publishing malicious packages with names similar to popular ones (typosquatting) or with the same name as an internal package but a higher version in a public registry (dependency confusion), tricking build systems into pulling the attacker's code.

List the three primary cloud service models and what each provides.

IaaS (Infrastructure as a Service): virtualized compute, storage, networking (e.g., EC2). PaaS (Platform as a Service): runtime/dev platform without managing OS (e.g., App Engine). SaaS (Software as a Service): complete application over the web (e.g., Gmail).

Name the four cloud deployment models.

Public cloud (shared, provider-owned), Private cloud (dedicated to one organization), Hybrid cloud (interconnected public + private), and Community cloud (shared by organizations with common concerns).

What is the cloud Shared Responsibility Model?

A framework dividing security duties between the cloud provider and customer: the provider secures the cloud (physical infrastructure, hypervisor), and the customer secures what's in the cloud (data, access, configurations)—with the split varying by service model.

Under the shared responsibility model, how does customer responsibility differ across IaaS, PaaS, and SaaS?

Customer responsibility shrinks from IaaS to SaaS: in IaaS the customer manages OS, apps, and data; in PaaS the customer manages apps and data (provider handles OS/runtime); in SaaS the customer mainly manages data and user access. Data and identity are always the customer's responsibility.

What is cloud Identity and Access Management (IAM)?

The framework of policies and technologies ensuring the right identities (users, services) have appropriate access to cloud resources, using authentication, authorization, roles/policies, and enforcement of least privilege.

What is the principle of least privilege in cloud IAM?

Granting each identity only the minimum permissions necessary to perform its function, and no more, to limit the blast radius if credentials are compromised.

Why are IAM roles preferred over long-lived access keys for cloud workloads?

Roles provide temporary, automatically rotated credentials assumed for a task, eliminating long-lived static secrets that can be leaked, hard-coded, or stolen—reducing the risk and lifetime of credential exposure.

What is the most common root cause of cloud data breaches?

Cloud misconfiguration—such as publicly exposed storage buckets, overly permissive IAM policies, open security groups, and disabled logging—rather than provider infrastructure failures.

What is a Cloud Access Security Broker (CASB)?

A security policy enforcement point placed between cloud users and cloud services that provides visibility, data security (DLP), compliance, and threat protection, and helps discover shadow IT (unauthorized cloud usage).

What are the four pillars/capabilities of a CASB?

Visibility (discovering cloud usage/shadow IT), Compliance (meeting regulatory requirements), Data Security (DLP, encryption), and Threat Protection (detecting malware and anomalous behavior).

What is a hypervisor, and how do Type 1 and Type 2 differ?

A hypervisor is software that creates and runs virtual machines by abstracting hardware. Type 1 (bare-metal) runs directly on hardware (e.g., ESXi, Hyper-V)—more secure/performant; Type 2 (hosted) runs atop a host OS (e.g., VirtualBox)—larger attack surface via the host OS.

What is a VM escape attack?

An exploit where an attacker breaks out of an isolated guest VM to execute code on the underlying hypervisor or host, potentially compromising other VMs on the same host. It defeats the core isolation guarantee of virtualization.

What is VM sprawl and why is it a security risk?

The uncontrolled proliferation of virtual machines that outpaces management capacity, leading to unpatched, forgotten, or unmonitored VMs that expand the attack surface and violate configuration/patch baselines.

How does container isolation differ from VM isolation?

Containers share the host OS kernel and isolate at the process level using namespaces and cgroups (lightweight, faster, weaker isolation), while VMs each run a full guest OS on a hypervisor (heavier, stronger hardware-level isolation).

Name three Docker container security best practices.

Run containers as a non-root user; use minimal/trusted base images and scan them for vulnerabilities; drop unnecessary Linux capabilities and avoid the --privileged flag; keep images updated and don't embed secrets in images.

What is the risk of running a Docker container with the --privileged flag?

It grants the container nearly all host kernel capabilities and device access, effectively removing isolation and making container escape to the host trivial if the container is compromised.

What are Linux namespaces and cgroups in container security?

Namespaces isolate what a container can see (PIDs, network, mounts, users), providing separation between containers, while cgroups (control groups) limit and account for resource usage (CPU, memory), preventing resource-exhaustion DoS.

In Kubernetes, what is the role of RBAC?

Role-Based Access Control governs which subjects (users, service accounts) can perform which actions (verbs) on which resources within the cluster/namespace, enforcing least privilege on the Kubernetes API server.

What is the security purpose of Kubernetes Network Policies?

They define allowed pod-to-pod and pod-to-external network traffic (by default all pods can talk to each other), enabling micro-segmentation so that a compromised pod cannot freely reach other workloads.

Why is securing the Kubernetes etcd datastore critical?

etcd stores all cluster state and secrets, often in plaintext by default; if an attacker accesses etcd they can read all secrets and configuration and effectively control the cluster—so it must be encrypted at rest and access-restricted.

What are Kubernetes Secrets and a caveat about their default security?

Secrets are objects for storing sensitive data (passwords, tokens, keys). By default they are only base64-encoded (not encrypted) in etcd, so encryption at rest, RBAC restriction, and external secret managers should be used.

What is Mobile Device Management (MDM)?

A solution for centrally managing, securing, and enforcing policies on mobile endpoints—enabling configuration, app control, remote lock/wipe, encryption enforcement, and compliance monitoring across an organization's devices.

What is containerization in MDM (BYOD context)?

Separating corporate data and apps into an encrypted, policy-controlled container on a personal device, keeping business data isolated from personal data so IT can wipe corporate data without affecting the user's personal content.

Name two common mobile application security risks.

Insecure data storage (sensitive data stored unencrypted on the device), insecure/cleartext network communication, hard-coded secrets, improper platform usage, and reverse engineering/code tampering of the app.

What is app sandboxing on mobile platforms?

An OS-enforced isolation mechanism where each app runs in its own restricted environment with limited access to system resources and other apps' data, containing the impact of a compromised or malicious app.

Why are IoT and embedded devices particularly vulnerable, and name a famous IoT botnet?

They often ship with default/hard-coded credentials, lack update mechanisms, have weak/no encryption, and long unpatched lifespans with large deployment scale. The Mirai botnet, which enslaved IoT devices using default credentials to launch massive DDoS attacks, is a famous example.