◇ OpenCyber Academy
Bachelor's · Chapter 2 · English

Chapter 2 — Computing systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Computing systems

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Layers"]
  N2["2.2 Service models"]
  N3["2.3 Images and registries"]
  N4["2.4 Shared responsibility"]
  N5["2.5 Managed services"]
  N6["2.6 Mapping the case"]
  N7["Containers versus virtual machines"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Layers"]
  N2["2.2 Service models"]
  N3["2.3 Images and registries"]
  N4["2.4 Shared responsibility"]
  N5["2.5 Managed services"]
  N6["2.6 Mapping the case"]
  N7["Containers versus virtual machines"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Layers]
    |
    v
[2.2 Service models]
    |
    v
[2.3 Images and registries]
    |
    v
[2.4 Shared responsibility]
    |
    v
[2.5 Managed services]
    |
    v
[2.6 Mapping the case]
    |
    v
[Containers versus virtual machines]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) describe the layers of a cloud-hosted application; (2) explain virtual machines, containers and managed services; (3) identify who manages each layer; (4) relate layers to the opening case.

2.1 Layers

StudyHub runs on physical servers in the provider's data centres, virtualised into machines that form the Kubernetes worker nodes. Containers run on those nodes, each packaged from an image stored in a registry. Managed services provide the database, storage and identity.

Each layer has its own security settings. The opening case touched three of them: the registry's access rules, the content of an image and the logging of the account that held them. None involved the physical servers or the virtual machines, which is why Samuel's investigation focused on configuration rather than on the provider's infrastructure.

2.2 Service models

NIST SP 800-145 (Mell & Grance, 2011) defines infrastructure, platform and software as a service. Managed Kubernetes sits between infrastructure and platform: the provider runs the control plane; Westmere runs the workloads and their configuration.

The split determines who fixes what. If the control plane had a flaw, the provider would patch it. The workloads, their images and their access settings are Westmere's, so the open registry and the leaked connection string were Westmere's to find and fix. Samuel marks this boundary on every diagram he draws.

2.3 Images and registries

An image is a stack of file-system layers plus metadata. The registry stores images and controls who may pull or push them. Whatever goes into a layer stays there, which is why a connection string in records-api remained readable even after the application stopped using it.

Deleting the file in a later layer does not help, because earlier layers are still part of the image and can be extracted. Samuel demonstrates this to the team with a synthetic image: a secret added in one layer and removed in the next is still recoverable by unpacking the image's layers one at a time.

2.4 Shared responsibility

The AWS, Microsoft and Google shared responsibility pages agree that customers configure access to registries, storage and identities. The open registry was on Westmere's side.

The provider kept the registry service running and secure; it did not choose whether repositories allowed anonymous pull. That choice sat in a setting Westmere controlled. Samuel's summary for managers says this plainly, because some had assumed the provider would have prevented the exposure automatically. The same applied to audit logging: the provider offered it, but switching it on in each account was Westmere's job, and one account had been missed when it was created.

2.5 Managed services

Using a managed database removes patching work but leaves access rules, backups and encryption choices to the customer.

StudyHub's records database is managed, so the provider applies patches and runs the hardware. Westmere still decides who may connect, how long backups are kept, whether they are encrypted with its own key and which network can reach the database. The test database's network rule, a customer setting, is what stopped the leaked connection string from being useful outside. Samuel lists these choices for each managed service StudyHub uses.

2.6 Mapping the case

Samuel draws StudyHub's layers and marks who manages each, then marks where the opening findings sat: registry settings, image content and account logging, all customer-managed.

Seeing all three findings in the customer-managed part of the drawing changed the conversation with managers. The question became which Westmere team owned each setting and how it would be checked, rather than whether the provider had failed. Each finding now has a named owner on the drawing. The drawing is kept with the team's documentation and updated when a service is added.

Containers versus virtual machines

A virtual machine includes a whole operating system, while a container shares the node's kernel and packages only the application and its libraries. Containers start quickly and pack densely, which suits StudyHub's many small services, but their isolation depends on kernel features and careful settings.

Worked example

The layer drawing surprises some university managers, who assumed the cloud provider handled registry security. Tom uses it in a briefing to explain why Westmere's cloud team must own these settings.

Synthetic case. Systems are synthetic.

Errors and limits

Responsibility boundaries differ between services; check each service's documentation.

Exercises

Synthesis

Know the layers and who manages each.

Continue studying — chapter 02 of 40

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →