Chapter 1 — Computing systems
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Starting the placement"]
N2["1.2 Hardware under the cloud"]
N3["1.3 Processes and programs"]
N4["1.4 Memory and storage"]
N5["1.5 Files and permissions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Starting the placement"]
N2["1.2 Hardware under the cloud"]
N3["1.3 Processes and programs"]
N4["1.4 Memory and storage"]
N5["1.5 Files and permissions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Starting the placement]
|
v
[1.2 Hardware under the cloud]
|
v
[1.3 Processes and programs]
|
v
[1.4 Memory and storage]
|
v
[1.5 Files and permissions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) describe the parts of a computer that a cloud service still depends on; (2) explain processes, memory and storage in plain terms; (3) connect these ideas to the hosting work Priya will see on placement.
1.1 Starting the placement
Priya Nair is a technologist student at the fictional Northgate Polytechnic. In her second week on placement at the fictional Cobalt Hosting, a small company that runs websites and booking systems for local businesses, a security advisory arrives about an old Node.js base image. Her mentor, Kwame Asante, asks which client workloads use it. Answering takes the team six hours of searching. This course follows Priya as she learns why that question was hard and how to make it easy.
1.2 Hardware under the cloud
Cloud computing, as defined in NIST SP 800-145, lets customers use pooled computing resources on demand. The resources are still physical machines with processors, memory, disks and network cards, owned and operated by a provider. Knowing this helps Priya understand that a cloud server is a share of real hardware, not something abstract. For Cobalt this matters in practice: when a provider retires an old hardware generation or schedules host maintenance, the client virtual machines and cluster nodes running on it must move or restart. Priya later sees that node upgrades and restarts are ordinary events, which is why nothing worth keeping should live only on one machine.
1.3 Processes and programs
A program is a file of instructions; a process is a running copy of it, with its own memory and permissions. A web server, a database and a backup job are separate processes. Security questions often start with which process is running, as which user, and with what access. On the client web server in the worked example, Priya applies exactly these questions to three processes: the web server, the scheduled report job and the log shipper. Asking which user each runs as is what exposes the report job's administrator account, a finding that a list of installed programs alone would never have shown.
1.4 Memory and storage
Memory holds working data and disappears when power is lost. Storage keeps data on disk. In cloud systems, a container's own disk is often temporary, so anything worth keeping must go to separate storage, such as a managed database or a storage bucket. The booking workload shows why this distinction matters for Cobalt's clients. If a container wrote appointment changes to its own disk, a restart or a move to another node would lose them. Riverside Dental's appointments therefore live in the managed database behind the API, and reports go to a storage bucket, so containers can be replaced at any time without losing data.
1.5 Files and permissions
Operating systems record who owns each file and who may read, write or run it. Mistakes here, such as a configuration file readable by everyone, are common causes of exposure. Permissions also apply to the accounts that processes run as, which is where file mistakes and process mistakes meet. A configuration file holding a database password is safe only if the process that needs it can read it and other users cannot. When Priya records what each process reads, she also notes the file's owner and mode, so a file readable by everyone stands out during review rather than after an exposure. Kwame asks her to treat the report job's administrator account the same way, because an administrator can read every file regardless of its mode.
Worked example
Kwame shows Priya a client's web server. She lists its processes and sees a web server, a scheduled report job and a log shipper. For each she records the user it runs as and what files it reads. The report job runs as an administrator account, which Kwame notes as something to fix later.
Synthetic case. Priya, Kwame, Cobalt Hosting and its clients are synthetic.
Errors and limits
Calling something "the cloud" can hide that it runs on real machines with real limits and owners.
Exercises
- EX001 — Placement trigger. What question took the Cobalt team six hours to answer? Rubric: 3 = which client workloads used the old Node.js image; 2 = names the advisory only; 1 = vague; 0 = none.
- EX002 — Process versus program. Explain the difference between a program and a process. Rubric: 3 = file of instructions vs running copy with memory and permissions; 2 = one correct; 1 = vague; 0 = none.
- EX003 — Temporary disks. Why should data worth keeping not stay on a container's own disk? Rubric: 3 = it is often temporary; use separate storage; 2 = partial; 1 = vague; 0 = none.
Synthesis
Cloud services still run on processes, memory, storage and permissions; security starts with knowing what runs and as whom.