Cloud-specific security considerations

If you are spinning up virtual machines in any of the major clouds with their default images, there are a few things to consider from a security point of view:

• Some clouds have auto-updates enabled; some do not. However, everyone's image for every OS is always somewhat out of date. After you spin up a VM, you will need to update it, the same as you would a standalone host.
• Most cloud service images also have a host firewall, enabled in some restrictive mode. What these two firewall issues mean for you is, when you bring up your first, fresh Linux VM, don't expect to be able to "ping" it until you've had a peek at the host firewall configuration (remember from the last chapter – be sure to check both iptables and nftables).
• Many cloud service images will by default allow remote access directly for administrative access from the public internet. In the case of Linux, this means SSH over tcp/22. While...