Digital Infrastructure & Cloud Providers
Build Digital Foundations That Stay Sovereign and Resilient.
Security for data center, cloud and digital platform providers facing concentration risk, supply-chain exposure and residency mandates.
Executive Summary
- 01Provider risk concentrates in shared layers such as the control plane, identity, build pipelines and backup, so security effort should follow the number of tenants each layer can reach.
- 02Residency obligations require evidence about where data, replicas, logs and encryption keys live, not just where the primary region sits.
- 03Resilience for providers means tested recovery of shared services within tolerances the business has defined, backed by evidence that can be shown to regulators.
DIGITAL INFRASTRUCTURE · Risk Drivers
Concentration risk, supply chain and data residency mandates.
In Depth
Security in Digital Infrastructure & Cloud Providers, Explained
Concentration Risk Starts at the Control Plane
A provider's control plane holds the power to create, change and delete every tenant resource. Management APIs, orchestration systems, identity services and hypervisor tooling all sit there. An attacker who gains administrative reach into that layer does not need to breach tenants one by one. Security work therefore begins by mapping which systems can act across tenant boundaries, who holds that authority, and how each action is authenticated and logged. Privileged access is narrowed, time-bound and recorded. Segmentation separates management networks from tenant traffic. The goal is to shrink the blast radius so that one stolen credential or flawed component cannot reach every customer.
Supply Chain Exposure Beyond Your Own Code
Providers depend on firmware, hardware, open-source packages, build pipelines and managed vendors. Each is a way in. Supply-chain security treats these dependencies as part of the attack surface. Teams keep an inventory of components and suppliers, verify the integrity of software before it reaches production, and sign artifacts built in controlled pipelines. Vendor access to facilities and systems is limited, supervised and reviewed. Contracts state security obligations and notification duties. Detection covers unexpected changes in build output, new maintainer behavior and unusual outbound connections from infrastructure hosts. The aim is to find a tampered dependency before it becomes a trusted part of the platform.
Proving Residency of Data and Keys
Residency is a claim that must be demonstrated. Storing data in a local region is not enough if replicas, backups, logs or support tooling move it elsewhere. Encryption keys matter just as much, because whoever controls the keys controls access. Proof starts with a data-flow map covering primary storage, replication, backup, telemetry and administrative access paths. Keys are generated and held in hardware-backed modules within the jurisdiction, with policies that block export. Evidence is collected continuously: configuration state, key-usage logs and access records. Auditors and regulators can then be shown how placement is enforced rather than simply promised.
A residency claim without evidence of where data and keys actually live is a promise, not assurance.
Threat Scenarios
What It Looks Like in Practice
Stolen Administrator Credential
How It Shows Up
Management API calls arrive from unfamiliar locations or at unusual hours, followed by new access keys or role changes.
Response
Revoke sessions, enforce just-in-time elevation and review every action taken under the credential to confirm which tenants were reachable.
Tampered Software Dependency
How It Shows Up
A build produces artifacts that differ from known baselines, or an infrastructure host contacts an unknown external address after an update.
Response
Quarantine the pipeline, verify signatures on deployed versions and roll back to known-good artifacts while the supplier is notified.
Residency Breach Through Backup or Support
How It Shows Up
A review finds backup replicas or log archives outside the permitted jurisdiction, or support staff reaching tenant data from abroad.
Response
Stop the transfer, relocate or delete the copies, rotate affected keys and document the event for regulators and customers as obligations require.
Ransomware on Shared Storage
How It Shows Up
Mass file modification, rising storage latency and failed replication suggest encryption of a shared storage tier.
Response
Isolate affected segments, fail critical services over using tested runbooks and restore from immutable backups in priority order.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Stolen Administrator Credential | Management API calls arrive from unfamiliar locations or at unusual hours, followed by new access keys or role changes. | Revoke sessions, enforce just-in-time elevation and review every action taken under the credential to confirm which tenants were reachable. |
| Tampered Software Dependency | A build produces artifacts that differ from known baselines, or an infrastructure host contacts an unknown external address after an update. | Quarantine the pipeline, verify signatures on deployed versions and roll back to known-good artifacts while the supplier is notified. |
| Residency Breach Through Backup or Support | A review finds backup replicas or log archives outside the permitted jurisdiction, or support staff reaching tenant data from abroad. | Stop the transfer, relocate or delete the copies, rotate affected keys and document the event for regulators and customers as obligations require. |
| Ransomware on Shared Storage | Mass file modification, rising storage latency and failed replication suggest encryption of a shared storage tier. | Isolate affected segments, fail critical services over using tested runbooks and restore from immutable backups in priority order. |
Regulatory & Operational Challenges
Providers carry concentrated risk: one compromise can affect every tenant.
Data residency mandates require proof that workloads and keys stay in jurisdiction.
Relevant DAAKYI Capabilities
Services for Digital Infrastructure & Cloud Providers
Delivery Approach
Priority Capabilities Across GUIDE, SECURE and OPERATE
GUIDE
CII assurance, resilience planning.
SECURE
Secure cloud, key management.
OPERATE
24/7 SOC, recovery on DAAKYI Cloud.
Methodology
The Method, Step by Step
- 1
Map Shared Dependencies
Catalog every system, supplier and administrative path that touches more than one tenant. Identify the shared control plane, identity provider, build pipeline, backup service and support tooling. Rank them by how many customers a failure would reach. This ranking drives every later priority and shows where concentration risk actually sits.
- 2
Trace Data and Keys
Follow regulated data from ingestion to deletion across storage, replication, backup, logging and support access. Record where each copy lives and which keys protect it. Compare the result with applicable residency and privacy obligations, including the Ghana Data Protection Act, 2012 and sector directives. Gaps become tracked findings with owners and dates.
- 3
Engineer Layered Controls
Apply controls where the ranking shows the greatest reach. Harden the control plane, enforce multifactor and just-in-time privileged access, segment management networks, encrypt with tenant-scoped keys and sign build artifacts. Design for failure by assuming any single layer can be bypassed and placing a second control behind it.
- 4
Test Detection and Recovery
Run adversary simulations against the control plane and exercise recovery from loss of a region, a corrupted key store or a compromised pipeline. Measure whether detections fire and whether services return within the tolerances the business set. Findings feed back into engineering, detection rules and the continuity plan.
- 5
Evidence and Govern
Turn operating controls into standing evidence: configuration snapshots, key logs, access reviews, test results and incident records. Report residual risk to executives against defined tolerances. Review after major changes, supplier changes and regulator guidance so the assurance position stays current rather than aging between audits.
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Shared‑Dependency Map | Shows which systems and suppliers can affect multiple tenants and ranks them by reach. |
| Data and Key Residency Register | Records where regulated data, replicas, logs and keys live and which obligations apply to each. |
| Tenant Isolation Test Report | Documents whether segmentation, hypervisor hardening and per-tenant encryption held under adversary simulation. |
| Critical Service Recovery Plan | Defines recovery order, tolerances and runbooks for shared services such as identity, storage and the control plane. |
| Regulator‑Ready Evidence Pack | Assembles configuration state, key logs, access reviews and test results for audits and Critical Information Infrastructure reviews. |
| Role | Responsibility |
|---|---|
| Chief Information Security Officer (Client) | Sets risk tolerance for shared layers and owns the decision to accept or fund remediation of concentration risk. |
| Platform Engineering Lead (Client) | Implements isolation, segmentation and signed-build controls in the control plane and delivery pipelines. |
| Data Protection Officer (Client) | Confirms that data flows, retention and cross-border access match privacy and residency obligations. |
| Security Operations Analyst (Provider) | Monitors management-plane and host telemetry, investigates anomalies and escalates suspected tenant-spanning activity. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Reactive
Controls are applied per tenant or per project, and nobody can list which shared systems carry the most risk. Residency is asserted from region settings alone.
Stage 2
Defined
Shared dependencies are inventoried and privileged access is restricted. Data-flow maps exist, though evidence is gathered by hand before audits.
Stage 3
Managed
Isolation, key custody and detection are tested on a schedule. Evidence is collected continuously and recovery exercises measure real tolerances.
Stage 4
Adaptive
Architecture changes are reviewed for concentration impact before release. Supplier changes, regulator guidance and test findings update controls without waiting for an audit cycle.
Frameworks and Regulation
The Standards That Shape This Work
NIST CSF 2.0
Its six functions (Govern, Identify, Protect, Detect, Respond, Recover) give providers a structure for ownership of concentration risk, shared-layer protection and recovery. The Govern function suits board-level tolerance setting.
ISO/IEC 27001:2022
Annex A contains 93 controls, which are grouped into four themes: organizational, people, physical, and technological. For data centers, the physical and technological themes matter most, and ISO/IEC 27002:2022 provides guidance on how to implement them.
Ghana Cybersecurity Act, 2020 (Act 1038)
It provides for the designation and protection of Critical Information Infrastructure and for incident reporting, both relevant to providers whose services support national functions.
ISO 22301
This business continuity standard supports defining recovery priorities and tolerances for shared services and testing them through exercises.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for a provider that can describe how it limits blast radius in a shared control plane, not only how it protects individual tenants.
- Look for key management designs that keep root keys and key backups inside the required jurisdiction with separation of duties.
- Look for recovery exercises that cover loss of identity, storage and key services, not just application restores.
- Look for evidence practices that produce logs, configuration records and test results on demand for regulators and customers.
Questions to ask a provider
- Which of your systems can act across tenant boundaries, and how is that access approved and recorded?
- Where do backups, logs and key backups reside, and who can reach them from outside the jurisdiction?
- How do you verify the integrity of software and firmware before it enters production?
- When did you last test recovery of a shared service, and what did the test change?
Technical Detail
For Architects and Security Leads
Tenant Isolation and Hypervisor Hardening
Isolation depends on layers that each assume the one below may fail. At the compute layer, hypervisors are patched on a controlled cadence, unused device emulation is disabled, and host management interfaces are reachable only from dedicated administrative networks. Network isolation uses overlay segmentation with default-deny rules between tenants. Storage isolation relies on per-tenant encryption keys so a misrouted volume stays unreadable. Side-channel exposure is reduced through scheduling policy for sensitive workloads. Telemetry from hosts feeds detection rules for guest-escape indicators, such as unexpected processes on hypervisors or management agents spawning shells. Regular adversary simulation tests whether these layers hold, using ATT&CK techniques for privilege escalation and lateral movement as the test catalog.
Key Hierarchy and In-Jurisdiction Custody
A defensible design uses a hierarchy. A root key lives inside a hardware security module in the jurisdiction and never leaves it. It wraps intermediate key-encryption keys, which in turn wrap data-encryption keys used by storage and databases. Rotation is scheduled and automated, and revocation is tested. Customer-managed and customer-held key options let tenants decide whether the provider can ever decrypt their data. Every key operation is logged to an append-only store, and separation of duties prevents any single administrator from both approving and executing a key change. Backup copies of key material are encrypted, split among custodians and stored in-country, so recovery does not undermine the residency claim.
Business Outcome
Sovereign, resilient digital foundations.
Glossary
Key Terms
- Control Plane
- The management layer that provisions, configures and administers tenant resources, and the prime target for tenant-spanning compromise.
- Blast Radius
- The number of tenants and services affected when a single credential, component or facility fails or is compromised.
- Hardware Security Module
- A tamper-resistant device that generates and protects cryptographic keys and performs cryptographic operations without exposing the keys.
- Customer‑Held Key
- An encryption key controlled by the tenant so the provider cannot decrypt the data without the tenant's participation.
FAQ
Questions Sector Leaders Ask
DAAKYI Intelligence
Ask Kasara About Digital Infrastructure & Cloud Providers
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step