Infrastructure

🔑 Key Takeaway: Web3 frontends and ops still run on centralized infrastructure. Inventory it, harden cloud and DNS, and weigh single-provider simplicity against multi-provider blast-radius reduction.

Infrastructure is often underrated relative to smart contracts, yet most front-end applications and operator tooling run on centralized systems. This framework covers cloud posture, DNS and domain registration, DDoS protection, network and OS hardening, asset inventory, and zero-trust principles.

When designing architecture, weigh provider concentration: one vendor for hosting, DDoS, registrar, and DNS lowers integration cost but creates a shared failure domain; decoupling raises complexity but can limit blast radius. Apply strong security practice either way.

Identity and access lifecycle for people is primarily covered in the dedicated IAM framework; the infrastructure IAM page is a pointer.

What this framework covers

1. Asset Inventory: know what to protect and who owns it.
2. Cloud Infrastructure: RBAC, encryption, network boundaries, logging.
3. DDoS Protection: cloud-native and third-party mitigation options.
4. Domain and DNS Security: registrar locks, DNSSEC and email security, monitoring.
5. Identity and Access Management (pointer): routes to the IAM framework.
6. Network Security: default-deny, segmentation, transit encryption.
7. Operating System Security: patching, SSH, host firewall baselines.
8. Zero-Trust Principles: verify continuously; least privilege access.

Domain and DNS subsection

1. DNS Overview
2. DNS Basics and Common Attacks
3. DNSSEC, CAA, SMTP DANE and Email Security
4. Registrar Security and Registry Locks
5. Monitoring, Alerts, and GitOps

Related frameworks

• IAM: org identity, MFA, RBAC lifecycle
• Front-End Web App: client delivery over infrastructure
• DevSecOps: pipeline and isolation
• Privacy — VPNs: operator path privacy complementary to network controls
• Monitoring: on-chain signals complementary to infra telemetry
• Guides — Account Management: product account hardening for common stacks

Further Reading

• Nested DNS pages and NIST SP 800-123 for OS baselines
• Cloud provider security benchmarks for your stack