P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Cloud and subscribed services

Cloud platform (AWS): what it is and how it is attacked

A supplier's computing platform, rented by the hour, where a setting made on a website creates or removes a whole system.

Also known as

  • AWS
  • Azure
  • GCP
  • Google Cloud
  • public cloud
  • hyperscaler
  • IaaS

Typing any of them into the editor finds this object.

Why it matters on a security diagram

It is a place, a supplier and a set of controls all at once, and it is reached by signing in rather than by connecting, so a network diagram never shows the way in. Responsibility is split with the provider, and the settings on your side of that line are the ones nobody else is checking.

How it gets attacked, and what reduces it

How it gets attacked

  • Its own controls reached from anywhere in the world, protected by a password alone
  • Permissions granted once for a project and never reduced afterwards
  • Systems created in accounts and locations that nobody was asked to watch

What reduces it

  • A phishing-resistant second factor on every administrative sign-in, with no exception for machine accounts
  • Account-wide limits, because they are the only control that still holds after an administrator account is taken
  • The provider's activity record switched on in every account and every region, written where that account cannot delete it

Where it sits

Group
Cloud and subscribed services · Things that only exist because somebody else runs the platform underneath them.
Whose side, by default
Ours · Belongs to the organisation the diagram is about.
Catalogue identifier
cloud

Reviewed . CC BY 4.0.

Others in cloud and subscribed services

The cloud and subscribed services group lists all 12 of them side by side.

Cloud platform on your own diagram

Open the editor, press N, and type AWS. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.

Open the diagram maker