P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Cloud and subscribed services

Cloud control panel (control plane): what it is and how it is attacked

The website and commands used to configure the cloud itself, as opposed to the systems running inside it.

Also known as

  • control plane
  • management console
  • cloud portal
  • cloud API
  • management plane

Typing any of them into the editor finds this object.

Why it matters on a security diagram

This is the difference between a cloud diagram and a network diagram. It answers to who you are signed in as rather than where you are connecting from, it is reachable from anywhere in the world by design, and one change made here can undo every network control drawn elsewhere on the page.

How it gets attacked, and what reduces it

How it gets attacked

  • Reached from any location, because the network controls on the diagram do not apply to it
  • Long-lived keys that carry the same power as the sign-in page without any of its checks
  • Changes made through it that leave no trace on the systems they affect

What reduces it

  • Sign-in rules on it, since this is the perimeter and the firewall rules are not
  • Replace long-lived keys with short-lived, issued identities wherever the platform allows
  • Record control-plane changes separately from the systems they alter

Where it sits

Group
Cloud and subscribed services · Things that only exist because somebody else runs the platform underneath them.
Whose side, by default
Ours · Belongs to the organisation the diagram is about.
Catalogue identifier
cloud-control-plane

Reviewed . CC BY 4.0.

Others in cloud and subscribed services

The cloud and subscribed services group lists all 12 of them side by side.

Cloud control panel on your own diagram

Open the editor, press N, and type control plane. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.

Open the diagram maker