Download Publication

This publication reflects on eight recent cloud breach cases, presented as both a detailed narrative and a threat model. The threat model format provides an attack-style synopsis of the threat actor including the relevant cloud computing vulnerabilities, business and technical impacts, and end controls and mitigations, deriving actionable insights to benefit cloud users, builders, and defenders. Additionally, each of the cases is mapped to the cloud security threats outlined in the Top Threats to Cloud Computing Pandemic Eleven publication released in 2022, as well as applicable Cloud Controls Matrix (CCM) controls and key takeaways. 

The analysis of these breaches produced observations on the prevalence of modern cloud security risks, the growing impact of identity and supply chain on cloud security, and the changing profile of threat actors targeting cloud services. Security practitioners and technology leaders are encouraged to use these breach case studies and insights to start their own internal analysis, comparisons, and discussions.