1/ Another thread on cloud risk. Years ago, my colleague @JayHeiser1 divided cloud providers into three "tiers". Tier 1 - the largest leaders, generally cloud-native. Tier 2A - significant usually cloud-native providers. Tier 2B - large vendors cloudifying. Tier 3 - Everyone else
2/ We used this hierarchy, for instance, in the cloud IaaS MQ, as a shortcut for relative risk. Tier 1 can probably be assumed to be investing very deeply in risk reduction, with a presumption of competence. They are also gold mines for attackers, so *need* that competence.
3/ Tier 2 is somewhat riskier but is where customers can influence the most. Tier 2A might not be resourcing risk reduction as deeply. Tier 2B ditto, especially if they're not thinking cloud-natively. Customers can influence, and negotiate more contractual concessions.
4/ Tier 3 is going to be risky and there's not necessarily much you can do about it, beyond carefully understanding how much risk you're exposing yourself to and mitigating what you can yourself, rather than expecting the provider to de-risk.
5/ Now, add the notion of the composable enterprise to this. Every business a digital business, with external APIs. (In many cases, the risk profile for that will be absolutely enormous.) Apps with highly complex chains of distributed dependencies from a huge array of sources.
6/ You think your software supply chain is a difficult risk problem right now? Just you wait! Consuming APIs from vendors poses new challenges already, but consuming them from less-well-defended fellow enterprises is a whole new ballgame for risk.
7/ Proliferation of options at the PaaS layer, especially, also complicates application architectures and all risk management. It's a problem that the industry has yet to really solve (and it promotes hyperscaler monoculture).
8/ No easy answers here, other than wondering what skeletons lurk in Tier 2 vendors, large enough to be worth plundering but not large enough to be intensively probed by vulnerability researchers. /fin
@threadreaderapp unroll
• • •
Missing some Tweet in this thread? You can try to
force a refresh
