CLD-010 Cloud Services
Can several people use the same cloud account?¶
Yes. Shared credentials, remembered sessions, multiple devices, delegated access and compromise can all place activity from several people under one account identifier.
Evidence and questions to consider¶
- who knew the credentials;
- signed-in devices and remembered sessions;
- multi-factor authentication;
- linked applications and delegated access;
- session, device and IP differences;
- organisation policy and wider contextual evidence.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
A shared account weakens direct attribution, so identify all possible users and compare the wider evidence.