Cloud Services · CLD-014

Does a cloud account identify a person?¶

A cloud account identifies a digital account within a service.

It does not, by itself, identify the person who was using it at a particular time.

What this means in practice¶

The account may be shared. Another person may know the password. A browser or device may remain signed in. An attacker may use stolen credentials or an active session. A linked application or automated process may act through the account without the named user manually doing anything at that moment.

In an organisational environment, the account may have been assigned to an employee, contractor, team or role. Administrators may reset credentials, change permissions or access the environment. Shared or generic accounts may have several legitimate users.

Treat account-registration details as one part of attribution.

Also consider whether the account details themselves could be false, outdated, borrowed or created using another person’s information.

What this may show¶

An account may contain a name, email address, telephone number, payment method, recovery details or organisational assignment. Those details may help identify who created, controlled or was expected to use the account.

What this does not show on its own¶

The dangerous assumption is that the named account holder must have carried out every recorded action.

Be precise in your language. A cloud log may show that activity was attributed to an account. It may support an inference about the user when combined with other evidence. It rarely proves the person’s identity on its own.

What to do next¶

Compare provider records with authentication events, session information, device records, IP addresses, application details and administrator activity. Then compare those with wider evidence such as device examination, communications, work records, physical access, CCTV and witness accounts.