Chapter 4 — Cloud and container security: competing explanations
Lesson map
Lesson 04 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Explanation A: console error"]
N2["4.2 Explanation B: weak IaC defaults"]
N3["4.3 Explanation C: identity breadth"]
N4["4.4 Distinguishing evidence"]
N5["4.5 Avoiding unfalsifiable claims"]
N6["4.6 Literature link"]
N7["Writing the table"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Explanation A: console error"]
N2["4.2 Explanation B: weak IaC defaults"]
N3["4.3 Explanation C: identity breadth"]
N4["4.4 Distinguishing evidence"]
N5["4.5 Avoiding unfalsifiable claims"]
N6["4.6 Literature link"]
N7["Writing the table"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]
[Learning outcomes]
|
v
[4.1 Explanation A: console error]
|
v
[4.2 Explanation B: weak IaC defaults]
|
v
[4.3 Explanation C: identity breadth]
|
v
[4.4 Distinguishing evidence]
|
v
[4.5 Avoiding unfalsifiable claims]
|
v
[4.6 Literature link]
|
v
[Writing the table]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) state each explanation as a testable mechanism; (2) derive predictions that differ; (3) identify evidence that would distinguish them; (4) avoid unfalsifiable explanations.
4.1 Explanation A: console error
Manual console changes skip review and templates, so mistakes such as ticking "public" are more likely and stay unnoticed. Prediction: higher exposure rate for console changes, persisting within teams and hours. This is the platform team's view. If console changes are riskier only because they happen at night or in one team, the subgroup checks will show it, and A would be weakened. A also predicts that fixing templates would do little for console exposures, which is a pattern the data could contradict.
4.2 Explanation B: weak IaC defaults
Templates copied between projects carry permissive settings, and review focuses on application logic, not storage policy. Prediction: IaC exposures cluster in resources created from a small number of templates; fixing templates would cut many exposures at once. This is the data team's view, and it comes with its own falsifying pattern: if IaC exposures are spread evenly across many templates, weak defaults in a few templates cannot explain them. Template identifiers in Larkspur's change records make the test possible. Rahman et al. give the mechanism support from other organisations.
4.3 Explanation C: identity breadth
Exposure depends on how many identities can change access settings, whatever the origin. Prediction: exposures concentrate where many identities hold storage administration rights. This explanation came from Lucas's seminar argument, not from either Larkspur team. It would be contradicted if accounts with few storage administrators showed exposure rates as high as accounts with many. Because console users might also hold broad rights, identity breadth must be counted alongside origin, or C could make A look stronger than it is. Dr Tanaka asked him to state this in the proposal.
4.4 Distinguishing evidence
A and B can both be true. The study measures rates by origin, clustering by template and the number of identities with storage admin rights per account. Each measure tests one explanation's prediction without assuming the others are false. Lucas sets these out in a table with the pattern that would contradict each explanation, so that the results chapter can say which predictions held and which did not. If all three hold, the study shows that all three contribute, which is itself a useful answer for Larkspur.
4.5 Avoiding unfalsifiable claims
"Human error" alone explains everything and predicts nothing; each explanation must say what pattern would contradict it. At Larkspur, each team had been using "human error" for the other team's changes. Asking each explanation to name a contradicting pattern forced the argument into a form data could settle. The rule also binds Lucas: his own identity-breadth explanation must say what would count against it, which he wrote into the proposal table. Each contradicting pattern appears in the proposal table, next to the analysis that would reveal it.
4.6 Literature link
Rahman et al. (2019) supports B's mechanism; provider guidance on blocking public access at account level addresses all three. Account-level blocking matters for the study's recommendations because it limits exposure whichever explanation turns out strongest. Lucas notes, though, that such guidance is a control, not evidence about causes, so it informs the recommendations rather than the analysis. The literature review keeps the two uses apart. Lucas also cites the providers' own documentation for account-level blocking, so Larkspur's engineers can follow the same guidance when they apply it, and notes the date each page was checked.
Writing the table
Each row of Lucas's table lists the explanation, its mechanism, its prediction, the evidence that would contradict it and the data field that measures it. Writing the contradicting evidence is the hardest column and the most useful: it forces each explanation to risk being wrong. The table becomes the first figure of the thesis.
Worked example
Lucas tables the three explanations with their predictions and contradicting patterns. Dr Tanaka points out that C could make A look stronger if console users also hold broad rights; Lucas adds identity breadth as a control variable.
Synthetic case. Explanations are framed for the synthetic case.
Errors and limits
Supporting one explanation does not rule out others; look for the pattern that would contradict each.
Exercises
- EX021 — Explanation A. State explanation A's prediction. Rubric: 3 = higher console rate within teams and hours; 2 = partial; 1 = vague; 0 = none.
- EX022 — Explanation B. What does explanation B predict? Rubric: 3 = clustering by template; 2 = partial; 1 = vague; 0 = none.
- EX023 — Explanation C. What does C predict? Rubric: 3 = exposures where many identities have admin rights; 2 = partial; 1 = vague; 0 = none.
- EX024 — Human error. Why is "human error" alone weak? Rubric: 3 = predicts nothing; 2 = partial; 1 = vague; 0 = none.
- EX025 — Control variable. What control variable was added? Rubric: 3 = identity breadth; 2 = partial; 1 = vague; 0 = none.
- EX026 — Both true. Can A and B both be true? Rubric: 3 = yes; 2 = partial; 1 = vague; 0 = none.
Synthesis
Turn explanations into predictions that evidence could contradict.
Continue studying — chapter 04 of 08
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →