An insurer runs its private cloud behind a VPN-connected perimeter, but the cloud provider's admin portal for all customers is reachable from the internet. What does that mean, and what can still be done?

The admin portal is a public backdoor into the private cloud perimeter. Since the provider serves many customers it can't be made private, and moving back on-premises is no longer an option, so the public admin access must be secured as well as possible: multi-factor authentication, monitoring of access, and minimising organisational risks such as those from staff changes.

The case continues the insurer from the perimeter example, whose private cloud was set up through exactly that portal. A routine audit of all privileged (admin) accounts asked how access to admin tools is organised, and found that whoever logs into the portal controls the whole cloud network, firewalls and VPN included, regardless of how closed the perimeter is.

The general lesson: a perimeter is only as closed as its management plane. Cloud resources come with a provider-run control interface, usually on the internet, that sits outside any perimeter you build. Since you cannot remove it, you harden the access to it instead. Staff changes are named explicitly because people who leave often keep admin credentials or MFA devices longer than they should.