Data Solutions: Cloud Dispersion

The Cloud Dispersion data feed shows how an organization's internet-facing infrastructure is distributed across cloud providers. Bitsight maps assets to specific cloud providers, regions, and services, giving you visibility into each organization's reliance on the cloud providers it uses.

Use Cloud Dispersion data to evaluate the diversity and concentration of cloud resources across the organizations you monitor, and to assess scalability, resilience, and risk exposure. 

For example, you can:

• Identify how many cloud providers an organization uses.
• Understand the geographic distribution of an organization's cloud resources.
• Find clusters of organizations in your portfolio that depend on the same provider, region, or service, and may be exposed to the same outage or provider-specific vulnerability.
• Support underwriting, portfolio management, and systemic risk modeling by quantifying cloud concentration.

Data

Cloud Dispersion is delivered as a bulk data feed. Each record is a single asset (a domain, hostname, or IP address) attributed to an entity in the Bitsight inventory and mapped to a cloud provider, region, and service.

The data includes:

• Asset and IP address
• Asset importance
• Cloud provider
• Cloud provider region
• Cloud provider service
• Cloud provider apps

Map this data to entity metadata, such as company name, domain, and industry, using the company unique identifier (company_guid). The company_guid field is the foreign key to the Entity Catalog data feed.

How the data is built

Bitsight combines cloud provider information with its attribution of internet assets to entities:

1. Collect cloud information. Bitsight collects cloud asset information from each supported provider. AWS, GCP, Azure, Cloudflare, Fastly, Imperva, Oracle, and Zscaler publish authoritative lists of public IP address ranges, categorized by service and region, and Bitsight uses these directly. Most smaller cloud providers do not publish reliable or detailed information about cloud usage, so for these providers Bitsight uses GROMA scan data to determine usage.
2. Normalize. Cloud data from all sources is processed into a consistent format.
3. Map to entities. Bitsight joins its graph of internet assets to the cloud provider data. This attributes cloud assets to entities across the Bitsight coverage universe and enriches the information collected from the providers.

Supported cloud providers

Cloud Dispersion covers 20 cloud providers and more than 100 services.

Providers include: Akamai, Apple, AWS, Azure, Claro, Cloudflare, DigitalOcean, Fastly, GCP, Hetzner, Huawei, Imperva, IONOS, KIO Networks, Oracle, OVH, Scaleway, Telefonica, UpCloud, and Zscaler.

Data Structure

Data Solutions data feeds are optimized for relational databases. Each Cloud Dispersion record references an entity through company_guid. Join to the Entity Catalog to retrieve entity metadata.

Schema

Assets

Sample records (anonymized)

The records below are illustrative. All company identifiers, domains, and IP addresses have been anonymized and do not represent real entities or assets. IP addresses use ranges reserved for documentation.

Aggregated assets

The aggregated output groups assets by company_guid, provider, region, service, and apps, and adds a count of the assets in each group. The asset, ip, and importance fields are not included. Each row is one distinct combination of those five fields for an entity, so an entity that uses several providers, or one provider in several regions, has several rows. Region and service can be blank when the provider data does not include them.

The following example shows the aggregated output for one entity, using anonymized data:

Interpreting the Data

Asset names that are IP addresses

An asset can be a domain, a hostname, or an IP address. When the asset value is an IP address, the collection did not involve resolving a domain or hostname for that asset.

Importance

Importance is calculated at the asset level, in the same way it appears in other Bitsight data sets, such as Asset Intelligence and the asset list in the Bitsight Portal. See Asset Importance for details.

IP addresses shared across entities

You may see the same IP address attributed to more than one company_guid. This typically indicates shared infrastructure. It is most common with CDN and WAF services, such as Cloudflare and Akamai, and with global load balancers, where a single IP address serves many customers.

Shared IP addresses are owned and managed by the cloud provider. Customer data on those IP addresses is isolated through application-layer controls such as virtual hosts, TLS SNI, and routing rules. The provider is responsible for the security of the infrastructure, and each customer is responsible for the security of its own applications and configuration.

Region GLOBAL

A region of GLOBAL indicates globally distributed infrastructure. The provider does not route traffic to a single physical location. This is typical of CDNs, such as Cloudflare and AWS CloudFront, and of global services, such as Google global accelerators. Requests are routed to the geographically nearest edge location. The provider manages this routing transparently, and customers typically do not control region selection for these services.

Understanding the apps field

The apps field uses two special values to describe cases where no apps are listed:

AWS, GCP, and Azure generally surface more detail about the apps running on their infrastructure, so assets on these providers use None. Smaller cloud providers typically do not surface this level of detail, so assets on those providers use Unknown.

Neither value confirms that no apps are running on an asset.

Delivery

Cloud Dispersion is available through Bitsight Cyber Data Solutions delivery options. The data is refreshed on a recurring basis.