Analysed as a cyber system, what are the system boundary, actors and interactions of publisher Z's web platform?

The boundary is Z's on-premises data centre, containing the LAMP system (Apache web server, Linux server, PHP code, MySQL database with, among other things, customer data) and the backend systems (a Z backend system and the printing works). Customers use the platform over the internet via HTTPS in their web browser; an editor maintains content; an admin looks after the system; an attacker targets it from the internet. There is no developer.

* Customers, editor and admin all reach the LAMP system, and the LAMP system reaches the backends; the developer is missing. *

Two points of the analysis are easy to miss. First, data exchange with the backend systems is not mentioned in the case text, but it has to be assumed to be operationally necessary: ads and subscriptions must reach the publisher's business systems and the printing works (German Druckerei). That link is what makes the platform dangerous beyond itself. Second, the missing developer is an actor worth drawing, crossed out, because it shows that nobody can change the code. The MySQL database holding customer data from the online business is the main asset an attacker is after.

Go deeper:

• LAMP (software bundle) — Wikipedia — the four components inside the system boundary.
• MITRE ATT&CK T1210 — Exploitation of Remote Services — how a foothold on one system is used to reach connected internal systems.