The weakest application in your server farm can provide a way into the local network.  One of the reasons Amazon uses their own software-defined network switches is so they can limit internal connectivity within their &quot;cloud&quot; to prevent such attack escalation.