Group 3 · Cloud security and identity

Learn · Group 3 · Financial services

Cloud security and identity

How banks, payment firms and insurers control who can use their cloud systems, protect their data, and keep running when something fails.

  1. Basicsthe ideas from class, one at a time
  2. Putting it togetherhow the ideas combine
  3. In depththe full design and its trade-offs
  4. Exampleapplied to one real company
→ next
← previous
Buttons and cards can be clicked

Basics · 1

Who secures what in the cloud

The provider and the customer split the work. Pick a service model and see who looks after each layer.

    Basics · 2

    Two questions: who are you, and what may you do?

    AuthenticationProves who you are. Example: a password or a security key.
    AuthorisationDecides what you may do once you are in. Example: read customer data.

    Try it: sort each item into the right question.

    Basics · 3

    What counts as multi-factor authentication

    MFA means factors from different categories. Pick any two and check.

    Pick two factors.

    Basics · 4

    Only the access you need

    A payments developer needs the payment code and a test database. Compare broad access with least privilege, then imagine the account is stolen.

    Basics · 5

    Implicit trust versus Zero Trust

    Diagram comparing implicit trust with Zero Trust
    legitimate requestsomeone using a stolen password

    Putting it together · 6

    Every request goes through five checks

    This is the access sequence from class. Pick a situation, switch the controls on or off, and run it.

    Situation
    Controls On
      Pick a situation and press run.

      Putting it together · 7

      Protect data in every state

      Data is stored, it travels, and it is used. Each state needs its own protection.

      Class case: a firm encrypts its customer database and uses HTTPS everywhere. An attacker steals an administrator's password and downloads customer records through the app. Did encryption fail?

      Putting it together · 8

      Rules that block unsafe settings

      Policies check a new resource before it is created. Set up a storage account and try to create it.

      The policy result appears here.

      Putting it together · 9

      Why it matters in financial services

      $0M
      average cost of a breach in financial services (IBM, 2026)
      0%
      of breaches involve a third party (Verizon, 2026)
      0%
      lower risk of account takeover with MFA (Microsoft study, 2023)

      Three rules shape the design

      EU financial firms DORA

      Strong access control, tested backup and recovery, a register of suppliers with exit plans, and fast reporting of major incidents: first report within 4 hours of classifying it (no later than 24 hours after detection), then 72 hours, then one month.

      Card payments PCI DSS 4.0.1

      MFA for all access to card data, no passwords written into code, and audit logs kept for 12 months.

      Personal data GDPR

      Protect personal data, for example with encryption, and tell the regulator about a breach within 72 hours.

      Putting it together · 10

      Where it goes wrong: six common failures

      Click a card to see a real case.

      In depth · 11

      Every layer needs its own control

      A financial platform has six layers, from the customer's app down to the cloud foundation. Click a layer.

      In depth · 12

      The full design, piece by piece

      Our reference design on Azure. Click a block to see what it does and why.

      Who connects
      Identity
      What they reach

      In depth · 13

      Seven decisions and the options we rejected

      Open a decision to see the choice, the alternative and the failure it prevents.

      In depth · 14

      Keeping the service running

      A payment depends on several services in a chain. Switch on the patterns from class and watch the yearly downtime.

      availability of the payment path
      possible downtime per year

      Uses published uptime targets (identity 99.99%, key vault 99.99%, zone-redundant database 99.995%, Kubernetes 99.95%), simplified for teaching. Logs and alerts are sent asynchronously, so the monitoring tool is not part of the chain.

      Replication or backup?

      Main databaselive data
      Replicaan up-to-date copy
      Immutable backuplast night's copy, cannot be changed

      Replication supports continuity. Backup supports recovery.

      In depth · 15

      When something still goes wrong

      Simulate a stolen administrator account and follow the clock.

        100%phishing-resistant MFA for admins
        0permanent admin accounts
        0passwords stored in code
        < 1 hto contain a stolen account

        In depth · 16

        What the design costs, and how we limit it

        Remaining risk: a stolen live session or a dishonest employee can still do limited harm. The design keeps that harm to one narrow role and to minutes rather than months.

        Example · 17

        Worked example: Coinbase

        The same seven decisions apply to a crypto exchange. What changes is where each one is strengthened, translated or extended.

        Based on public sources: Coinbase's SEC filings (8-K 2025, 10-K 2024), an AWS case study and the FBI.

        Review · 18

        Check yourself

        Six questions on the main ideas. Feedback appears straight away.

        Sources

        Where the facts come from

        Group 3 · Cloud Computing, IE University. The full paper cites every claim in detail.