Cloud Security Scaled: The Chaos Continues

The speakers continue a series on cloud security in regulated finance, drawing on roughly 30 to 40 organizations they have worked with. They present three composite case studies: a large enterprise with hundreds of AWS accounts and thousands of applications, a mid-sized lending firm, and a small blockchain project run by one to three people.

For the large enterprise, the team describes how infrastructure as code let them enforce security policy before deployment. Policy checks written as code, using tools such as Terraform with Sentinel, CloudFormation linting and Semgrep, ran in seconds and caught problems before they reached production. They warn that rules must match how teams actually deploy, and that pre-deployment checks miss resources and relationships that exist only at runtime. For the mid-sized lender, the speakers describe an overhaul of secrets management with HashiCorp Vault, which made rotation easier for developers than the old manual process. The firm then used an OWASP SAMM assessment to measure maturity beyond what compliance audits showed. The blockchain startup had familiar gaps: weak logging, unencrypted storage, public buckets, trust placed in the client-side application, and no dedicated security team.

Their advice for smaller companies is to cover the basics first: centralized logging, identity federation, budget alerts and one standard deployment path. Larger organizations should plan early, track metrics that show trends over time, and fix problems at the root so the benefits spread across teams.