Future Banks Live in The Cloud: Building a Usable Cloud with Uncompromising Security
summary
Coinbase builds on AWS with hardened CoreOS AMIs and Docker containers, keeps 99% cold air-gapped storage and root tokens in safes, and burns hosts on redeploys; logging streams through Kinesis into Elasticsearch and processes over a billion events per day for real‑time detection. IAM is namespaced and self‑service to avoid blanket describe star rights, deployments require quorum so only consensus can push to prod, and a migration launched over 10,000 servers to validate the design.
AI-written summary · about
chapters (18)
- 0:00Intro
- 3:37Security
- 6:15Third Parties Compromised
- 8:13Everyone is a Target
- 9:39The Attack
- 10:40Takeaways
- 13:48Securing the Cloud
- 21:19Permissions
- 25:15Selfservice IAM
- 27:38AWS Panel
- 30:53Network Design
- 34:56Environments
- 37:59Docker Security
- 42:14Monitoring Containers
- 43:19Elastic Search
- 44:35Example
- 45:49Consensus Deployment
- 47:40Conclusion
related talks
26mSecurity Without Friction
39mThe Power of Cloud Native in Financial Institutions
49mPublic cloud in regulated industry, not just swipe of a cred
45mSecurity Lessons Learned Moving a Bank 100% in the Cloud
18mSelf-service AWS Serverless Application Model
01h 03mContinuous Security in the Cloud
39mPerils of the cloud
19mKeynote: From COBOL to Kubernetes: A 250 Year Old Bank's Cloud-Native Journey