Alfa-Bank

Tools Alone Won't Suffice: Building Systemic Kubernetes Security Across Hundreds of Clusters at Alfa-Bank

Alexander, lead of the K8S and cloud security department at Alfa-Bank, explains how the bank moved from fragmented tools and ad-hoc practices to a comprehensive process-driven security function covering more than 500 Kubernetes clusters. The approach centers on a threat lifecycle model that includes threat modeling, requirements definition, project expertise, auditing, risk assessment, platform operations, and SOC integration. A RACI matrix formalizes responsibilities across security, DevOps, AppSec Business Partners, and IT teams to ensure consistent execution at scale. Four specialized roles—an architect, analyst-engineer, auditor, and platform DevOps engineer—handle the workload that no single individual could manage. The bank emphasizes that commercial scanners and policies deliver value only when embedded in repeatable processes tied to a living threat model and clear accountability.

Alfa-Bank Balances Cloud Trust and Zero Trust Models During Migration to Yandex Cloud

Alfa-Bank's head of container and cloud security, Sasha Chertok, detailed how the bank migrated regulated workloads to Yandex Cloud while preserving existing Zero Trust controls. The organization mapped on-premises network segmentation, Active Directory authentication, and firewall policies directly onto Yandex Cloud resources using interconnect links secured with GOST encryption. Responsibility for managed services is shared under a Cloud Trust model, yet the bank retains oversight through Terraform-managed Security Groups, custom CSPM checks, and internal CI/CD gates. User access continues to authenticate via on-premises Active Directory and KeyCloak federations, while authorization leverages granular Yandex Cloud IAM roles. Logging and detection rely on a combination of Yandex Cloud Audit Trail, Cloud Logging, and the YCDR service to compensate for incomplete control-plane visibility. The resulting hybrid architecture now supports 1,500 virtual machines, 100 managed services, and 1,000 identities across multiple environments without disrupting established security processes.

AI in Cybersecurity: Where It Delivers Real Value and Where It Remains Marketing Hype

The article examines how artificial intelligence is applied in information security, distinguishing genuine technological capabilities from vendor marketing claims. It explains the differences between classical correlation rules in SIEM systems, machine learning models for anomaly detection, and generative AI for analyst assistance. Real-world examples from Alfa-Bank highlight both successes in anti-fraud and UEBA systems and limitations when context or business understanding is required. The piece warns against inflated expectations that AI alone can replace SOC analysts or automatically investigate complex incidents. It concludes by identifying areas where AI genuinely reduces noise and processes large data volumes effectively.