Multi-Cloud

SAO — Security Audit Orchestrator

Challenge

Security teams struggle with fragmented tooling: separate tools for asset inventory, vulnerability scanning, attack path analysis, and detection engineering. Infrastructure state is scattered across Terraform backends, cloud APIs, and on-premise systems. Attack feasibility assessments require manual expert analysis.

Build a unified security audit platform that:

Extracts infrastructure state from multiple clouds
Generates comprehensive SBOMs
Builds attack trees mapped to MITRE ATT&CK
Identifies detection coverage gaps
Provides AI-powered risk assessment

Solution Architecture

Overview

┌─────────────────────────────────────────────────────────────────────┐
│                     Security Audit Orchestrator                      │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│   ┌──────────────┐    ┌──────────────┐    ┌──────────────┐         │
│   │  Extractors  │    │   Parsers    │    │   Analyzers  │         │
│   │  - Terraform │    │  - Cloud API │    │  - Attack    │         │
│   │  - Docker    │    │  - SBOM      │    │  - Detection │         │
│   │  - Git       │    │  - IAM       │    │  - Risk      │         │
│   │  - OS Pkgs   │    │  - Network   │    │  - AI/LLM    │         │
│   └──────┬───────┘    └──────┬───────┘    └──────┬───────┘         │
│          │                   │                   │                  │
│          └───────────────────┼───────────────────┘                  │
│                              ▼                                      │
│                    ┌──────────────────┐                             │
│                    │   Audit Engine   │                             │
│                    │   NIST CSF 2.0   │                             │
│                    │   MITRE ATT&CK   │                             │
│                    └────────┬─────────┘                             │
│                             ▼                                       │
│          ┌─────────────────────────────────────┐                   │
│          │           Output Formats             │                   │
│          │  SARIF · CycloneDX · JSON · Markdown │                   │
│          └─────────────────────────────────────┘                   │
└─────────────────────────────────────────────────────────────────────┘

NIST CSF 2.0 Alignment

Function	Coverage	Key Capabilities
GOVERN (GV)	Strategic	Risk metrics, compliance mapping
IDENTIFY (ID)	Asset management	SBOM, dependency analysis, threat catalog
PROTECT (PR)	Preventive	IAM analysis, encryption audit, network segmentation
DETECT (DE)	Detection engineering	Rule coverage, gap analysis, SIEM correlation
RESPOND (RS)	Incident response	Attack paths, remediation plans
RECOVER (RC)	Business continuity	Impact analysis, recovery priorities

Key Features

1. Multi-Cloud Support

# AWS infrastructure audit
sao run --cloud aws --terraform-state s3://bucket/prod.tfstate

# Yandex Cloud audit
sao run --cloud yandex --terraform-state s3://bucket/yc-prod.tfstate

# On-premise (local state)
sao run --cloud onprem --terraform-state ./terraform.tfstate

2. SBOM Extraction

# Docker image SBOM
sao extract sbom --type docker --target nginx:1.25-alpine

# Git repository dependencies
sao extract sbom --type git --target ./my-app

# OS packages
sao extract sbom --type os --target ubuntu:22.04

# CI/CD build artifacts
sao extract sbom --type build --target ./build-manifest.json

Output formats: CycloneDX, SPDX, JSON.

February 25, 2026 •

Security Audit SBOM Attack Tree MITRE ATT&CK Detection Engineering Multi-Cloud

Cryptocurrency Exchange Infrastructure

Challenge

Build a robust, scalable, and secure multi-cloud infrastructure for a cryptocurrency exchange platform handling high-frequency trading operations, requiring:

High Performance: Process 10K+ orders per second with minimal latency
Security: Protect hot/cold wallets and blockchain nodes
Availability: Ensure 24/7 operations across multiple environments
Compliance: Meet cryptocurrency regulatory requirements
Scalability: Support growing trading volumes and user base

Architecture Overview

Multi-Cloud Strategy

On-Premise Infrastructure (Colocation):
  Purpose: Core trading engine and cold wallet storage
  Resources:
    - 50 physical servers
    - VMware ESXi virtualization platform
    - Ceph distributed storage (200TB)
    - OPNsense firewall cluster

Hetzner Cloud:
  Purpose: Additional compute and redundancy
  Resources:
    - Dedicated servers
    - Automated provisioning via Ansible
    - Load balancing tier

Google Cloud Platform:
  Purpose: Public-facing services and analytics
  Resources:
    - GKE (Google Kubernetes Engine)
    - Cloud SQL for relational data
    - Cloud Armor for DDoS protection
    - Global load balancing

Technical Implementation

1. Kubernetes Architecture

Multi-Distribution Setup

Production Clusters:
  GKE (Google Cloud):
    - Public-facing trading interface
    - API gateway services
    - Real-time market data feeds
    - User authentication services

  K3s (On-Premise):
    - Core trading engine
    - Order matching engine
    - Wallet management services
    - Blockchain node management

  Management:
    - Rancher for centralized cluster management
    - Unified monitoring and logging
    - Cross-cluster service mesh

Container Registry & Security

Nexus Registry:
  - Private container registry
  - Vulnerability scanning integration
  - Image signing and verification
  - Access control and audit logging

Security Measures:
  - Network policies for pod-to-pod communication
  - RBAC with least privilege access
  - Secret management with encrypted storage
  - Regular security scanning and updates

2. Storage Infrastructure

Ceph Distributed Storage (200TB)

Architecture:
  Pools:
    - Hot data pool (SSD): Trading data, active wallets
    - Cold data pool (HDD): Historical data, backups
    - Metadata pool: File system metadata

  Replication:
    - 3x replication for critical data
    - 2x replication for warm data
    - Erasure coding for cold storage

  Performance:
    - IOPS optimization for trading engine
    - Low-latency access for hot wallets
    - Bandwidth optimization for blockchain sync

Other Storage Solutions:
  - Linstor for Kubernetes persistent volumes
  - PortWorx for database workloads
  - MinIO for object storage (S3 compatible)
  - NFS for shared application data

3. Cryptocurrency Infrastructure

Blockchain Nodes

Supported Blockchains:
  - Bitcoin (BTC): Full node + pruned nodes
  - Ethereum (ETH): Geth full nodes
  - Litecoin (LTC): Full node
  - Other altcoins: Selective node deployment

Node Management:
  - Automated synchronization monitoring
  - Health checks and auto-healing
  - Version management and updates
  - Performance optimization

Wallet Architecture

Hot Wallets (Online):
  Location: Kubernetes pods with strict security
  Purpose: Active trading and withdrawals
  Security:
    - Multi-signature requirements
    - Rate limiting on withdrawals
    - Real-time monitoring and alerts
    - Encrypted keys with HSM integration

Cold Wallets (Offline):
  Location: Air-gapped servers in colocation
  Purpose: Long-term storage of customer funds
  Security:
    - Hardware security modules (HSM)
    - Physical security controls
    - Multi-party authorization
    - Regular security audits

Warm Wallets (Semi-Online):
  Purpose: Balance between hot and cold
  Process: Automated cold-to-warm-to-hot transfers

4. CI/CD Pipeline

Jenkins on Kubernetes

Pipeline Architecture:
  - Jenkins master on Kubernetes
  - Dynamic agent provisioning
  - Parallel job execution
  - Docker-in-Docker builds

Stages:
  1. Code checkout and validation
  2. Unit and integration tests
  3. Security scanning:
     - Trivy for vulnerabilities
     - SonarQube for code quality
  4. Container image build and push
  5. Helm chart packaging
  6. Deployment to staging
  7. Automated testing
  8. Production deployment (manual approval)

GitLab Integration:
  - Self-hosted GitLab instance
  - Git repository management
  - Code review and merge requests
  - 100+ Helm charts for deployments

5. Security Architecture

Network Security

OPNsense Firewall:
  - High-availability cluster
  - Intrusion Detection System (IDS)
  - Intrusion Prevention System (IPS)
  - VPN for secure remote access
  - Traffic analysis and logging

Network Segmentation:
  - Isolated trading network
  - Separate blockchain node network
  - DMZ for public-facing services
  - Management network isolation
  - Strict firewall rules between segments

DDoS Protection:
  - Cloud Armor (GCP) for public endpoints
  - Rate limiting at multiple layers
  - Traffic scrubbing and filtering
  - Automated incident response

Application Security

Security Measures:
  - Two-factor authentication (2FA) mandatory
  - IP whitelisting for API access
  - API rate limiting per user/IP
  - Session management and timeout
  - Encrypted communication (TLS 1.3)
  - Regular penetration testing
  - Bug bounty program

6. Observability & Monitoring

Multi-Layer Monitoring

Infrastructure Monitoring (Zabbix):
  - Server hardware metrics
  - Network device monitoring
  - Service availability checks
  - Capacity planning metrics
  - Alerting and escalation

Application Monitoring (Prometheus/Grafana):
  - Trading engine performance
  - Order processing latency
  - Wallet transaction metrics
  - API response times
  - Custom business metrics

Log Aggregation (ELK Stack):
  - Centralized logging
  - Security event correlation
  - Audit trail for compliance
  - Real-time log analysis
  - Long-term log retention

Distributed Tracing (Jaeger):
  - Request flow visualization
  - Performance bottleneck identification
  - Dependency mapping

7. WebRTC Video Communication Platform

Real-Time Communication

Infrastructure:
  - WebRTC signaling servers on Kubernetes
  - TURN/STUN servers for NAT traversal
  - Media servers for group calls
  - Load balancing for 1000+ concurrent users

Features:
  - Peer-to-peer video/audio calls
  - Screen sharing capabilities
  - Recording and playback
  - Integration with trading platform

Performance:
  - Low latency (<100ms)
  - Adaptive bitrate streaming
  - Network resilience
  - Quality monitoring

Results & Metrics

Performance Achievements

Trading Performance:
├── Order Processing: 10,000+ orders/second
├── Order Latency: <50ms average
├── API Response Time: <100ms p95
└── Blockchain Sync: 99.9% uptime

User Capacity:
├── Concurrent Users: 5,000+ active traders
├── WebRTC Sessions: 1,000+ concurrent
└── API Requests: 50K+ requests/minute

Availability & Reliability

Platform Uptime: 99.9% across all services
Zero Security Breaches: Throughout operation period
Disaster Recovery: 2-hour RTO, 15-minute RPO
Incident Response: 24/7 on-call team

Business Impact

Revenue Growth
June 15, 2022 •
Cryptocurrency Blockchain Trading High Availability Multi-Cloud