Alfa-Bank has implemented a hybrid infrastructure strategy by integrating its on-premises environment with Yandex Cloud. The bank maintains a Zero Trust security model while adopting Cloud Trust principles to share responsibility with the cloud provider.
The bank established a dedicated interconnect using fiber optics with GOST encryption to manage traffic between its internal network and the cloud. Network isolation is maintained through Security Groups, and projects are assigned IP address pools that appear as standard subnets within the bank's internal accounting system.
User access is managed centrally via Active Directory and KeyCloak, integrated with Yandex Cloud IAM to ensure consistent authentication. The bank utilizes Terraform to manage cloud resources and enforces security policies through automated code-based checks, effectively creating an internal Cloud Security Posture Management solution.
The current cloud infrastructure includes 1500 virtual machines, 100 managed services, and 1000 users. For monitoring and threat detection, the bank relies on Yandex Cloud's logging services and the YCDR platform, balancing internal control with the provider's native security tools.
