🔒
Security & Compliance Foundations
Section 2 of 9
PCI-DSS scoping and controls, AML/KYC engineering pipelines, cryptography for fintech, OAuth 2.0 + FAPI, fraud detection patterns, and secrets management
3 hours•advanced
🎯
Key Takeaways
- •PCI-DSS scope is defined by what touches cardholder data — tokenisation and network segmentation are your primary scope-reduction tools
- •AML/KYC is an engineering problem: real-time watchlist screening must complete in under 500ms to avoid checkout abandonment
- •Envelope encryption is the standard pattern: encrypt data with a DEK, then encrypt the DEK with a CMK in KMS
- •FAPI 2.0 (Financial-grade API) adds PAR, JARM, and DPoP on top of standard OAuth 2.0 — required for Open Banking
- •Secrets must never be in code, environment files, or logs — use AWS Secrets Manager with automatic rotation
📝Personal Notes
Ready to test your knowledge?
Take the quiz to reinforce what you've learned