An Experimental Model for Assessing Cloud Security Risks in Financial Institution Under DORA Compliance

The rapid adoption of cloud computing, by financial institutions introduces significant security risks like misconfigurations, threatening operational resilience and compliance with frameworks such as the EU's Digital Operational Resilience Act (DORA). This thesis addresses these challenges by developing and evaluating an experimental AWS Security Scanner designed to bridge technical security assessment with DORA's regulatory requirements. The study addresses the question: “How can an experimental security scanning model be utilized to identify common AWS misconfigurations and report their alignment with DORA compliance requirements?” An experimental approach utilized a custom Python-based AWS Security Scanner (Boto3 SDK) in a controlled test environment. The scanner targeted S3, EC2, IAM, and VPC configurations, mapping identified vulnerabilities to DORA Articles, with findings presented via an interactive dashboard and PDF report. The scanner successfully identified misconfigurations across targeted services, including public S3 access, disabled logging, overly permissive EC2/IAM rules, missing MFA, and insecure VPC settings. Findings were automatically mapped to relevant DORA articles, validating the tool's core detection and compliance mapping capabilities. The findings answer the research question, demonstrating the model's capability to link technical AWS misconfigurations to specific DORA violations. This study contributes an empirically validated model and an open-source, DORA-focused scanner, addressing a gap in literature by integrating technical assessment with regulatory specifics. The results highlight the importance of compliance-aware scanning for financial institutions needing to meet DORA's resilience requirements, offering a practical approach.