Banking vertical: 15 real PCI/SOX/AML findings -> forwarded via generic API -> fixed -> closed

THE SECURITY FINDING

SQL Server firewall permits 0.0.0.0-255.255.255.255 on port 1433 — direct database exposure across internet. Violates PCI DSS 1.2.1 and SOX ITGC access controls.

JUSTIFICATION

Critical: SQL Server firewall permits 0.0.0.0-255.255.255.255 on port 1433 — direct database exposure across internet. Violates PCI DSS 1.2.1 and SOX ITGC access controls.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az sql server firewall-rule delete --resource-group rg-banking-prod-data --server sqlsrv-pyx-banking-prd --name AllowAllWindowsAzureIps
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (sqlsrv-pyx-banking-prd).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: SQL Server firewall permits 0.0.0.0-255.255.255.255 on port 1433 — direct database exposure across internet. Violates PCI DSS 1.2.1 and SOX ITGC access controls.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of sqlsrv-pyx-banking-prd before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans sqlsrv-pyx-banking-prd immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az sql server firewall-rule delete --resource-group rg-banking-prod-data --server sqlsrv-pyx-banking-prd --name AllowAllWindowsAzureIps

AI CLOSE NOTES

TITAN CONDUIT opened this critical ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

AML transaction log storage account publicly accessible — container 'aml-alerts' returns HTTP 200 anonymously. BSA/AML §1020.320 violation: customer identification and suspicious activity data must be protected.

JUSTIFICATION

Critical: AML transaction log storage account publicly accessible — container 'aml-alerts' returns HTTP 200 anonymously. BSA/AML §1020.320 violation: customer identification and suspicious activity data must be protected.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az storage account update --resource-group rg-banking-aml --name stgbankingamlogs --default-action Deny --allow-blob-public-access false
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (stg-banking-aml-logs).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: AML transaction log storage account publicly accessible — container 'aml-alerts' returns HTTP 200 anonymously. BSA/AML §1020.320 violation: customer identification and suspicious activity data must be

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of stg-banking-aml-logs before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans stg-banking-aml-logs immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az storage account update --resource-group rg-banking-aml --name stgbankingamlogs --default-action Deny --allow-blob-public-access false

AI CLOSE NOTES

TITAN CONDUIT orchestrated end-to-end: SCOUT detected the critical aml incident, FORGE applied the consent-gated fix automatically (incident class), SCOUT rescan confirmed the finding cleared, and CONDUIT closed this ticket with a Successful close_code. Pre-change snapshot retained for 30 days for rollback.

THE SECURITY FINDING

Key Vault 'kv-banking-hsm' soft-delete disabled — HSM-backed keys used for payment processing signing are at risk of irreversible accidental deletion. PCI DSS 3.5.1 requires key management controls.

JUSTIFICATION

High: Key Vault 'kv-banking-hsm' soft-delete disabled — HSM-backed keys used for payment processing signing are at risk of irreversible accidental deletion. PCI DSS 3.5.1 requires key management controls.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az keyvault update --resource-group rg-banking-core --name kv-banking-hsm --enable-soft-delete true --retention-days 90
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (kv-banking-hsm).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Key Vault 'kv-banking-hsm' soft-delete disabled — HSM-backed keys used for payment processing signing are at risk of irreversible accidental deletion. PCI DSS 3.5.1 requires key management controls.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of kv-banking-hsm before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans kv-banking-hsm immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az keyvault update --resource-group rg-banking-core --name kv-banking-hsm --enable-soft-delete true --retention-days 90

AI CLOSE NOTES

TITAN CONDUIT opened this high encryption ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Fraud-detection service account has admin access + no MFA + access keys unrotated 420 days. Bank regulator FFIEC CAT mandates least-privilege and MFA on privileged accounts.

JUSTIFICATION

Critical: Fraud-detection service account has admin access + no MFA + access keys unrotated 420 days. Bank regulator FFIEC CAT mandates least-privilege and MFA on privileged accounts.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   aws iam attach-user-policy --user-name iam-user-fraud-svc-legacy --policy-arn arn:aws:iam::aws:policy/FraudOpsReadOnly && aws iam update-access-key --status Inactive --access-key-id AKIA...
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (iam-user-fraud-svc-legacy).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Fraud-detection service account has admin access + no MFA + access keys unrotated 420 days. Bank regulator FFIEC CAT mandates least-privilege and MFA on privileged accounts.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of iam-user-fraud-svc-legacy before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans iam-user-fraud-svc-legacy immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

aws iam attach-user-policy --user-name iam-user-fraud-svc-legacy --policy-arn arn:aws:iam::aws:policy/FraudOpsReadOnly && aws iam update-access-key --status Inactive --access-key-id AKIA...

AI CLOSE NOTES

TITAN CONDUIT orchestrated end-to-end: SCOUT detected the critical fraud incident, FORGE applied the consent-gated fix automatically (incident class), SCOUT rescan confirmed the finding cleared, and CONDUIT closed this ticket with a Successful close_code. Pre-change snapshot retained for 30 days for rollback.

THE SECURITY FINDING

PCI card-data RDS instance has 'publicly_accessible=true' set — violates PCI DSS 1.3.4 (no direct public access to CHD). TLS also disabled (rds.force_ssl=0).

JUSTIFICATION

High: PCI card-data RDS instance has 'publicly_accessible=true' set — violates PCI DSS 1.3.4 (no direct public access to CHD). TLS also disabled (rds.force_ssl=0).

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   aws rds modify-db-instance --db-instance-identifier rds-pci-card-data --no-publicly-accessible --apply-immediately && aws rds modify-db-parameter-group --db-parameter-group-name pci-card-pg --parameters "ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=immediate"
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (rds-pci-card-data).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: PCI card-data RDS instance has 'publicly_accessible=true' set — violates PCI DSS 1.3.4 (no direct public access to CHD). TLS also disabled (rds.force_ssl=0).

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of rds-pci-card-data before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans rds-pci-card-data immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

aws rds modify-db-instance --db-instance-identifier rds-pci-card-data --no-publicly-accessible --apply-immediately && aws rds modify-db-parameter-group --db-parameter-group-name pci-card-pg --parameters "ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=immediate"

AI CLOSE NOTES

TITAN CONDUIT opened this high database ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Security group sg-banking-webtier-prod allows 0.0.0.0/0 on port 3306 (MySQL) — production banking DB exposed to internet. PCI DSS 1.2.1 firewall/router configuration violation.

JUSTIFICATION

High: Security group sg-banking-webtier-prod allows 0.0.0.0/0 on port 3306 (MySQL) — production banking DB exposed to internet. PCI DSS 1.2.1 firewall/router configuration violation.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   aws ec2 revoke-security-group-ingress --group-id sg-0abc123 --protocol tcp --port 3306 --cidr 0.0.0.0/0
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (sg-banking-webtier-prod).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Security group sg-banking-webtier-prod allows 0.0.0.0/0 on port 3306 (MySQL) — production banking DB exposed to internet. PCI DSS 1.2.1 firewall/router configuration violation.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of sg-banking-webtier-prod before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans sg-banking-webtier-prod immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

aws ec2 revoke-security-group-ingress --group-id sg-0abc123 --protocol tcp --port 3306 --cidr 0.0.0.0/0

AI CLOSE NOTES

TITAN CONDUIT opened this high network ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Cross-account IAM role trust policy uses wildcard principal (*). Any AWS account can assume this role — critical lateral-movement risk for banking workloads. SOX ITGC and FFIEC violation.

JUSTIFICATION

High: Cross-account IAM role trust policy uses wildcard principal (*). Any AWS account can assume this role — critical lateral-movement risk for banking workloads. SOX ITGC and FFIEC violation.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   aws iam update-assume-role-policy --role-name banking-crossaccount --policy-document file://fixed-trust-policy.json
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (iam-role-banking-crossaccount).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Cross-account IAM role trust policy uses wildcard principal (*). Any AWS account can assume this role — critical lateral-movement risk for banking workloads. SOX ITGC and FFIEC violation.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of iam-role-banking-crossaccount before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans iam-role-banking-crossaccount immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

aws iam update-assume-role-policy --role-name banking-crossaccount --policy-document file://fixed-trust-policy.json

AI CLOSE NOTES

TITAN CONDUIT orchestrated end-to-end: SCOUT detected the high identity incident, FORGE applied the consent-gated fix automatically (incident class), SCOUT rescan confirmed the finding cleared, and CONDUIT closed this ticket with a Successful close_code. Pre-change snapshot retained for 30 days for rollback.

THE SECURITY FINDING

GCS bucket 'gs-banking-statements-prd' holding customer monthly statements has uniform bucket access disabled and allUsers:storage.objectViewer binding. GLBA §501(b) safeguards violation.

JUSTIFICATION

Medium: GCS bucket 'gs-banking-statements-prd' holding customer monthly statements has uniform bucket access disabled and allUsers:storage.objectViewer binding. GLBA §501(b) safeguards violation.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   gcloud storage buckets update gs://gs-banking-statements-prd --uniform-bucket-level-access && gcloud storage buckets remove-iam-policy-binding gs://gs-banking-statements-prd --member=allUsers --role=roles/storage.objectViewer
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM risk — weaker control, should be hardened.
Business impact if unremediated: Control weakness that compounds with other gaps.
Scope: single resource (gs-banking-statements-prd).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: GCS bucket 'gs-banking-statements-prd' holding customer monthly statements has uniform bucket access disabled and allUsers:storage.objectViewer binding. GLBA §501(b) safeguards violation.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of gs-banking-statements-prd before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans gs-banking-statements-prd immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

gcloud storage buckets update gs://gs-banking-statements-prd --uniform-bucket-level-access && gcloud storage buckets remove-iam-policy-binding gs://gs-banking-statements-prd --member=allUsers --role=roles/storage.objectViewer

AI CLOSE NOTES

TITAN CONDUIT opened this medium storage ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Core-banking transfer API has managed identity with Contributor on the whole subscription — excessive blast radius. Reduce to minimum scoped permissions per CIS Azure 1.23.

JUSTIFICATION

High: Core-banking transfer API has managed identity with Contributor on the whole subscription — excessive blast radius. Reduce to minimum scoped permissions per CIS Azure 1.23.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az role assignment delete --assignee <principal-id> --role Contributor --scope /subscriptions/<sub> && az role assignment create --assignee <principal-id> --role 'Storage Blob Data Contributor' --scope /subscriptions/<sub>/resourceGroups/rg-banking-transfers
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (app-banking-transfers-prd).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Core-banking transfer API has managed identity with Contributor on the whole subscription — excessive blast radius. Reduce to minimum scoped permissions per CIS Azure 1.23.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of app-banking-transfers-prd before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans app-banking-transfers-prd immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az role assignment delete --assignee <principal-id> --role Contributor --scope /subscriptions/<sub> && az role assignment create --assignee <principal-id> --role 'Storage Blob Data Contributor' --scope /subscriptions/<sub>/resourceGroups/rg-banking-transfers

AI CLOSE NOTES

TITAN CONDUIT opened this high identity ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

KYC document storage account missing infrastructure-level encryption. FinCEN customer identification rules and GDPR Art. 32 require encryption at rest for identity documents.

JUSTIFICATION

High: KYC document storage account missing infrastructure-level encryption. FinCEN customer identification rules and GDPR Art. 32 require encryption at rest for identity documents.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az storage account update --resource-group rg-banking-kyc --name stgbankingkycdocs --require-infrastructure-encryption true
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (stg-banking-kyc-docs).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: KYC document storage account missing infrastructure-level encryption. FinCEN customer identification rules and GDPR Art. 32 require encryption at rest for identity documents.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of stg-banking-kyc-docs before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans stg-banking-kyc-docs immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az storage account update --resource-group rg-banking-kyc --name stgbankingkycdocs --require-infrastructure-encryption true

AI CLOSE NOTES

TITAN CONDUIT orchestrated end-to-end: SCOUT detected the high kyc incident, FORGE applied the consent-gated fix automatically (incident class), SCOUT rescan confirmed the finding cleared, and CONDUIT closed this ticket with a Successful close_code. Pre-change snapshot retained for 30 days for rollback.

THE SECURITY FINDING

Core-ledger SQL server missing auditing/diagnostic settings — no immutable audit trail for financial transactions. SOX §404 and SOC 1 Type II deficiency.

JUSTIFICATION

Medium: Core-ledger SQL server missing auditing/diagnostic settings — no immutable audit trail for financial transactions. SOX §404 and SOC 1 Type II deficiency.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az sql server audit-policy update --resource-group rg-banking-ledger --name sqlsrv-banking-ledger --state Enabled --storage-account <log-storage> --retention-days 2555
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM risk — weaker control, should be hardened.
Business impact if unremediated: Control weakness that compounds with other gaps.
Scope: single resource (sqlsrv-banking-ledger).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Core-ledger SQL server missing auditing/diagnostic settings — no immutable audit trail for financial transactions. SOX §404 and SOC 1 Type II deficiency.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of sqlsrv-banking-ledger before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans sqlsrv-banking-ledger immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az sql server audit-policy update --resource-group rg-banking-ledger --name sqlsrv-banking-ledger --state Enabled --storage-account <log-storage> --retention-days 2555

AI CLOSE NOTES

TITAN CONDUIT opened this medium logging ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Wire-instruction S3 bucket has server-side encryption disabled — wire fraud staging ground. SWIFT CSP 1.2, PCI DSS 3.4, and Fed Reserve Operating Circular violation.

JUSTIFICATION

High: Wire-instruction S3 bucket has server-side encryption disabled — wire fraud staging ground. SWIFT CSP 1.2, PCI DSS 3.4, and Fed Reserve Operating Circular violation.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   aws s3api put-bucket-encryption --bucket s3-banking-wire-instructions --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSMasterKeyID":"alias/banking-wires"}}]}'
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (s3-banking-wire-instructions).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Wire-instruction S3 bucket has server-side encryption disabled — wire fraud staging ground. SWIFT CSP 1.2, PCI DSS 3.4, and Fed Reserve Operating Circular violation.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of s3-banking-wire-instructions before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans s3-banking-wire-instructions immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

aws s3api put-bucket-encryption --bucket s3-banking-wire-instructions --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms","KMSMasterKeyID":"alias/banking-wires"}}]}'

AI CLOSE NOTES

TITAN CONDUIT opened this high encryption ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Databricks workspace running risk-model notebooks has token-based auth with 90-day tokens and no IP allowlist. Risk-model IP theft and insider-threat exposure per FFIEC and OCC expectations.

JUSTIFICATION

High: Databricks workspace running risk-model notebooks has token-based auth with 90-day tokens and no IP allowlist. Risk-model IP theft and insider-threat exposure per FFIEC and OCC expectations.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   databricks workspace conf set enableIpAccessLists true && databricks ip-access-lists create --json-file banking-allowlist.json
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (dbw-banking-risk-models).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Databricks workspace running risk-model notebooks has token-based auth with 90-day tokens and no IP allowlist. Risk-model IP theft and insider-threat exposure per FFIEC and OCC expectations.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of dbw-banking-risk-models before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans dbw-banking-risk-models immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

databricks workspace conf set enableIpAccessLists true && databricks ip-access-lists create --json-file banking-allowlist.json

AI CLOSE NOTES

TITAN CONDUIT opened this high database ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

GCP firewall rule fw-banking-api-ingress allows 0.0.0.0/0 on 8080 — unencrypted API traffic reachable from anywhere. Should be restricted to corporate egress + load-balancer only.

JUSTIFICATION

Medium: GCP firewall rule fw-banking-api-ingress allows 0.0.0.0/0 on 8080 — unencrypted API traffic reachable from anywhere. Should be restricted to corporate egress + load-balancer only.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   gcloud compute firewall-rules update fw-banking-api-ingress --source-ranges=35.191.0.0/16,130.211.0.0/22,10.0.0.0/8
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM risk — weaker control, should be hardened.
Business impact if unremediated: Control weakness that compounds with other gaps.
Scope: single resource (fw-banking-api-ingress).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: GCP firewall rule fw-banking-api-ingress allows 0.0.0.0/0 on 8080 — unencrypted API traffic reachable from anywhere. Should be restricted to corporate egress + load-balancer only.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of fw-banking-api-ingress before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans fw-banking-api-ingress immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

gcloud compute firewall-rules update fw-banking-api-ingress --source-ranges=35.191.0.0/16,130.211.0.0/22,10.0.0.0/8

AI CLOSE NOTES

TITAN CONDUIT opened this medium network ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Azure Data Factory for regulatory reporting has pipeline with hardcoded service-principal secret in linked-service JSON. Credential rotation is blocked; SOX §404 failure and secret-sprawl exposure.

JUSTIFICATION

Critical: Azure Data Factory for regulatory reporting has pipeline with hardcoded service-principal secret in linked-service JSON. Credential rotation is blocked; SOX §404 failure and secret-sprawl exposure.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az datafactory linked-service update --resource-group rg-banking-reporting --factory-name adf-banking-reg-reports --name ls-sql-core --properties @linked-service-keyvault-ref.json
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (adf-banking-reg-reports).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Azure Data Factory for regulatory reporting has pipeline with hardcoded service-principal secret in linked-service JSON. Credential rotation is blocked; SOX §404 failure and secret-sprawl exposure.

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of adf-banking-reg-reports before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans adf-banking-reg-reports immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az datafactory linked-service update --resource-group rg-banking-reporting --factory-name adf-banking-reg-reports --name ls-sql-core --properties @linked-service-keyvault-ref.json

AI CLOSE NOTES

TITAN CONDUIT opened this critical access_control ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

Banking-copilot OpenAI endpoint received 38 prompts containing raw customer SSNs, account numbers, and card PANs in the last 24h. GLBA §501(b) + PCI DSS 3.4 + SOX ITGC violation — card data + PII leaked into third-party LLM prompt logs. AI GUARD blocked exfiltration and rotated prompts.

JUSTIFICATION

Critical: Banking-copilot OpenAI endpoint received 38 prompts containing raw customer SSNs, account numbers, and card PANs in the last 24h. GLBA §501(b) + PCI DSS 3.4 + SOX ITGC violation — card data + PII leaked into third-party LLM prompt logs. AI GUARD blocked exfiltration and rotated prompts.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az cognitiveservices account network-rule add --name openai-banking-copilot --resource-group rg-banking-ai --ip-address 10.0.0.0/8 && titan-ai-guard apply-policy --policy banking-strict-pii
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: HIGH business risk — active exposure; fix required immediately.
Business impact if unremediated: Potential data exfil, privilege escalation, or compliance breach.
Scope: single resource (openai-banking-copilot).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Banking-copilot OpenAI endpoint received 38 prompts containing raw customer SSNs, account numbers, and card PANs in the last 24h. GLBA §501(b) + PCI DSS 3.4 + SOX ITGC violation — card data + PII leak

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of openai-banking-copilot before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans openai-banking-copilot immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az cognitiveservices account network-rule add --name openai-banking-copilot --resource-group rg-banking-ai --ip-address 10.0.0.0/8 && titan-ai-guard apply-policy --policy banking-strict-pii

AI CLOSE NOTES

TITAN CONDUIT orchestrated end-to-end: SCOUT detected the critical data_leak incident, FORGE applied the consent-gated fix automatically (incident class), SCOUT rescan confirmed the finding cleared, and CONDUIT closed this ticket with a Successful close_code. Pre-change snapshot retained for 30 days for rollback.

THE SECURITY FINDING

Fraud-detection Data Factory pipeline uses public-IR (Integration Runtime) — card-transaction data in-flight traverses Azure public backbone. FFIEC + SWIFT CSP Control 2.5B require private-network enforcement for payment data pipelines.

JUSTIFICATION

High: Fraud-detection Data Factory pipeline uses public-IR (Integration Runtime) — card-transaction data in-flight traverses Azure public backbone. FFIEC + SWIFT CSP Control 2.5B require private-network enforcement for payment data pipelines.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   az datafactory integration-runtime managed create --factory-name adf-banking-fraud-pipeline --resource-group rg-banking-fraud --name ir-banking-private --type SelfHosted && az datafactory linked-service update --vnet-integration
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (adf-banking-fraud-pipeline).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: Fraud-detection Data Factory pipeline uses public-IR (Integration Runtime) — card-transaction data in-flight traverses Azure public backbone. FFIEC + SWIFT CSP Control 2.5B require private-network enf

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of adf-banking-fraud-pipeline before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans adf-banking-fraud-pipeline immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

az datafactory integration-runtime managed create --factory-name adf-banking-fraud-pipeline --resource-group rg-banking-fraud --name ir-banking-private --type SelfHosted && az datafactory linked-service update --vnet-integration

AI CLOSE NOTES

TITAN CONDUIT opened this high data_factory ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)

THE SECURITY FINDING

AML scoring Databricks workspace has 14 notebooks with hard-coded Snowflake passwords + 3 Unity Catalog tables exposing raw wire data with no row-level security. BSA/AML recordkeeping + FFIEC data-classification policy breach — insider-threat + regulator-visibility risk.

JUSTIFICATION

High: AML scoring Databricks workspace has 14 notebooks with hard-coded Snowflake passwords + 3 Unity Catalog tables exposing raw wire data with no row-level security. BSA/AML recordkeeping + FFIEC data-classification policy breach — insider-threat + regulator-visibility risk.

IMPLEMENTATION PLAN

1. Pre-change snapshot captured by TITAN (auto-rollback available).
2. Execute fix command:
   databricks secrets put --scope aml-prod --key snowflake-pw && databricks unity-catalog grants update --full-name banking.aml_wires --row-filter amount_filter
3. TITAN FORGE verifies the fix was applied.
4. Post-change rescan by TITAN SCOUT — finding must no longer appear.
5. Close ticket with Successful close_code.

RISK & IMPACT ANALYSIS

Risk level: MEDIUM-HIGH risk — misconfiguration with realistic exploit path.
Business impact if unremediated: Increases attack surface; auditor finding likely.
Scope: single resource (dbw-banking-aml-notebooks).
Blast radius: change is idempotent; pre-change snapshot captured by TITAN; auto-rollback available if rescan fails.
Finding detail: AML scoring Databricks workspace has 14 notebooks with hard-coded Snowflake passwords + 3 Unity Catalog tables exposing raw wire data with no row-level security. BSA/AML recordkeeping + FFIEC data-cla

BACKOUT / ROLLBACK PLAN

1. TITAN auto-captured snapshot of dbw-banking-aml-notebooks before change (baseline: titan-banking-demo-20260422T201922Z).
2. If post-change rescan still shows the finding OR a new issue appears within 15 min:
   a. TITAN FORGE fires rollback automatically using stored snapshot.
   b. Incident reopens and escalates to on-call.
3. Manual rollback command path (human override) is documented in close notes.

TEST PLAN

1. TITAN SCOUT rescans dbw-banking-aml-notebooks immediately after FORGE applies the change.
2. PASS criteria: the specific finding no longer appears in SCOUT results.
3. PASS criteria: no new CRITICAL or HIGH findings introduced by the change.
4. Automated compliance check: HIPAA/PCI/SOC2 controls re-evaluated.
5. If any check fails, backout plan fires automatically.

RECOMMENDED FIX COMMAND

databricks secrets put --scope aml-prod --key snowflake-pw && databricks unity-catalog grants update --full-name banking.aml_wires --row-filter amount_filter

AI CLOSE NOTES

TITAN CONDUIT opened this high databricks ticket and assigned it to the banking_compliance group for review. STATE: ASSIGNED — awaiting human action. Per TITAN AI policy, configuration changes are NEVER auto-applied and tickets are NEVER auto-closed by TITAN. The assigned group reviews the recommended fix, schedules an approved maintenance window, applies the fix manually, validates via SCOUT rescan, and closes this ticket themselves. TITAN documents and routes — the human owns the change from here.

CTASK BREAKDOWN (4 sub-tasks · 3 TITAN-executed · 1 human-action · 0 closed by human)